One decision solves most of your compliance: the data never leaves the device
Privacy regulations — GDPR, HIPAA, financial rules, data-residency laws — mostly exist to control what happens when your data is handled by someone else. VoiceNote sidesteps almost all of it with a single architectural choice: your voice is transcribed and written on your own computer, and nothing is ever sent anywhere. Here's how that one fact maps onto the rules that matter.
The core idea
Nearly every data-protection rule is triggered by transfer and third-party processing — the moment your data leaves your control and lands on a vendor's servers. VoiceNote has no servers in the loop. Transcription (Whisper) and the writing model (Gemma) both run locally, the audio is discarded once it becomes text, and what you keep lives in a folder on your own machine. Remove the data flow, and most obligations simply don't attach.
We're careful with our words here: VoiceNote is compliant by design, not 'certified.' There's no data flow for an auditor to certify — which is exactly the point. Below is how that architecture lines up with each regime; each has its own detailed guide linked at the bottom.
How on-device maps to the major regimes
| Regulation | What it worries about | Why VoiceNote is fine by design |
|---|---|---|
| GDPR / UK GDPR | Processing & cross-border transfer of personal data by third parties | We never process or receive your dictation — so no DPA, no transfer, and data-minimisation is the default. |
| HIPAA | PHI handled by a Business Associate | PHI never leaves your machine, so there's no Business Associate — and no BAA to sign. |
| Financial (SEC/FINRA, MiFID II, APRA, GLBA) | Confidential client data and where records are kept | Client information stays on the adviser's device; nothing is sent to a cloud processor. |
| Data-residency / sovereignty | Data crossing borders or sitting in the wrong region | Data is resident on your device, in your country. It even works fully air-gapped. |
| AI / model-data policies | Your text sent to an AI provider and used to train models | The AI runs locally; nothing is ever sent to OpenAI, Google or Anthropic. |
What this means in practice
- A security or compliance officer has almost nothing to assess — no vendor data flow, no sub-processors touching your content, no cross-border transfer.
- It's deployable in regulated and even air-gapped environments, because it needs no connection after the one-time model download.
- The same tool works for staff handling personal, health, financial or classified information — because none of it leaves the device.
The detailed guides
Each regime gets its own page with the specifics and the honest caveats:
Related
Compliance that's simple because there's nothing to send.
Private, on-device dictation for regulated teams and individuals.