Security and privacy at Epilude

Epilude is working toward a SOC 2 attestation. We do not yet hold a SOC 2 report, and no certification is claimed today. We will publish status updates here as we progress.

Epilude does not store, process, or transmit payment card information directly. All payment card transactions are handled by PCI DSS–compliant third-party payment processors. As a result, Epilude’s PCI DSS scope is limited, and applicable compliance obligations are met through our payment processing partner, Stripe.

Epilude complies with applicable data protection and privacy laws, including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), where they apply.

Epilude maintains processes and controls to support data subject rights, lawful data processing, and transparency obligations. No formal external certification is required for compliance with these regulations.

We adhere to the principle of least privilege, giving team members access only to the information necessary for their job functions. Requests for privilege escalation require documented approval by an authorized manager, and we perform regular audits of access privileges to sensitive applications.

We maintain an incident response plan that defines responsibilities, detection methods, and corrective actions during security incidents. We use monitoring tools for early detection, and we test, review, and update the plan at least annually.

We log, time-stamp, and attribute source code changes to their author in our source code management tool. We restrict access to the tool to authorized users with multi-factor authentication.

We enforce multi-factor authentication (MFA) for user accounts with access to company email, version control tools, and cloud infrastructure.

We patch and update all systems on a documented, regular, and timely schedule, using the Common Vulnerability Scoring System (CVSS) to set patching guidelines. We address critical security vulnerabilities as soon as possible regardless of CVSS score.

Our employees complete mandatory security awareness training continuously, and we maintain records of completion.

We actively manage vendor risks through a structured approach that includes maintaining a critical third-party vendor inventory and conducting risk assessments before initiating third-party work. We repeat these assessments annually to identify any gaps between third-party security controls and our information security standards.

We perform periodic tests, which can include tabletop sessions, disaster simulations, or other realistic scenarios. After each test, we create an assessment report indicating the success of the exercise and any required corrective actions.

We review SOC 2 reports from service providers at onboarding and annually to assess the appropriateness of scope and the impact of identified exceptions. For critical vendors without SOC 2 reports but with access to company data, we perform regularly scheduled risk assessments to evaluate performance and compliance with security commitments.

Yes. Choose EP-1, the local model, for dictation and Cleanup. Your audio and transcripts are processed on your Mac, and dictation works offline once the model is downloaded.

Notetaker transcription, meeting summaries and Narrator have separate model choices. Actions sends your selection and command to the cloud when you run it. Sharing a narration or keeping it on the web uploads its text and audio, even when it was read locally.

Cloud transcription models receive your audio to produce the transcript. Account, billing and performance data are handled separately, whether you use local or cloud models. Performance records cover timings and counters only, never your audio or text.

We collect three broad categories of data to deliver the product. Audio and transcripts are captured when you press to dictate; with a cloud transcription model, we send the audio to a speech-to-text service and return the transcript to your Mac. With a local transcription model, the audio is processed on your Mac and stays there. Account information includes your email address, authentication credentials, and basic profile details you provide. Usage and diagnostic data covers errors, crashes, and performance metrics.

For dictation, performance data is recorded once per dictation and is tied to your account, so it is not anonymous. It holds timings and counters only: how long each stage took, whether the microphone was Bluetooth or built-in and wired, whether the dictation completed or failed and at which stage, the app version, the transcription and cleanup engines the session used, and the number of words in the transcript. It never contains your audio, your transcript, or the text that was inserted. Epilude records it with both local and cloud models, and sends nothing while you are signed out or offline. Narrator also sends a record per narration and per listening session, tied to your account in the same way: timings and counts, which voice model read it (on your Mac or in the cloud), the language, the playback speed, how long the text is and where it came from, never the text or a page's address.

Captured audio is treated as Customer Content under our Privacy Policy.

Most processing happens through a small set of trusted subprocessors. The full list, with each subprocessor’s purpose and location, is in the Subprocessors section above.

When you use a cloud transcription model, audio is sent to our speech-to-text provider to produce transcripts and is deleted from the provider in line with their data-handling commitments. Transcripts may be sent to a large language model provider for formatting or auto-editing when you use those features. When you choose local models for dictation and Cleanup, your audio and transcripts are processed on your Mac and are not sent to any subprocessor. Account credentials are managed by our authentication provider. Payment information is handled directly by our payment processor; we do not store full card numbers. Product analytics flow through a self-hosted service so the underlying data stays on infrastructure we control.

We encrypt all sensitive data in transit using industry-standard protocols like TLS 1.3. Data at rest is encrypted using AES-256, and we manage encryption keys securely in a KMS.

No. We do not train any models on your data, and the speech-to-text and large language model providers we use are configured not to train on it either.

We have established procedures to respond to data subject requests within regulatory timeframes. We authenticate requests to verify identity, and we provide data in a commonly used, machine-readable format. We log and track all requests for compliance purposes.

Open Settings → General and choose Clear dictation history to delete saved dictation transcripts and reset local activity stats. This cannot be undone.

For meetings, choose Delete meeting from the row’s menu or the More menu inside the meeting. You can undo it while the deletion notice is visible. Afterwards, the meeting, its transcript, its Markdown file and any saved audio are removed from your Mac.

In Narrator, open All narrations and delete the entry. A narration is a separate copy: clearing a dictation or deleting a meeting does not delete a narration you made from it. Copies you exported elsewhere must be deleted separately.

• Manage your meeting library
• Manage your narrations

Open the narration’s share sheet and choose Stop Sharing. This deletes the uploaded text and audio from Epilude’s servers and stops the link from working. It applies to shared narrations and private copies kept on the web.

The narration in your Mac library remains. Delete that entry in Narrator too if you want to remove the local copy.

• Sharing and removing narrations

Email privacy@epilude.com to request deletion of your account and personal data. We may ask you to verify your identity before acting on the request.

Clearing local history does not delete your account. Account deletion also does not remove copies you saved or exported on your Mac. Our Privacy Policy explains the records we may need to keep to meet legal obligations.

• Request account deletion
• Privacy Policy

We retain data only for as long as necessary to fulfill business purposes or comply with legal requirements. When data is no longer needed, we securely delete it using approved methods that prevent recovery. We run regular audits to confirm compliance with retention schedules.