Dictation your security team can actually sign off

Last updated 11 September 2026

The question a review actually asks

Security reviews of dictation software converge on one thing: where does the audio go, and who else can hear it? Everything else — encryption, retention, subprocessors, breach notification — exists because the answer is normally "to the vendor".

When recognition runs on the endpoint, most of that questionnaire stops applying. Not because we have good answers, but because the questions are about a transfer that does not happen.

What we do not have

Listing this properly is more useful than a sales conversation that discovers it in week three.

• No certifications. Not ISO 27001, not SOC 2, not HIPAA-attested. We are a small UK company and we claim none of them. If a certification is a hard gate, we will not pass it.
• No SSO or SCIM. Licences are per user, managed by the individual or by whoever bought them.
• No MDM configuration profile. Settings are per machine. You cannot centrally enforce, for example, a maximum history retention.
• No admin console. No central view of who is using what.
• No audit log. Dictation history is local to each Mac and visible to that user.
• Mac only. Apple Silicon (M1 or later), macOS 14 Sonoma or later. Windows is in development with no date promised.

What deployment looks like

1. One machine first Install, complete first run, verify the architecture by disconnecting the network and dictating. Record the date.
2. Check your accessibility permission policy Dictation needs accessibility permission to type into other applications. Managed Macs often restrict this, and it must be allowed or nothing works. This is the most common blocker.
3. Decide the retention position Users can set history retention themselves. Decide what you want it to be and tell them, because you cannot enforce it centrally.
4. Confirm FileVault is enforced The local history sits on the disk. FileVault is what protects it, and you probably already require it.
5. Decide on cloud rewriting An optional rewrite step can be pointed at a cloud provider. If that is not acceptable, say so in the rollout note — the default is local.
6. Pilot with five people for a fortnight Then decide. Dictation adoption is highly individual; some people take to it immediately and some never do.

Who this suits

• Professional services firms. Law, accountancy, consultancy — client-confidential material and a partner who has to sign it off.
• Healthcare administration. With the caveat that we hold no HIPAA attestation; the architecture helps, the paperwork does not exist.
• Security and engineering teams. Where the content of a note is the thing being protected.
• Organisations with air-gapped or restricted machines. On-device recognition works where nothing else does.
• Small teams without a procurement department. Where architecture is the assurance and a certification would be theatre.

Who it does not suit: organisations needing central policy control, a certification, SSO, or Windows today. See dictation for confidential work for the decision framework.

Licensing

Pro covers 2 active devices per licence, which handles the laptop-and-desktop case. For a team, buy volume rather than individual seats — talk to us rather than putting twenty purchases through expenses.

Lifetime options exist (£29.99 for Founder Lifetime, £79.99 for Pro Lifetime), which some organisations prefer to a renewal they have to justify annually. Prices are in pounds sterling; VAT is added at checkout where it applies. Every purchase is refundable in full within 14 days.