Security and data handling

What leaves your Mac when you dictate, where it goes, and how long anyone keeps it. Last updated on October 30, 2026.

The short version

  • Your history, transcripts, sessions, prompts, dictionaries, and settings are stored on your Mac, not on our servers.
  • Your audio goes straight from your Mac to OpenAI. It never passes through Confer’s servers.
  • Confer’s servers keep no logs of what you say. A result is held for up to 10 minutes so a retried request gets the same answer, and then it is deleted.
  • Neither Confer nor its AI providers train models on your dictations.
  • There is no account to create and no password to leak.

What happens when you dictate

  1. Your Mac checks your license with Confer’s API and receives a short-lived key for transcription.
  2. Your Mac streams the audio directly to OpenAI’s speech model over an encrypted connection.
  3. The transcript goes to Confer’s API with what it needs to format the result: the prompt’s instructions, your smart dictionary terms, the name of the app you’re in, and, during a dictation session, earlier text from that session.
  4. Confer’s API sends that to OpenAI, or to Google’s Gemini API if OpenAI fails, and streams the result back to your Mac.
  5. Your Mac pastes the result and saves it to the history on your Mac.

Who keeps what, and for how long

  • Your Mac. Everything in your history stays until you delete it. Audio from a successful dictation is not saved. Audio from a failed dictation is kept for 24 hours so you can retry it, and then it is deleted.
  • Confer. Each dictation request and its result sit in a temporary cache for up to 10 minutes. Server logs record timings and hashed identifiers, never what you said. For billing, Confer keeps your name, email, license code, subscription status, and the Macs you have activated, for as long as you have a license.
  • OpenAI. Confer turns off response storage on every request. OpenAI keeps API inputs and outputs for up to 30 days to detect abuse, then deletes them. OpenAI does not train on API data.
  • Google. Used only when OpenAI fails. Google keeps Gemini API prompts and responses for 55 days to detect abuse and does not use them to improve its products.
  • Stripe. Handles your card at checkout. Confer never sees your card number.

How Confer is built

  • Every connection, to Confer and to its providers, is encrypted in transit.
  • The app is signed and notarized by Apple. Updates are signed, and Confer verifies the signature before installing one.
  • Confer only listens while you are dictating. It never records in the background.
  • Your license code is the only credential. There are no passwords to reuse or phish.

Subprocessors

  • OpenAI: speech recognition and formatting
  • Google (Gemini API): formatting when OpenAI is unavailable
  • Stripe: payments and billing
  • DigitalOcean: hosts Confer’s API
  • Laravel Nightwatch: monitors the API’s timings and errors, never what you said; keeps its data for 90 days

Compliance and security reviews

Confer is an independent product and is not SOC 2 or ISO 27001 certified. If your company needs a security questionnaire answered or a data processing agreement signed, email support@confervoice.app.

See also the Privacy Policy.