Tota is a Mac dictation app that transcribes incident timelines, penetration-test findings and ticket updates entirely on-device, makes exactly three kinds of network call, all documented and none carrying content, and has no telemetry SDK to find.
It is hour six of an incident and the timeline needs writing while the details are still in your head: hostnames, the initial access vector, what the attacker touched. The last thing you would send that to is a cloud dictation vendor. Tota transcribes on your Mac, biases towards your own hostnames and tool names, and types the note into the ticket. You can watch it make no outbound connection while it does so.
Why a security team cannot use cloud dictation
Security writing is a list of things that must not leak: unpatched vulnerabilities, internal hostnames and IP ranges, the state of an incident, which controls failed. Cloud dictation apps upload the audio containing all of it, route it through third-party AI providers, and in some cases capture screenshots for context. The threat model writes itself.
The requirement is not a vendor's SOC 2 report; it is that the data never leaves the endpoint. Apple Silicon can run OpenAI's Whisper models locally, so there is no technical reason for dictation to touch a network at all. The question is whether a given app actually does that, and whether you can verify it rather than take it on trust.
Tota is designed to be verified. All processing is local, the app has no account and no analytics or crash-reporting SDK, and the security page lists every outbound call it can make. Put it behind Little Snitch and watch.
What security and IT teams actually dictate
- Incident timelines and post-mortems. Long, time-pressured notes dictated into the ticket or the incident doc.
- Penetration-test findings. Descriptions, impact and remediation for each finding, spoken into the report template.
- Ticket updates and change records. The short daily writing in Jira, ServiceNow or Linear.
- Runbooks and policies. Documentation drafts where talking through a procedure is faster than typing it.
- Risk assessments and vendor reviews. Structured documents where Smart Formatting's lists help.
What leaves your Mac, and what doesn't
This is the whole list. Every row is checkable from the app's own behaviour, and the security page explains how to watch its network activity yourself.
| Data | Leaves your Mac? | What actually happens |
|---|---|---|
| Your voice while dictating incident and vulnerability details | No | Recorded to a temporary file, transcribed on your Mac by Whisper via WhisperKit, then deleted. |
| The transcript | No | Typed into the app you are using. Kept in a local history for three days, then archived as Markdown in a folder you choose. Entries can be deleted. |
| Text on your screen | No | With “Spell what’s on your screen” on, the visible text of the window you are dictating into is read once, to bias spelling. Never stored or sent. Can be turned off. |
| Glossary terms and learned corrections | No | Stored as JSON files in Tota’s folder in Application Support. |
| Smart Formatting | No | Runs a local Qwen 3 language model via MLX. Off by default. |
| Audio files dropped in for transcription | No | Transcribed and speaker-labelled on your Mac. |
| Licence key and a machine identifier | Yes | Sent to api.lemonsqueezy.com at activation and validation. Never any content. |
| Update check | Yes | A download request to github.com at launch. Can be disabled in Settings. |
| Model downloads | Yes, one-way | Speech, formatting and speaker-ID model files from huggingface.co, once, on first use. |
| Usage analytics or crash reports | Never | There is no analytics or crash-reporting SDK in the app. |
How Tota works for security and IT professionals
Install the app, grant it microphone and accessibility access, and press Cmd+Shift+R wherever your cursor is. Tota records until you press it again, transcribes the audio on your Mac with OpenAI's Whisper model running through WhisperKit, and types the result into the field. There is also a hold-to-talk key for short entries and a “Hey Tota” wake word for hands-free use. It behaves like a keyboard, so it works in browser-based systems, Word, email, Notes and anything else with a text field, with no integration to request from IT. After the one-time model download it needs no internet at all.
Three optional layers sit on top. Smart Formatting runs a small local language model that fixes punctuation, turns “new paragraph” and “new list” into structure, and corrects stutters without rewriting what you meant. The auto-learning dictionary remembers the corrections you make. And Audio Drop transcribes audio files you already have, with automatic speaker labels, also on-device.
