API content
Audio and model outputs are processed only to return the requested result and are not retained after the response.
Security and trust
The public controls below describe the production Speech API and developer portal. They deliberately avoid claiming certifications or contractual service levels oruk does not currently hold.
Last updated July 12, 2026
Model training
Customer audio and outputs are not used to train, fine-tune, or evaluate models.
Credentials
Passwords and API key secrets are stored only in non-recoverable form. Complete API keys are shown once.
Transport
Public website, account, billing, and inference traffic use encrypted HTTPS connections.
Stored records
Account, billing, audit, and usage metadata use provider-managed encryption at rest and role-restricted access.
Payments
Card details are entered on Stripe-hosted pages and are not stored by oruk. Verified webhooks are required before credits are issued.
Operational architecture
01 / Authenticate
Keys are validated against active organizations, expiration, revocation state, and available prepaid balance.
02 / Reserve
Each request reserves its maximum billable amount before inference, preventing concurrent overspend.
03 / Settle
Successful inference appends one idempotent usage debit. Failed requests release their reservation.
Subprocessors
No payment provider or marketing analytics service receives customer API audio.
| Provider | Purpose | Processing location |
|---|---|---|
| Cloudflare | Website delivery, account control plane, usage records, edge security, and transactional email | Global routing; account records in managed infrastructure |
| Google Cloud | Speech inference | United States |
| Stripe | Payment processing, saved payment methods, receipts, and invoices | Stripe-managed regions |
| Resend | Fallback transactional email delivery when configured | Provider-managed regions |
| Google Analytics | Public marketing-site analytics only; excluded from authenticated account pages | Provider-managed regions |
Incident handling
Report a suspected security issue to access@oruk.ai. Reports are triaged by impact, contained, investigated, and communicated to affected customers when required.
Contracts and review
Security questionnaires, data-processing terms, and deployment requirements are handled during an enterprise review. Public commitments remain in the Privacy Policy and Terms.