Encryption begins in your browser
Audio is encrypted before upload, and no usable recovery key is stored by CleanWave.
Zero-Access confidential processing
Your audio is encrypted before CleanWave receives it.
CleanWave retains no usable recovery key. Its operators and ordinary systems cannot decrypt stored audio, transcripts or the personal information inside them.
The key stays with you
Encrypted content can be opened only inside a verified, hardware-protected processing environment.
Confidential processing verified
What “Zero-Access” means at CleanWave
CleanWave cannot read or recover content stored for a Zero-Access project because its operators and ordinary infrastructure do not have the usable decryption key. Account, billing and operational metadata remain available where necessary to provide and secure the service.
Technical controls
Designed to minimize trust.
Verified confidential processing
Processing is restricted to a hardware-protected environment whose identity is verified before encrypted content can be opened.
Access is minimized
Readable project content is available only for the limited time and purpose required to perform the requested analysis.
Encrypted project data
Stored audio, transcripts and suggested redactions remain encrypted and inaccessible to ordinary CleanWave systems and operators.
Local final export
Your review edits and the final silence operation stay on your device. The completed WAV is created locally.
Short, enforced retention
Projects remain available after download and are purged when you delete them or automatically within 24 hours of upload.
Clear boundaries, not vague promises.
Security claims are useful only when their limits are visible.
Approved service providers support processing
Selected subprocessers may temporarily handle content only to provide the analysis you request. Current providers and purposes are disclosed in our legal pages.
A lost key cannot be recovered
Clearing browser storage or changing devices can make an unfinished encrypted project permanently inaccessible. This is a consequence of CleanWave not holding a recovery key.
Zero-Access protects project content
It does not hide account identity, credit balance, billing records or minimal security logs needed to operate the service.
Operational security
The surrounding service is restricted too.
- TLS for every network connection
- Private object storage with short-lived, object-scoped links
- Least-privilege service accounts and grouped secrets
- Signed authentication, rate limits and tenant isolation
- Confidential worker scales to zero when no project needs it
- Automated deletion plus a 24-hour retention backstop
Questions about our security?
Report a concern or ask for technical and organizational information.