Are Cloud AI Dictation and Note Taking Apps Safe for Confidential Work?

Cloud AI dictation and meeting note apps can be safe for confidential work, but only when you have read the vendor's terms for your exact plan, confirmed how long audio and transcripts are kept, checked whether your content trains models, listed the sub-processors that see it, and settled recording consent with everyone on the call. Consumer tiers and personal sign ups usually fail at least one of those tests.

The useful question is not "is this app safe" in general. It is "is this app, on this plan, with these settings, safe for this kind of material, and can we prove it later." The rest of this post answers that question piece by piece, using only what the makers themselves publish, and ends with a vendor questionnaire and a simple approve, restrict or block policy you can adopt this week.

Key takeaways

• Plan tier decides most of the answer. The same brand can train on content in one tier and contractually exclude it in another. Read the terms for the plan your people actually use, not the marketing page.
• "Not used for training" is not the same as "not retained." A vendor can promise no training and still keep content for abuse monitoring, support or legal holds. Ask for retention periods in days, per data type.
• Every AI note taker has sub-processors. Cloud hosting, speech recognition and large language model providers often sit behind the brand you signed with. Under GDPR Article 28 you are entitled to know who they are and to object to changes.
• Recording law follows the people, not the app. US federal law allows one party consent, but California requires the consent of all parties to a confidential communication. A bot that joins a call does not settle that for you.
• Suite tools and standalone tools differ in where data lands. Built in assistants usually store output inside your existing tenant. Standalone services create a new copy of your meetings in someone else's cloud.
• Local models remove the cloud transfer, not the risk. You still own model provenance, updates, permissions and where transcripts are saved.
• Make it a third party risk decision. Record the vendor, plan, data types, sub-processors, required settings and approver, and review when terms change.

What do AI dictation and note taking apps actually capture?

People picture "the audio." In practice these tools collect more, and the extra pieces are often what makes a security review harder.

Audio, and the transcript made from it

Every tool in this category starts with sound. Dictation tools capture your voice while a hotkey or button is held. Meeting note takers capture everyone in the meeting, usually by joining as a participant bot, by recording through the conferencing platform's own feature, or by listening to the system audio on your laptop. The transcript is a second copy of the same content in text form, which is easier to search, copy and leak than audio.

Screens and slides

Some meeting tools take pictures of what is shared. Google's help page for "take notes for me" in Meet says screenshots of a presentation are included only if it stays on screen for at least 10 seconds. Otter's privacy policy lists automatic screenshots taken during virtual meetings among the data it collects. If a confidential spreadsheet is shared for a minute during a call, assume it may end up as an image inside the notes.

Identity and voice data

Speaker labels need speaker recognition. Otter's privacy policy describes data used to recognise speakers and tag their names, and one of its tables labels this "Speaker Identification / Biometric Information." Biometric data carries its own legal rules in several jurisdictions, so it deserves its own line in your review.

Calendar, contacts and connected accounts

Note takers that join meetings automatically need your calendar. Otter's policy says that when you connect calendars, contacts or a conferencing account it receives items such as usernames, email addresses, calendar information and contact information. That connection is usually an OAuth grant, and it often outlives the user's interest in the tool. Our post on reviewing risky OAuth apps covers how to find and prune those grants.

Context from your device

Dictation tools that insert text into any app need to know where your cursor is. That can mean accessibility permissions to read on screen text, the active application's name, or clipboard contents. Even a built in tool uses context: Apple's Siri and Dictation privacy page lists contact names, nicknames and relationships, and the names of installed apps, among contextual data that may be sent to help recognition.

Third party dictation apps set their own rules. When one asks for accessibility access, treat it like granting screen reading and keystroke capability, because that is close to what it is. Read the vendor's documentation for what it collects from the active window and whether that leaves the device.

Usage, device and analytics data

Finally there is ordinary telemetry: logs, IP based location, device identifiers and analytics. Otter's policy names analytics providers among its third parties. This is rarely the confidential part, but it tells an outside party who met with whom and when.

Where do audio and transcripts go, and how long are they kept?

There are three broad architectures, and each answers "where" differently.

Built into your collaboration suite. Microsoft says Copilot prompts, retrieved data and responses are stored under the same contractual commitments as your other Microsoft 365 content, and Teams recordings go to the organiser's OneDrive or the channel's SharePoint, where Purview and normal permissions apply. Google says "take notes for me" saves a Google Doc in the organiser's Drive. Either way, output lands in a tenant you already govern.

