Where Does Your Voice Data Go? A Privacy Deep-Dive into Popular Dictation Apps

The Illusion of "Free" and Convenient Voice Dictation

Voice dictation has become an indispensable productivity tool. Articulating complex software logic, drafting sensitive litigation arguments, or writing psychotherapy notes at 160 words per minute feels revolutionary compared to keyboard fatigue.

However, behind the polished user interfaces of modern speech-to-text applications lies a fundamental architectural divide:

To understand the tangible risks of this divide, we conducted packet-capture inspections, reviewed vendor terms of service, and audited sub-processor registers across four leading dictation technologies:

Comparative Architecture & Data Flow Breakdown

┌────────────────────────────────────────────────────────────────────────────────────────┐
│                        HOW VOICE DATA TRAVELS: 4 ARCHITECTURES                         │
├───────────────────┬─────────────────────────┬──────────────────────┬───────────────────┤
│ Application       │ Network Path            │ Remote Sub-processors│ Cloud Retention   │
├───────────────────┼─────────────────────────┼──────────────────────┼───────────────────┤
│ Otter.ai          │ WebSockets → AWS S3     │ AWS, Segment, Stripe │ Indefinite default│
│ Nuance Dragon     │ HTTPS TLS → MS Azure    │ Microsoft Azure      │ Up to 90 days     │
│ OpenAI Whisper API│ HTTPS POST → OpenAI API │ OpenAI, Cloudflare   │ 30-day default log│
│ Murmur (Local)    │ NONE (Air-gapped RAM)   │ ZERO (100% On-device)│ ZERO (0 Bytes)    │
└───────────────────┴─────────────────────────┴──────────────────────┴───────────────────┘

Deep Dive 1: Otter.ai (Cloud Recording & Meeting Bots)

Otter.ai is widely used for meeting notes and real-time transcription. However, its architecture is engineered around continuous cloud streaming:

Deep Dive 2: Nuance Dragon (Dragon Professional Anywhere)

For decades, Dragon NaturallySpeaking was the gold standard of local desktop dictation. However, Nuance's modern enterprise products (now owned by Microsoft) have shifted heavily to cloud-hosted acoustic engines:

Deep Dive 3: Whisper via OpenAI API (The SaaS Wrapper Model)

Many modern voice dictation apps (such as Wispr Flow, Superwhisper cloud modes, and custom menu bar utilities) rely on OpenAI's hosted Whisper endpoint (api.openai.com/v1/audio/transcriptions):

> "OpenAI retains API data for 30 days for abuse and misuse monitoring purposes, after which it is deleted (unless legally required otherwise)."

Deep Dive 4: Murmur (100% Local-First & Air-Gapped)

Murmur was engineered from the ground up to eliminate policy promises and replace them with physical hardware isolation:

- macOS: Apple Silicon Metal GPU shaders and Accelerate framework.

- Windows: DirectML (DirectX 12 GPU compute) and NVIDIA CUDA / Tensor Cores.

Detailed Privacy & Regulatory Comparison Table

Legal & Regulatory Implications for Professionals

1. Attorney-Client Privilege (ABA Model Rule 1.6)

Under American Bar Association Model Rule 1.6(c), lawyers are legally obligated to "make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client."

Streaming privileged strategy notes, witness interviews, or settlement negotiations to cloud speech vendors without explicit client disclosure exposes attorneys to malpractice allegations and potential waiver of privilege.

2. HIPAA & Healthcare Privacy (45 CFR § 164.502)

Covered healthcare entities cannot disclose Protected Health Information (PHI) to third-party vendors without an executed Business Associate Agreement (BAA). Using consumer cloud dictation tools for patient clinical summaries violates HIPAA guidelines. Because Murmur never transmits data outside the hospital laptop, it does not act as a cloud intermediary.

3. Enterprise NDAs & Proprietary Source Code

Software engineers dictating proprietary algorithms, API keys, or unreleased system designs into cloud voice utilities risk violating non-disclosure agreements with employers and clients.

How to Audit Your Dictation Tools Yourself

Don't trust marketing claims—verify network traffic on your own machine:

macOS: Packet Monitor with tcpdump

# Monitor all outbound packets from your machine while dictating:
sudo tcpdump -i any -n "not port 53 and not port 443"

(Notice: With Murmur active, zero packets are emitted. With cloud tools, continuous packet streams to AWS/Cloudflare appear instantly.)

Windows: Packet Monitor with pktmon

# Create a filter and monitor active adapters:
pktmon filter add -t TCP -p 443
pktmon start --etw
# Dictate your text, then stop and inspect:
pktmon stop
pktmon format PktMon.etl -o log.txt

Little Snitch / LuLu (macOS) & Portmaster (Windows)

Configure application-level firewalls to block all outbound connections for Murmur. You will notice that Murmur functions flawlessly with all network adapters disabled.

Conclusion: Data Sovereignty as a Default

Privacy should not be an expensive enterprise add-on or a checkbox in a 40-page terms of service agreement. By leveraging modern local hardware acceleration and open-weights Whisper models, Murmur proves that you no longer need to sacrifice privacy to achieve world-class voice dictation.