Most dictation vendors answer security questions with certifications — audits of how their servers handle your data. Tota's answer is architectural: there is no Tota server that processes user content. Transcription, AI formatting, and speaker identification all run on your Mac. So instead of a compliance page, this is a transparency page: every network connection the app can make, enumerated, with what's sent and when — so you can verify the claims rather than trust them.
1. On-Device Processing
Tota's speech recognition runs locally via WhisperKit (open-source, built for Apple Silicon). Smart Formatting runs on a local language model via MLX. Speaker identification for audio files runs on local CoreML models. None of these features has a cloud fallback or cloud mode — your audio, transcripts, and prompts are never sent anywhere, in any configuration.
2. Every Network Call the App Makes
This is the complete list. On its own initiative, Tota can contact exactly three services:
| Purpose | Destination | What's sent | When |
|---|---|---|---|
| License activation & validation | api.lemonsqueezy.com (our payment provider) | Your license key and a machine identifier. Never any content. | When you activate or deactivate; a revalidation at most once every 24 hours, with a 7-day offline grace period |
| App updates (Sparkle) | github.com — our public releases repository | A standard download request. Sparkle's optional system profiling is not enabled — no system info is sent. | Update check at launch (can be disabled in Settings) or when you click “Check for Updates” |
| AI model downloads | huggingface.co | Nothing — these are one-way downloads of speech, formatting, and speaker-ID model files. | Once, on first use of a non-bundled model, Smart Formatting, or speaker identification |
That's the whole list. Voice commands you configure (like "visit YouTube") open URLs in your default browser — that's your browser making the request to your chosen destination, not the app phoning anywhere.
3. What the App Never Sends
- No audio or transcripts. There is no code path that uploads recorded audio, transcribed text, or formatting prompts.
- No analytics or telemetry. The app contains no analytics, crash-reporting, or tracking SDK of any kind, and collects no usage data.
- No account. There is no sign-up, login, or user profile. The only identity the app has is your license key.
4. Data Storage
- License key: stored in the macOS Keychain — not in a plaintext config file.
- Transcription history, dictionary, glossaries, snippets, settings: stored locally on your Mac, under your control. We hold no copy — there is nowhere for us to hold one.
5. Application Integrity
- Signed and notarized: every release is signed with our Apple Developer ID certificate, built with the hardened runtime, and notarized by Apple.
- Cryptographically verified updates: updates are delivered by Sparkle and verified against our EdDSA public key before installing — a tampered update won't install.
- HTTPS only: the app uses Apple's default App Transport Security with no exceptions — every connection above is TLS-encrypted.
- Minimal permissions: the app requests microphone and accessibility access to do its job — dictating and typing into other apps — and nothing else.
6. Verify It Yourself
Don't take this page's word for it. Run Tota alongside a network monitor (Little Snitch, LuLu, or Apple's own nettop) and watch: after models are downloaded, day-to-day dictation generates no traffic at all. The only hosts you'll ever see are the three above (plus their content-delivery subdomains). Turn WiFi off entirely — dictation keeps working.
For the wider argument about why on-device beats audited clouds for confidential work, see offline dictation for Mac.
7. Reporting Vulnerabilities
If you believe you've found a security vulnerability in Tota, email team@heytota.com. We take reports seriously and will respond promptly.