A standalone cloud service. A dedicated note taker keeps recordings and transcripts in its own cloud; Otter's policy names Amazon Web Services as its host. That is a second copy of your meetings under a different retention policy and access model.

On device. Apple says Keyboard Settings will indicate when dictation audio and transcripts are processed on your device and not sent to Apple's servers. When on device processing is not available, dictated content is sent to and processed on Apple's servers, and Apple says it is not stored unless you opt in to Improve Siri and Dictation.

Retention: ask for numbers

Retention language ranges from precise to open ended. Some examples, quoted or paraphrased from each maker's own documentation:

• Google Workspace. Google's generative AI privacy hub for Workspace says admins can keep Workspace Gemini prompts and responses for between 90 days and indefinitely, and can set Gemini app conversations to auto delete after 3, 18 or 36 months, with 18 months as the default.
• Microsoft. Microsoft says admins can use Microsoft Purview to set retention policies for Copilot interaction data, and users can delete their Copilot activity history from their account portal.
• Apple. For people who opt in to Improve Siri and Dictation, Apple says data may be retained and used for up to two years, and a small subset of reviewed interactions may be kept longer.
• Otter. Otter's policy says data is kept for as long as necessary to fulfil the purposes described in the policy, or as required by law, without a specific period.
• Zoom. Zoom's AI Companion whitepaper, as indexed in search results we reviewed, says a third party model provider may retain content used to provide the service for trust and safety purposes, within the US, for up to 30 days unless a longer period is required by law. Confirm the current wording in Zoom's own documentation for your plan.

"No training" and "retention" are different promises; you want both in writing, plus a deletion path at contract end. GDPR Article 28(3)(g) already requires processors to return or delete personal data at the end of the service, at the controller's choice, unless law requires them to keep it.

Is your data used to train AI models, and how do you verify the setting?

This is the question everyone asks first, and the answer genuinely differs by maker and by plan.

What the makers say

• Microsoft states that prompts, responses and data accessed through Microsoft Graph are not used to train foundation large language models, including those used by Copilot. It also says Copilot services have opted out of the abuse monitoring with human review that is available in its Azure OpenAI service.
• Google states in its Workspace privacy hub that Workspace does not use customer data for training models without the customer's prior permission or instruction, and that content is not used for other customers.
• Zoom says, according to its AI Companion whitepaper as summarised in search results, that it does not use customer audio, video, chat, screen sharing, attachments or other communications like content to train Zoom's or third party AI models.
• Otter says in its privacy policy that it trains its AI on de-identified audio recordings, and on transcriptions which may contain personal information. The de-identification language in that sentence applies to audio, not transcripts. The policy also lists data labelling service providers among its third parties, which suggests human annotation of some data.
• Apple says dictation data sent to its servers is not stored unless you opt in to Improve Siri and Dictation, and that if you opt in, additional data is collected, stored and reviewed, with audio review done only by Apple employees according to its improvement page.

None of these statements is "good" or "bad" by itself. A policy that trains on transcripts may be fine for a podcast host and unacceptable for a law firm. The point is that you have to read it for each tool and plan.

How to verify, not just trust

1. Find the governing document for your plan. Consumer privacy policies, business terms, data processing addenda and AI supplements can all apply. Ask legal to confirm which one wins.
2. Find the setting and record it. Many tools have an admin or account switch for training or product improvement. Record its value, the date and who checked.
3. Check who controls the switch. If users can turn training on for their own account, your admin setting is not a guarantee.
4. Check feedback flows separately. Microsoft notes it may use optional customer feedback to improve Copilot, though not to train the foundation models, and that admins can manage feedback. Feedback buttons often send the prompt and response with them.
5. Re check when terms change. Store the policy URLs and effective dates you reviewed. Otter's policy, for example, is marked effective 16 June 2026. When that date changes, the review is due again.

Which sub-processors and model providers see the data?

Most AI note takers are a chain of services. The brand you sign with may host on one cloud, transcribe with its own or another speech model, and summarise with a large language model from a third party.

