There is no server. That is the security model.

What happens on your device

Recording, transcription, speaker identification, and summarization all run locally using open models (Parakeet for speech, CAM++ for voices, Gemma 4 or Qwen for summaries). No account, no login, no cloud. The models are named here on purpose, so the claim can be checked, not just believed.

What we can see

The app talks to the network for exactly two things. Downloading the app and its models from GitHub releases, and checking GitHub for updates. Those requests carry no meeting content. Like any download, GitHub's servers see the requesting IP address. We operate no servers, collect no analytics, and could not read your transcripts if we wanted to.

Your files, your format

Transcripts are plain Markdown files on your disk, in a folder you choose. Voice profiles are a human-readable JSON file you can open, inspect, and delete. Uninstalling the app leaves nothing behind anywhere else. There is no license server and no account, so the app keeps working even if we disappear.

Voice profiles and biometric law

Speaker profiles are created only when you name a speaker, stored only on your device, and deletable at any time. Courts have held that biometric data processed and stored entirely on the user's device is not possessed or collected by the software vendor (G.T. v. Samsung, 7th Cir. 2026, and Barnett v. Apple, Ill. App. 2023).

If you use voice profiles for other people, biometric consent laws such as Illinois BIPA may apply to you as the person deploying them. Get consent before naming coworkers' or clients' voices.

Recording consent is on you

Aloe Scribe records your meetings at your direction. Many states and countries require the consent of everyone on the call, regardless of where the recording is stored. Tell people you are recording. We recommend announcing it at the start of every meeting, and the app shows its recording state while capture is running. Local storage changes who can access your data. It does not change consent law.

Where we stand under GDPR

For meeting content, Aloe Scribe the company is neither a data controller nor a data processor, because we never receive the data. There are no international transfers and no subprocessors for your content. You, or your employer, control what you record. Workplace deployments in the EU should run their own assessment, particularly before enabling voice profiles for staff.

Supply chain, and how to verify us

• The strongest verification needs no trust in us at all: put the machine in airplane mode and record an in-person meeting. Transcription, speaker labels, and the summary all still happen, because everything runs locally. Your video call needs the internet. Aloe Scribe never does. Dependencies are pinned and hash-locked at build time.
• Releases publish SHA-256 checksums for their downloads.
• Model files are fetched over HTTPS from pinned release URLs.
• Dependencies are scanned continuously (GitHub vulnerability alerts, CodeQL, and a weekly audit).
• macOS notarization and Windows code signing are in progress and will appear here when live.

What we do not have

No SOC 2 report, because there is no service organization to audit. No cloud penetration test, because there is no cloud. The Windows beta installer is not yet code signed. If your security review needs a control mapping or the full list of network calls, ask, most hosted-service questions close as not applicable here, and we would rather show you than have you take our word.

Questions security reviewers ask

Where is our data stored and who can access it?

On the employee's device only, as Markdown and JSON files. The vendor has no access path. Data residency equals device residency, and your existing endpoint controls (FileVault, BitLocker, MDM) are the controls.

Could a compromised model exfiltrate data?

Models are static weights executed by the app. They have no network access of their own, and the app makes no content-bearing network calls regardless of what a model outputs.

What is our wiretap exposure if employees record meetings?

The same as with any recorder. Adopt a policy requiring verbal disclosure at the start of meetings, especially with participants in all-party consent states.

How are vulnerabilities reported?

Privately, through GitHub security advisories on the releases repository, or by email to feedback@aloescribe.ai.

What happens if the vendor disappears?

The app keeps working. No license server, no account, no dependency on our existence. Your files are open formats.

This page describes the product's architecture and cites court decisions about comparable architectures. It is not legal advice, and it does not make your recordings lawful. When in doubt about consent or biometric rules in your jurisdiction, ask a lawyer, and tell people you are recording.