Security review pack
Everything your security review will ask, in one place.
Mythral is dictation and meeting notes for Mac. Speech recognition, writing and notes run on Apple silicon with local models. There are no Mythral servers, no accounts and no telemetry, so there is no customer data for us to hold, lose or hand over.
At a glance
Customer data held by MythralNone. Recordings, transcripts, notes and dictations stay on the Mac where they were made.
SubprocessorsNone. No Mythral service receives customer content, so no third party processes it on our behalf.
HostingNone for customer data. The app and its models run on your Macs.
Accounts and SSONo accounts. Nothing to provision or deprovision.
Telemetry and analyticsNone in the app.
Encryption at restTranscripts, notes and dictations are AES-GCM encrypted per record. Kept meeting audio is AES-GCM encrypted once its notes are written. FileVault encrypts the disk underneath.
Encryption in transitNo customer content is transmitted. The few connections the app can make (below) use HTTPS, and offline mode turns them all off.
Data residencyThe Mac the meeting or dictation happened on.
Retention and deletionSet and locked by your organization: transcripts, dictation history and meeting audio each have a retention setting. Deleting a meeting deletes its transcript, notes and audio. An uninstall script removes the app and, if you choose, every account's data.
Code signingSigned with an Apple Developer ID and notarized by Apple.
UpdatesEach update is signed with an EdDSA key built into the app and checked before it installs. Your organization can turn self-updating off and push approved versions itself.
LicensingA signed license key in your configuration profile, checked on the Mac. No license server.
Admin visibilityA local status file on each Mac (version, models installed, license, offline state) that your MDM can read. Never anything anyone said.
RequirementsApple silicon Mac · macOS 14.4 or later. 16 GB of memory recommended for meeting notes.
Every connection the app can make
With OfflineMode set by your organization, the app makes none of its own. Nothing anyone says, types or records is ever sent.
WhatWhereWhen
Model downloadshuggingface.coOnce, at first run, if the models were not installed. Never with the organization installer.
Update checkmythral.dev, then github.com for the downloadOnce a day. Carries the app version and nothing else. Off with UpdatesAllowed or OfflineMode.
Website wordsThe site the person types inOnly when someone adds a website for its vocabulary. Off with OfflineMode.
Microsoft 365 calendarlogin.microsoftonline.com, graph.microsoft.comOnly if someone signs in with their work account. Reads their own calendar, read-only. Nothing goes to Mythral. Off with MicrosoftCalendarAllowed or OfflineMode.
Help, feedback, email draftsmythral.dev, Gmail or Outlook on the webOpened in the person's browser when they choose. The app itself sends nothing.
What is stored, and where
WhatWhereProtection
Transcripts, dictations, notesThe app's folder in the person's LibraryEvery record encrypted with AES-GCM. FileVault covers the disk.
Meeting audioThe app's folderEncrypted with AES-GCM once the notes are written, opened only to play back. Kept only as long as the retention policy allows.
A failed dictationA temporary folderEncrypted with a key held only in memory. Deleted after five minutes.
Word listsThe app's folderPersonal lists and how each word is misheard, encrypted with AES-GCM.
Learned correctionsThe app's folderOnly the word pairs a person corrected, encrypted with AES-GCM. Listed in Settings with Remove.
Diagnostics logThe app's folderCounts and timings, never words. Leaves the Mac only if someone attaches it to a report.
ModelsThe app's folder, or shared from the installerChecked against pinned checksums before use.
Questionnaire answers
Do you have a SOC 2 report or ISO 27001 certification?
Not today. Mythral holds no customer data, so the scope of such an audit would be our development and release process rather than your data. We will walk your team through that process and answer your security questionnaire in full.
Has the app been penetration tested?
Not by a third party yet. The app's only network activity is the outbound connections listed below, and offline mode turns them off. Your team is welcome to test it on your own Macs.
Will you sign a DPA?
Yes, on request. It states that Mythral does not receive, store or process customer personal data or content.
What happens if Mythral the company goes away?
The app keeps working. Nothing depends on our servers: no account, no license server, no cloud processing. Updates stop; everything else carries on.
How do you handle a vulnerability?
Report it to security@mythral.dev. It is treated ahead of all other work; a fix ships as a signed update, or as a build your IT team can push, and the contact on your order is told what changed.
Which third-party code and models are inside?
Open source, all running on the Mac: whisper.cpp and llama.cpp (MIT), FluidAudio (Apache 2.0), Sparkle (MIT); models NVIDIA Parakeet (CC-BY-4.0), Qwen (Apache 2.0) and pyannote speaker separation (CC-BY-4.0). A full list is available on request.
What permissions does it need, and why?
Microphone, to hear the person dictating. Accessibility, to type into the app in front and to read names near the cursor as spelling hints; never password managers or banking apps, and your organization can turn screen reading off or block apps. Screen & System Audio Recording, only for meetings: it is how macOS lets an app hear the other side of a call. No screen is recorded.
Can people record meetings without telling others?
Your organization can require a consent check before every recording, or turn meeting recording off and keep dictation.
Contacts
Deployment detail and every setting your organization can lock: Mythral for teams. How the app handles data for individuals: privacy.