The makers' own documents show this clearly:

• Microsoft says it offers third party models from Anthropic and OpenAI within Copilot experiences as sub-processors, that admins decide whether to use them, and that models provided by Anthropic as a sub-processor are currently excluded from the EU Data Boundary.
• Zoom says, per its whitepaper as indexed, that third party models such as those from Anthropic and OpenAI may be used for certain AI Companion features alongside Zoom's own models.
• Otter names Amazon Web Services for hosting, Amplitude and Google Analytics for analytics, Stripe for payments, and unnamed data labelling and AI service providers.

Why the list matters

Each sub-processor is another set of systems, staff and jurisdictions holding your meeting content. If you promise clients their data stays in a region, a sub-processor outside it can break that promise. Microsoft's EU Data Boundary note is a concrete example: enabling one optional model provider changes where processing may happen.

What the law gives you

For personal data under GDPR, Article 28(2) says a processor shall not engage another processor without the controller's prior specific or general written authorisation, and under general authorisation the processor must inform you of intended changes so you can object. Article 28(4) requires the same data protection obligations to flow down to the sub-processor, and leaves the original processor fully liable to you if the sub-processor fails. In practice that means:

• Ask for the current sub-processor list and how you are notified of changes.
• Subscribe to the notification, and route it to whoever owns the vendor record.
• Decide in advance what you will do if a new sub-processor appears in a region or category you cannot accept.

When a vendor does have a breach somewhere in that chain, the steps in what to do when a vendor tells you they were breached apply directly, and the sub-processor list is what tells you which notices concern you.

Recording consent: what the law requires

Before any security question, a recording tool raises a legal one. Recording and transcribing other people's speech is regulated, and the rules depend on where the participants are.

United States federal law

Under 18 U.S.C. 2511(2)(d), a person not acting under colour of law may intercept a communication if they are a party to it or if one of the parties has given prior consent, unless the interception is for the purpose of committing a criminal or tortious act. That is the "one party consent" rule people often quote.

California and other all party states

California is stricter. California Penal Code section 632 applies to anyone who, "intentionally and without the consent of all parties to a confidential communication," records it with an electronic device. A confidential communication is one where the circumstances reasonably indicate a party wants it kept among the parties, which excludes public gatherings and open government proceedings and situations where people could reasonably expect to be overheard or recorded. The section allows a fine of up to 2,500 dollars per violation, rising to 10,000 dollars per violation after a prior conviction, plus possible imprisonment.

Other states have their own statutes, and some also require all party consent. A meeting with one participant in California and the rest elsewhere is the common case that trips teams up, so the safe operating rule is to get clear consent from everyone, every time.

Outside the United States

In the EU and UK, recording and transcription is processing of personal data. You need a lawful basis, you need to tell people, and if a vendor processes it for you, Article 28 governs the contract. Many professional bodies add their own rules on top.

What the tools do about consent

The tools differ, and none of them makes consent your vendor's problem.

• Microsoft Teams offers a meeting policy that requires participants' explicit agreement before they are recorded or transcribed, controlled with Set-CsTeamsMeetingPolicy -ExplicitRecordingConsent Enabled according to Microsoft Learn. Microsoft also notes that turning off Copilot in a meeting turns off recording and transcription too.
• Google Meet notifies all participants that notes are being taken and shows a pencil icon, according to Google's help page, and admins can require explicit consent before the feature starts.
• Otter's privacy policy says audio may contain the personal information of third parties and asks users to make sure they have the necessary permissions. Responsibility sits with the person who brings the tool.

An announcement is not consent in an all party jurisdiction if nobody actually agreed. Ask at the start, record the agreement, and stop the tool when someone declines.

Local models: what they fix and what they do not

An Ask HN thread this month asked for a non cloud alternative to a popular AI dictation app, and the same week's busiest threads asked whether people use subscribed models or local ones. Running speech recognition and summarisation on your own machine is a reasonable answer for some confidential work. It is not a complete one.

What a local model fixes

• No transfer to a vendor cloud, so no vendor training and no sub-processor chain.
• Predictable retention. Files live where you put them and go when you delete them, subject to your backups.