Workflows for a security team
- The incident timeline. Cursor in the incident doc, shortcut, talk. Hostnames and tool names come through because they are in your glossary. The audio is deleted once transcribed.
- Findings into the report. Dictate each finding's description and remediation into the template. Say 'new list' for the steps. Filler words are removed.
- Verifying the no-network claim. Install Little Snitch or LuLu, use Tota for a day, and compare what you see to the security page: a licence check at activation, an optional update check at launch, model downloads from huggingface.co on first use. Nothing else.
- Air-gapped or offline use. Once models are downloaded, the app runs with no network. Updates can be disabled in Settings.
A glossary for security and IT professionals
Security vocabulary is acronyms, tool names and hostnames that general speech recognition has never seen. A Tota glossary is a short list of terms the speech model is nudged towards while it transcribes, with sound-alike matching afterwards for anything it still mishears. A team glossary might hold:
- internal hostnames and environment names
- CVE
- OWASP
- SIEM
- EDR
- Kerberos
- IAM
- nmap
- Burp Suite
- CrowdStrike
- Okta
- teammates' names
The Development starter glossary covers common tooling; add your own environment's names. The live hint has room for roughly 70 to 90 words. Glossaries are plain JSON files in Tota's Application Support folder, so a team can keep one in a repo.
Tota ships with a built-in Development starter glossary you can edit, and the glossaries guide covers set-up, the hint budget and per-app switching.
What Tota does not do
- It is not sandboxed from your screen. With 'Spell what's on your screen' on, Tota reads the visible text of the window you are dictating into at the moment you start, to bias spelling. It is never stored or transmitted, and the setting can be turned off.
- Secure keyboard entry blocks it. When a terminal or password field enables secure input, macOS blocks all apps' hotkeys and keystroke injection. Tota shows a banner and waits.
- It has no third-party audit. Tota is not SOC 2 or ISO 27001 certified. The claim is that there is nothing to certify: no server processes content. The security page and a firewall are how you check it.
- Transcripts are files on your Mac. Nothing is synced or backed up by Tota. FileVault, your backup tool and your device policy are what protect them.
Pricing for a security team
Tota is a one-time purchase of £19.99, with two seats per licence, after a 14-day free trial of every feature. There is no subscription, no per-minute transcription fee and no word limit, because local processing costs us nothing per word. Larger teams buy additional licences. Pricing is the same worldwide; see the pricing section for what the licence includes.
Frequently asked questions
What network connections does Tota make?
Three kinds: a licence check to api.lemonsqueezy.com at activation and validation, carrying the licence key and a machine identifier; an update check to github.com, which can be disabled; and one-way model downloads from huggingface.co on first use of a model. No audio, text or screen content is ever sent. There is no analytics or crash-reporting SDK.
How do I verify that?
Run Little Snitch, LuLu or a packet capture while using the app. Compare what you see to the security page, which enumerates every call. Updates are delivered by Sparkle and verified against an EdDSA public key before installing.
Is the app signed and notarised?
Yes. Tota is signed with a Developer ID certificate, notarised by Apple and built with the hardened runtime.
Can it run with no network at all?
Yes, after the initial model download. Disable the update check in Settings and the app makes no connections except the periodic licence validation, which has a seven-day offline grace period before the app asks you to reconnect.
Does it work in Jira, ServiceNow, Linear and the terminal?
Yes. Tota types into any text field, including browser-based tools. In terminals it works unless secure keyboard entry is enabled, which blocks all apps' hotkeys at the macOS level.
What does it cost?
£19.99 once, after a 14-day free trial, with two seats per licence. No subscription and no word limit.
Dictate the incident notes on an endpoint that stays quiet
Download Tota, put it behind your firewall of choice, and write the timeline. Two seats, £19.99 once.
14-day free trial · macOS 14 or later · No account needed
