VoiceIDVault
Recognise callers by their voice, not security questions
For: Contact-center operators in banking, telecoms, insurance and other regulated industries, their security and data-protection teams, and developers adding voice authentication to their own products.
VoiceIDVault checks in the first seconds of a call whether the caller's voice matches the customer on record. It works as a second factor next to the phone number, and the agent sees 'verified' or 'not verified' before asking the first question.
It is built for contact centers, and for developers who want voice authentication in their own apps through a REST API, JavaScript/TypeScript and Python SDKs, or a drop-in widget. Self-serve plans run from a developer tier up to enterprise volumes.
The problem is that security questions no longer protect: dates of birth and customer numbers sit in data leaks, but a voice cannot be looked up. Identification runs while the caller states their request, so the question-and-answer loop at the start of every call shrinks.
The service is designed around data protection and works councils. Callers give explicit consent once, only an encrypted voiceprint is stored (not the recording), every check scores the risk of a synthetic voice, and on error or doubt the answer is 'not verified', so the agent falls back to the usual questions and nobody is locked out.
30 days
single-queue pilot with written success criteria
AES-256-GCM
encryption for stored voiceprints
$97
per month, entry developer plan
1.1.0
JS/TS and Python SDKs published
What it does
Caller verification in the first seconds of a call, shown on an agent screen
One-time enrolment by keypress consent and a few seconds of speech
Deepfake screening on every check, failing closed on error or doubt
Explicit GDPR Art. 9 consent recorded with time and text version; withdrawal deletes the voiceprint
Tamper-evident, write-once audit log of consents, sign-offs and role changes
REST API plus JavaScript/TypeScript and Python SDKs for enrol, verify and delete, with proof of consent
Drop-in JavaScript widget with a brand editor that applies your colours, font and logo
Connects to phone systems over SIP for a 30-day single-queue pilot
How we architected it
- Next.js
- React
- TypeScript
- Supabase
- Vercel
- Vercel KV
- Fly.io
- ECAPA-TDNN
- Resemble Detect
- AWS KMS
- AWS S3 Object Lock
- AWS Rekognition
- Stripe
- Sentry
- Twilio
- Asterisk
- @node-saml
- Azure MSAL
- SimpleWebAuthn
- 01
Speaker recognition runs on an ECAPA-TDNN model in a dedicated voice service on Fly.io in Frankfurt; voiceprints are versioned by model, so no cross-model matching occurs
- 02
Next.js API on Vercel functions in Frankfurt (fra1), with the Supabase database and KV store in Frankfurt and failover in Amsterdam
- 03
Two-layer deepfake screening: a local DSP check on every verification, plus Resemble ML detection on risk triggers and a sample of calls
- 04
Biometric data encrypted at rest with AES-256-GCM using KMS envelope encryption; only voiceprints are stored, never raw recordings
- 05
Audit trail chained with HMAC and stored on S3 Object Lock (write-once) for tamper evidence
- 06
Tenant-bound API keys on the v1 enrol, verify and delete routes, per-tier quotas, rate limiting and fail-closed route tests
- 07
Enterprise identity options in the codebase include OAuth2/OIDC SSO (MSAL), SAML and WebAuthn; a phone gateway runs on Asterisk
- 08
Face recognition via AWS Rekognition is available on higher plans as a secondary modality; iris is on the roadmap
Want something built like this?
Every build runs the same five gates: spec, architect, build, review, ship. It starts with a 48-hour audit.