What a local model does not fix

• Model provenance. A model file downloaded from a public hub is software from a third party. Some formats can carry executable code when loaded, which is why weight formats designed to hold only tensors are preferred. Pin a specific revision and verify a hash before use.
• The wrapper application. Most local dictation setups are an open source app with dozens of dependencies around the model. Those dependencies get vulnerabilities like any other code, and they need updates.
• Operating system permissions. A local dictation app still needs the microphone and usually accessibility access. The permission is the same whether the model is local or not.
• Where transcripts land. A local tool that saves transcripts into a synced folder has quietly created a cloud copy after all.
• Updates and drift. Auto updaters can fetch new code and new models. Know whether yours does, and from where.
• Accuracy. A smaller local model may mishear names and numbers more often. For legal and medical notes, a confident wrong transcript is its own risk.

We cover the broader trade off in the local or hosted LLM decision guide and the operational side in local LLM deployment risks for enterprises.

Step by step: setting up a local transcription tool you can defend

This walkthrough assumes a Python based open source transcription wrapper and a model from a public model hub. Adapt the names to your stack.

1. Create an isolated environment and pin dependencies.

python3 -m venv ~/.venvs/transcribe
source ~/.venvs/transcribe/bin/activate
pip install --upgrade pip
pip install -r requirements.txt --require-hashes
pip freeze > requirements.lock.txt

Using --require-hashes makes pip refuse any package whose hash is not listed in the requirements file, so a changed upstream artifact fails loudly instead of installing quietly.

2. Audit the dependencies before first use, and on a schedule.

pip install pip-audit
pip-audit -r requirements.lock.txt

3. Download the model at a pinned revision and verify it.

huggingface-cli download <org>/<model> model.safetensors \
  --revision <commit-sha> --local-dir ./models/<model>
shasum -a 256 ./models/<model>/model.safetensors

Compare the hash with the value recorded in your vendor or tool record. Prefer safetensors or another tensor only format over formats that can execute code when loaded.

4. Check what the app talks to on the network. On macOS or Linux, run the tool and then list its open connections:

lsof -i -nP | grep -i <process-name>

A local transcription tool should show no outbound connections during transcription. If it does, find out why before you trust it with client audio.

5. Pick an output folder that is not synced. Keep transcripts in a local, encrypted location with a defined deletion schedule. If they must be shared, move them deliberately into your governed document system.

6. Review operating system permissions. On macOS, check Privacy and Security under Microphone and Accessibility; on Windows, check Privacy and security, Microphone. Remove tools that no longer need access.

7. Record the decision. Write down the app, version, model, revision, hash, permissions and approver.

Regulated data: health, legal and financial work

Confidential work often means regulated work. The general advice above still applies, with extra requirements on top.

Health information

Under HIPAA, a vendor that creates, receives, maintains or transmits protected health information for a covered entity is a business associate and needs a business associate agreement. The HHS Office for Civil Rights cloud computing guidance says that a cloud provider which lacks the encryption key is still a business associate. So "we encrypt everything" does not remove the need for a BAA.

Coverage can be partial even when a BAA exists. Google's Workspace privacy hub says Gemini can support HIPAA workloads and that its HIPAA included functionality terms were updated to include Gemini, but that Gemini Notebook and Gemini in Chrome are not covered by the BAA. Microsoft lists HIPAA among Copilot's compliance offerings. Read the covered services list for the exact feature your clinicians would use, not the brand.

Legal work

For lawyers, the American Bar Association issued Formal Opinion 512 on generative AI on 29 July 2024. Commentary on the opinion, including the ABA's own litigation section newsletter, reports that it treats self learning tools as a higher risk to client confidentiality because they can retain and reuse input, and that lawyers should get the client's informed consent before entering information relating to the representation into such tools, with boilerplate engagement letter language not enough. ABA opinions are persuasive rather than binding, and state bars issue their own guidance, so check your jurisdiction. Privilege is a separate concern: sharing privileged discussions with a third party service can raise waiver questions, which is a matter for counsel.

Financial services

Financial firms usually have record keeping obligations for business communications. An AI generated meeting summary may itself be a business record that must be retained, supervised and producible. A tool that keeps notes outside your archive can create a gap, and so can one that auto deletes too quickly. Involve compliance before rollout.

How the main approaches compare

This is not a ranking of products. It compares deployment approaches, using facts the makers publish, so you can see which questions matter most for each.

What to ask a vendor before approval

Send these questions in writing and keep the answers with the vendor record. Short answers are fine. Vague answers are a finding.

If you are building an AI product yourself and expect to receive questions like these, what SOC 2 auditors ask AI companies covers the other side of the table.

