Security

We try to be specific here, not aspirational. If something below is unclear, email security@dictates.app.

Managed API path

Dictate uses one managed API path for transcription and account-backed user data. Audio is sent to the Dictate API, forwarded to the configured transcription provider, and discarded when the request completes. Settings, glossary entries, and transcript history are stored through the API so your account is the source of truth.

Secure Enclave + App Attest

On first launch, Dictate generates a P-256 keypair inside Apple’s Secure Enclave and obtains an App Attest attestation from Apple’s servers. Each transcription request is signed with that enclave-resident key. We verify the signature server-side against the attested public key.

The benefit: your subscription is bound to the Macs you actually use in a way that survives reinstalls (because the device fingerprint is stable), without a Dictate password, and rejects obvious abuse vectors (replay, modified binaries).

Transcript history

Dictate no longer saves recording history folders on your Mac. History is account-backed and contains transcript text plus metadata such as duration, model, and timestamps. Source audio is not kept in history.

Offline entitlements

Each successful transcription returns a short-lived signed entitlement ticket (P-256 ECDSA) so the app can keep working briefly when you lose network — typical case: dictating in flight or on a tunnel ride. The Mac app verifies the signature against an embedded public key on every use.

Minimum macOS

Dictate requires macOS 15 or later. That is the app's deployment target, and it is the gating constraint for installation. App Attest itself works on macOS 14 and later on Apple Silicon, but the app will not launch on anything below macOS 15.

Vulnerability disclosure

Please email security@dictates.app with reproduction steps and a proof-of-concept where reasonable. We aim to acknowledge within 2 business days. We don’t (yet) offer a paid bounty, but we’ll publicly credit you in our changelog if you’d like.