Our security model
Voyage is designed around an instructor-owned workspace. Every tenant record is assigned to a workspace, and each request must prove that the signed-in user has an active membership in that workspace. An email address by itself is never an authorization boundary.
The application applies layered controls across identity, workspace access, storage, payments, and background jobs. Security is an ongoing program rather than a one-time certification claim, and deployment controls must be configured and verified by the production operator.
Identity and access
Instructor accounts require email verification before a trial or student invitation can be activated. Student accounts are invitation-only. Invitation tokens are time-limited, single-use, stored in hashed form, and accepted only by the verified intended recipient.
- Server-verified identity and role information
- Explicit workspace membership checks on tenant requests
- Rate limits for covered public and sensitive endpoints
- Idempotency and signed-event verification for covered payment and automation flows
Data isolation and encryption
Voyage uses managed Google Cloud and Firebase services with encrypted network connections and provider-managed encryption at rest. The repository keeps production credentials out of source code; a production deployment must store them in managed secret storage and restrict them to the required service identity.
A student who trains with more than one instructor chooses the active workspace explicitly. Records, messages, reports, invoices, and files are queried and authorized within that selected workspace.
Private files and sensitive documents
Voyage does not retain images of government IDs or medical certificates. Instructors can record only the verification status and relevant dates needed for their workflow.
Permitted lower-risk training files use private object storage, validated upload types and sizes, quarantine status, and an authorization check on every download request. Production must connect the quarantine callback to a trusted external malware scanner before uploads are enabled; a file is unavailable until that scanner reports it clean. Do not upload identity documents, medical records, card information, or account secrets.
Payments
Stripe hosts subscription and student-payment entry. Voyage does not receive or store full payment-card numbers. Instructor subscription events and connected-account payment events are verified by signed webhooks and applied idempotently.
For student invoices, the instructor operates the connected Stripe account and is the merchant of record. Stripe provides its own account security, onboarding, and payment controls.
Reliability, recovery, and monitoring
Voyage exposes live and ready health checks and returns non-cacheable responses for authenticated and API routes. Application logging intentionally avoids student notes, invitation tokens, payment details, and sensitive verification content.
Before launch, the production operator must configure and verify structured log redaction and retention, uptime checks, scheduled-job and webhook monitoring, error and delivery alerts, point-in-time recovery or protected backups, and a documented restoration test. These are deployment requirements, not controls this page represents as already active.
Report a security issue
If you believe you found a vulnerability, email support@voyage-us.com. Include the affected URL, a concise reproduction, and potential impact. Do not access another person's data, disrupt service, or publish the issue before we have had a reasonable opportunity to investigate.
Do not send passwords, secret keys, government IDs, medical records, or payment-card information in the report. We will acknowledge and prioritize reports based on evidence and impact.