A simple approve, restrict or block policy

Most organisations need a short policy more than a long one. This one fits on a page.

Approve

The tool is approved for confidential and client work when all of these are true:

• It is on a business plan with a signed data processing addendum, and personal accounts are blocked or claimed.
• The contract or an admin locked setting excludes your content from training.
• Retention is set to your standard and deletion works at contract end.
• The sub-processor list has been reviewed and change notifications go to a named owner.
• An explicit consent mechanism is enabled, or the team has a written consent script.
• For regulated data, the specific feature is covered by a BAA or equivalent.

Restrict

Internal, non client, non regulated work only, when the tool is on a business plan but an approve condition is still pending, such as a BAA or a retention setting. Tell users plainly which meetings it may not join: client calls, board meetings, HR matters, legal advice and incident response.

Block

Not permitted when the tool is on a personal or free plan, its terms allow training on transcripts you cannot turn off, it cannot name its sub-processors or commit to retention periods, or it demands device permissions its documentation does not justify.

Name who decides and review approved tools quarterly and whenever a vendor's terms change.

Enforcing the policy in the suite you already use

Policy without controls drifts. If you run Microsoft Teams, Microsoft Learn documents meeting policy settings that put the policy into effect:

# Require explicit participant agreement for recording and transcription
Set-CsTeamsMeetingPolicy -Identity "Confidential" -ExplicitRecordingConsent Enabled

# Turn off cloud recording for a group that handles regulated data
Set-CsTeamsMeetingPolicy -Identity "Regulated" -AllowCloudRecording $false

# Assign the policy to a group
Grant-CsTeamsMeetingPolicy -Group "<group-id>" -PolicyName "Confidential"

# Stop channel members from downloading channel meeting recordings and transcripts
Set-CsTeamsMeetingPolicy -Identity Global -ChannelRecordingDownload Block

In Google Workspace, Google's documentation places "take notes for me" under the Gemini settings in the Admin console, where it can be turned on or off per organisational unit, and admins can set default sharing for AI notes. Combine those with the retention range in the Workspace privacy hub.

For standalone tools, the main levers are your identity provider and your calendar. Restrict which third party apps can receive calendar and directory scopes, require admin consent for new OAuth apps, and review existing grants for note taker bots that users connected on their own.

Where Safeguard fits, and where it does not

Be clear about the limits. Safeguard does not block, monitor or filter dictation and note taking apps, does not inspect meeting traffic and does not decide whether a recording is lawful. Those controls live in your identity provider, your collaboration suite and your legal process.

Safeguard helps with the parts of this problem that are third party risk and software review:

• Vendor review. Safeguard's Third-Party Risk Manager lets you onboard an AI tool vendor, assign a risk tier, keep its questionnaire answers, contracts and documents with the vendor record, and score and monitor supplier risk over time. The questionnaire above and the sub-processor list belong there, with the approval and its date.
• Compliance evidence. Safeguard's compliance suite tracks vendors, questionnaires, policies and evidence against the frameworks you report on, so the approve, restrict or block decision becomes evidence an auditor can see.
• Local model checks. For teams that choose local models, Safeguard's model scanning covers models and their dependencies, so the model files and the wrapper code can be reviewed before people start feeding client audio into them.
• The code around the model. If you build internal tooling on top of a local or hosted speech model, Safeguard scans those repositories and container images, ranks findings using exploit signals and reachability, and can open fix pull requests for vulnerable open source dependencies.

Common mistakes

• Reviewing the brand instead of the plan. Consumer and business terms for the same product can differ on training and retention. Approvals must name the plan.
• Treating "no training" as "no retention." Ask how long content is held, by whom, and for what purpose, including sub-processors.
• Forgetting the calendar grant. Users connect a note taker to their calendar once, stop using it, and the OAuth grant keeps working for months.
• Assuming an announcement is consent. A bot joining the call tells people a recording may happen. It does not get agreement from a participant in an all party consent state.
• Letting notes inherit loose sharing. Auto sharing notes with all invitees, including external guests, can send a summary of an internal discussion to the other side. Set conservative defaults.
• Assuming local means safe. Local tools still need provenance checks, dependency updates and permission reviews.
• Trusting summaries as records. AI summaries can drop caveats or misattribute statements. Have a human confirm decisions before they are sent.
• Approving once and never revisiting. Vendor terms change. Store effective dates and review on change.

