ClearDictateDesigned to keep personal data off third-party servers.
In on-device mode, no personal data leaves the Mac. That is designed to help you meet GDPR and UK GDPR data-minimisation duties without adding a processor.
ClearDictate and Megakad xd ltd hold no certifications: not SOC 2, not ISO 27001, not HIPAA. This page describes how the product is built so you can assess it against your own obligations.
GDPR and UK GDPR
Dictations are processed by your organisation on your own hardware. We never receive them, so we are not your processor and there is nothing for us to transfer, retain or breach.
If a user enables the optional OpenAI features, OpenAI becomes a processor under that user’s or your organisation’s own agreement with OpenAI. Use ForceOnDevice to prevent this.
Data residency
Data resides on the device. History is in the user’s Application Support folder (~/Library/Application Support/DictationApp/), and the dictionary and settings are in the app’s preferences (com.megakad.dictationapp). All of it is covered by FileVault and your existing endpoint controls. There is no region to choose because there is no server.
Retention controls
Set HistoryRetentionDays in a configuration profile. Users can always delete History entries sooner.
| Value | Effect |
|---|---|
| 0 | Don’t keep history. Nothing is written after pasting, and the History window shows “History Is Off”. |
| N | Entries older than N days are deleted. |
| not set | History is kept until the user deletes it, up to the 2,000 most recent dictations. |
HIPAA-sensitive settings
ClearDictate is not HIPAA certified. If staff may dictate protected health information, we recommend this profile at minimum:
- ForceOnDevice = trueNo audio or text can reach OpenAI.
- HistoryRetentionDays = 0No dictations are stored at rest.
- ModelMirrorURLOptional: keep the model download inside your network.
Procurement FAQ
Do we need a DPA with you?
Not for on-device use. We don’t process personal data on your behalf, so there is nothing for a DPA to cover.
Who are your sub-processors?
None by default. OpenAI only if a user enables the optional cloud features with their own key.
Will you complete our security questionnaire?
Yes. Send it to security@cleardictate.com. Most answers are on the Security page.
Is there a contract or order form?
No. It’s free and covered by our standard Terms.
How do we stop staff using the cloud features?
Deploy a profile with ForceOnDevice set to true. The Cloud engine and Smart cleanup are then hidden from users, with a note that the setting is managed by your organisation.