Security · Network disclosure
Every connection this app can make.
For IT security reviewers, data-protection officers, procurement — and anyone who wants to verify the local-first claim instead of taking it on faith. Kept in lockstep with the code: when a release adds or changes a connection, this page changes in the same release.
Last verified against v0.6.20 · 2026-06-10
The core promise
Meeting audio, transcripts, summaries, and voiceprints never leave the device. Transcription (whisper.cpp), speaker diarization (pyannote/ONNX), voice matching, and LLM summarization all run locally. The table below is the complete list of network traffic the app can generate — what each connection carries, and how to turn it off.
Applies to v0.6.20 and later. In earlier versions (≤ 0.6.19) the network audit log does not yet record licence and referral calls and Hard Offline Mode does not block them; the strict webview CSP and the “Your data” panel also arrive in v0.6.20.
How to verify this yourself
- In-app audit log: Settings → Privacy → Network log shows every outbound attempt (timestamp, host, purpose, allowed/blocked) and exports as JSON-lines. The underlying file is
%APPDATA%/<app-id>/network-audit.jsonl. - Hard Offline Mode (Settings → Privacy) blocks every connection in the table before any DNS lookup or socket opens (loopback/LAN destinations excepted). Telemetry, which uses the Sentry SDK's own transport, is forced off by offline mode at its own gate.
- Or watch the wire: run Wireshark or Process Monitor against the app process. With offline mode on — or simply no cloud features configured — you should see no traffic beyond the optional update check.
Connections
| # | Purpose | Destination | When | What is sent | Off switch |
|---|---|---|---|---|---|
| 1 | Auto-update check + download | GitHub Releases (public release repo) | App start / manual “Check for updates” | HTTP GET only; no user data. Standard HTTP metadata (IP, user agent) reaches GitHub. Updates are ed25519-signature-verified before install. | Hard Offline Mode pauses it; per-brand auto-update flag |
| 2 | AI model download | GitHub (public model repo) | First-run wizard, model change, repair — always user-initiated | HTTP GET of model files; no user data | Don't run downloads; offline mode blocks |
| 3 | Licence activation / daily heartbeat / deactivation | Licence API (localtranscript.com) | Only when a licence key is stored. Domain-activated (corporate) and free installs send nothing | Licence key, machine fingerprint (SHA-256 of hardware IDs — no serial numbers in clear), hostname hint, OS, app version, account email | Don't activate online (offline token paste exists); Hard Offline Mode blocks (90-day grace period applies) |
| 4 | Referral program | Referral API (localtranscript.com) | Only after the user explicitly joins the referral program | Email, referral code, machine fingerprint, marketing-consent bit | Don't join; Hard Offline Mode blocks |
| 5 | Crash + performance telemetry | Sentry, EU region (*.ingest.de.sentry.io) | Opt-in, default OFF. Only in builds compiled with a DSN, only after the user consents (setup wizard or Settings) | Scrubbed crash reports + timing spans: app version, hardware tier, error stacks with usernames redacted on-device. Never audio, transcripts, names, or file contents | Default is off; Settings toggle; Hard Offline Mode overrides to off |
| 6 | Cloud transcription / cloud AI (optional providers) | OpenAI, Anthropic, or Infomaniak (Switzerland) — user's choice | Only when the user explicitly configures a cloud provider with their own API key. Local is the default | Meeting audio (cloud transcription) or transcript text (cloud AI actions) — to the provider the user chose, under the user's own account | Never configure a provider; “local” is the default; Hard Offline Mode blocks |
| 7 | Calendar fetch (iCal) | The user's own calendar URL | Only when the user configures a calendar URL | HTTP GET of the iCal feed | Don't configure; offline mode blocks (LAN URLs still allowed) |
What never has a network path
Recording, transcription, diarization, speaker/contact matching, voiceprint creation, semantic search, and local LLM summarization — there is no code path that uploads meeting content unless the user configured connection #6 themselves.
The meetings database (SQLite), audio clips, and contact voiceprints live in the app's local data folder (Settings → Privacy → “Your data” shows and opens it; “Delete all data” erases it). The app does not encrypt this folder itself — it is protected by your Windows user account; we recommend BitLocker disk encryption.
Enforcement in code (for reviewers)
All HTTP in the table routes through a single chokepoint (net_guard): it writes the audit line and, in Hard Offline Mode, rejects non-LAN destinations before any DNS resolution. Exceptions by design: #1 (updater — paused by offline mode at the call site) and #5 (Sentry SDK transport — gated off at initialisation and at send time instead). The webview runs under a restrictive Content-Security-Policy, so frontend code cannot contact arbitrary hosts even if compromised.
For IT & data protection officers
Data minimisation by architecture: in the default configuration, meeting content is processed only on the device — there is no cloud processor to assess for FADP/GDPR purposes. Speaker recognition is local-only biometrics: voiceprints are created, stored, and compared on the machine. Hard Offline Mode plus the exportable audit log are designed to serve as the procurement demo.
White-label builds and managed installs (MSI for SCCM / Intune / Group Policy) are available, including pre-baked defaults. Questions, DPIA support, or a pilot: hello@localtranscript.com.
Free forever · no card · no account