FAQ

Is it safe to use an AI note taker in client meetings?

It can be, if the tool is on a business plan with a data processing agreement, your content is excluded from training, retention is defined, the sub-processors are acceptable, and every participant has agreed to recording. If any of those is unknown, keep the tool out of client meetings until it is known.

Do AI meeting assistants use my recordings to train their models?

Some do and some do not, and the answer can change with the plan. Microsoft and Google publish commitments not to train foundation models on business content without permission, Zoom states it does not train on communications content, and Otter's policy says it trains on de-identified audio and on transcripts. Read the current terms for your plan and record the setting.

Is it legal to record a meeting with an AI note taker?

It depends on where participants are. US federal law allows one party consent, but California Penal Code 632 requires all parties to consent to recording a confidential communication. The simplest compliant habit is to ask everyone at the start and stop if anyone declines.

Are on device dictation features more private than cloud dictation apps?

Generally they send less off the device. Apple says keyboard settings show when dictation is processed on device; otherwise content goes to its servers and is not stored unless you opt in to improvement. Third party apps set their own rules.

Can I use AI transcription for patient conversations under HIPAA?

Only with a business associate agreement covering the specific feature, after your own risk analysis. Google, for example, says Gemini Notebook is not covered by its BAA even though other Gemini features are.

What should lawyers check before using AI dictation?

Confidentiality and informed consent. ABA Formal Opinion 512 is reported to call for informed client consent before client information goes into self learning AI tools. Also check your state bar's guidance and the tool's training and retention terms.

Is a local open source transcription model safe for confidential audio?

It removes the vendor cloud, which helps a lot. You still need to verify the model's source and hash, patch the wrapper's dependencies, review permissions and keep transcripts out of synced folders.

What is a sub-processor, and why should I care for a note taking app?

Another company your vendor uses to process your data, such as a cloud host or language model provider. Under GDPR Article 28 the vendor needs your authorisation and must flow the same obligations down. Your meeting content is only as safe as the weakest link.

Fix it without waiting for upstream

AI note takers and local transcription setups are built on open source just like the rest of your stack, from speech model wrappers to the libraries inside a vendor's desktop agent. When a vulnerability lands in the code you build and ship around these tools, the steps below apply.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

None of these demos is a dictation or note taking product; they show principles this post argues for.

The first demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. It is the same question you should ask of any AI note taker: exactly which data and actions does this assistant get, and who decided. Granting only what the job needs is the habit to carry into every AI tool review.

Click through it at your own pace, or open it full screen.

The second demo is a real desktop app session. The CLI session shows in the desktop app's conversation list, you ask for work on your computer, pick the folder, then Approve or Deny each command and file edit, and it ends with the upgrade done and tests passing. For a local transcription setup, the same flow is how you would update the wrapper's dependencies on the machine that holds the model, seeing every change before it happens.

Click through it at your own pace, or open it full screen.

The third demo is a real CLI session. Asked to fix a lodash CVE, the CLI reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with approval, prints a summary and pushes nothing. If your team builds internal tooling around a speech model, such as an upload service or a summarisation script, the same approach keeps its open source dependencies current.

Click through it at your own pace, or open it full screen.

To try it on your own projects, download Safeguard or read the CLI documentation.

Quick check

Sources

• Microsoft Learn: Data, privacy and security for Microsoft Copilot
• Microsoft Learn: Manage Teams recording policies for meetings and events
• Google Workspace: Generative AI in Google Workspace privacy hub
• Google Meet Help: Take notes for me in Google Meet
• Google Workspace Admin Help: Let Google Meet AI take notes for my users
• Otter.ai Privacy Policy
• Apple: Siri, Dictation and Privacy
• Apple: Improve Siri and Dictation and Privacy
• Zoom: AI Companion security and compliance (AI whitepaper)
• Zoom: AI Companion security and privacy whitepaper
• 18 U.S.C. 2511, Legal Information Institute
• California Penal Code section 632
• GDPR Article 28, Processor
• HHS: Guidance on HIPAA and cloud computing
• ABA Litigation Section: Generative AI for lawyers, part 2, maintaining confidentiality

Last reviewed: 23 October 2026. Vendor privacy terms, plans and settings change often; check the linked sources for the current wording before you approve a tool.