Security and procurement answers
For whoever has to approve Vocula at your organisation. The short version: dictation never leaves the Mac, there is no account, and there is no subprocessor that sees what anyone says. The rest of this page is the detail, and how to check it without taking our word; the privacy page goes further into what is stored on disk.
The short version, for a questionnaire
- Data leaving the device: none from dictation — no audio, no text.
- Accounts: none. The app has no sign-in and holds no user record.
- Telemetry, analytics, crash reporting: none.
- Subprocessors for dictation: none. Recognition runs on the Mac.
- Network connections: two, both to Vocula’s GitHub releases — the model, once, and a daily version check that can be switched off.
- Licensing: offline. No licence server, nothing to revoke or phone home to.
- Source: published under GPL-3.0 at GitHub.
Where each piece of data goes
| What | Where it lives | Leaves the Mac? |
|---|---|---|
| Audio | In memory, only while the key is held. Never written to disk. | No |
| Transcript | Pasted at the cursor through the system pasteboard, which is restored about a second later. | No |
| Dictation history | On disk, one file per day, AES-GCM encrypted, kept a year; can be switched off. The key is in the login Keychain — not bound to this Mac’s hardware. | No |
| Licence check | An Ed25519 signature verified against a public key compiled into the app. | No |
| Speech model | Downloaded once from Vocula’s own GitHub release and checked against a SHA-256 built into the app. | Inbound only |
| Version check | Once a day while the switch in Settings → Permissions is on (it ships on). Fetches one signed file. | A request carrying IP address and app version |
| Diagnostic log | Local: app and macOS versions, Mac model, per-dictation timings and outcomes, audio-device identifiers — never transcript text. | Only if the user presses Report a problem, which opens their own mail client |
Parties involved, and what each sees
- GitHub hosts the app, the model and the version file. It sees the requests any web server sees — IP address and user agent — and counts downloads. It never sees dictation.
- Creem is the merchant of record for purchases: it takes payment, handles VAT and issues the receipt, so it holds the buyer’s name and e-mail. The licence key is signed and mailed without being stored. No purchase is ever linked to anything dictated.
Verify it yourself
Run nettop -p Vocula while dictating and watch the counters
stay at zero, or put the Mac behind LuLu or Little Snitch for a week: the
only connection you will see is the daily version check to GitHub, and none
once it is switched off. The full ten-minute
procedure works on any dictation app, not only this one.
Permissions it asks for, and why
- Microphone — to record while the key is held. The mic opens on the key and closes on release.
- Input Monitoring — to see the dictation key from any app.
- Accessibility — to paste the text where the cursor is.
It refuses to paste into password fields. It also refuses if another app turns on macOS’s secure input during the dictation itself — but not if secure input was already on beforehand, because a background terminal or password manager can hold that flag all day and refusing on it would block every dictation.
Updates
Updates use Sparkle with a signed feed, and each update is checked against a key built into the installed app before it is unpacked. Nothing installs without the user’s say-so, and Mac profile data is not sent. Organisations that prefer to control versions can switch the daily check off and distribute releases themselves.
What it does not protect against
- Someone using the Mac while it is unlocked — they can read the history in the app, as its owner can.
- Software already running as the user with enough privilege to reach the Keychain or the app’s memory.
- What happens to text after it is pasted into another application.
FileVault is worth enabling regardless: it protects a Mac that is switched off.
Compliance questions
- GDPR. Dictation is processed only on the user’s Mac and never reaches us, so there is no processing of dictated content on our side to cover in a data-processing agreement. The only personal data we handle is the buyer’s, through Creem, for the purchase.
- HIPAA. We do not sign BAAs. Vocula never receives, stores or transmits what is dictated; whether that means no business associate relationship arises is for your compliance officer to confirm.
- SOC 2. We have none and will not imply otherwise.
- GPL-3.0 in a corporate policy. Some IT policies flag GPL software for approval. GPL obligations attach to distributing or modifying the software, not to using it; your legal team can confirm how your policy treats internal use. The source and the local build.
Deployment and removal
There is no admin console, SSO, MDM package or usage dashboard, because
nothing reports anywhere. A team licence is one key, pasted once per Mac.
To remove the app and everything it stored, delete it, then
~/Library/Application Support/app.vocula.mac/ and
~/Library/Caches/app.vocula.mac/; defaults delete
app.vocula.mac clears its settings.
For offboarding: the history key lives in the login Keychain and is not bound to the Mac’s hardware, so if that keychain is carried to a new Mac — a Migration Assistant transfer, for example — the old history is readable there. Deleting the app and its files, above, is what ends access.
Reporting a vulnerability
Through GitHub’s private vulnerability reporting on the repository’s Security tab. One person reads it and acknowledges within a week.
Team licences for 10, 20, 30 people are $240, $420 and $540 once, with an invoice carrying your company name, address and VAT number — pricing, or write to [email protected] with your questionnaire.