Murmurtale Get started

Security

Security at Murmurtale

On-device mode keeps everything on your Mac when you prefer it.

Draft — describes current design, not a guarantee

This page describes Murmurtale’s current security posture. It makes no claim of formal certification or audit. Report security issues to support@murmurtale.com.

Version
Draft v0.1
Drafted
2026-07-14
Status
Posture described; no formal certification
Disclosure
Security contact pending — see Contact

Our approach: collect less

Cloud is Murmurtale’s default engine, but on-device processing is always available. In on-device mode, your audio and text are transcribed and cleaned up entirely on your Mac and are never transmitted to us. That is the foundation everything else builds on.

Current controls

These describe how Murmurtale works today. We have deliberately kept the list to things we actually do — no certifications, audits, or guarantees we have not earned.

  • Cloud requests are processed by our subprocessors under their own terms; they are listed in the Privacy Policy. A second cloud transcription of each finished dictation is coming in 1.1.6. On-device mode sends nothing at all.
  • Encrypted transport for cloud features. When you use the cloud engine (the default with Pro and the free trial), audio/text travel over TLS 1.3 to the backend and its subprocessors.
  • Cloud requests are processed by our subprocessors under their own terms. Who they are is in the Privacy Policy.
  • Crash/error diagnostics can be turned off in Preferences.
  • Least-privilege permissions. Murmurtale requests only Microphone and Accessibility, used solely to capture dictation, detect the hotkey, and insert text.
  • Distribution integrity. The Mac app is code-signed; the release build is verified before distribution.

Not yet in place / what we are not claiming

To keep this page honest, some things we deliberately do not assert at this stage:

  • No claim about what subprocessors keep. This page does not say what a subprocessor stores or whether it trains on a request. Cloud requests are processed by our subprocessors under their own terms. The list is in the Privacy Policy.
  • No third-party security certification or audit (for example SOC 2 or ISO 27001).
  • No specific encryption-at-rest boundary or key-management guarantee beyond what is described here.
  • No formal uptime or incident-response SLA.

If and when any of these change, this page will say so plainly, with a date.

Responsible disclosure

If you believe you have found a security vulnerability, we want to hear from you. Please report it privately rather than disclosing it publicly, and give us a reasonable chance to investigate and fix it before any public discussion.

Helpful reports include what you found, the steps to reproduce it, and the potential impact. Please do not include real private content — a synthetic example is enough.

How to reach us

Email support@murmurtale.com with “Security” in the subject.

A note on scope

Murmurtale is a Mac app with a cloud engine (the default with Pro and the free trial) and an on-device engine. This page will grow to describe the controls that apply to them. We would rather add commitments as they become true than promise them in advance.