Trust Center
Your client's voice never reaches us. Check it yourself.
Recordist never uploads your audio to us. It transcribes the audio itself and, with the built-in engine, writes the notes too. Open Settings, then Privacy, then the Privacy Ledger, and read the app's own list of what it sent. Every claim on this page points at a setting, a file or a page you can open the same way.
The promise
Your calls stay yours. We have nowhere to keep them.
Your recordings, transcripts and notes stay with you, never with us. Recordist has no server that could hold them. We keep nothing about your meetings: only the email you give us on a receipt or on one of our forms, and what each form on this site says it stores.
If you choose a cloud AI provider for notes, the transcript goes straight from Recordist to that provider under your own account. That is your choice, off by default, and listed in the Privacy Ledger. On a Mac your organisation manages, it can choose to archive each meeting to its own storage. We never receive it.
Privacy you can check
Nothing joins the call, so your client hears about the recording from you, not from a bot. By default it asks before it records. Recordist never uploads your audio to us. It transcribes the audio itself and, with the built-in engine, writes the notes too. Flip the switch to see exactly what changes if you bring your own cloud key.
- Audio
- never uploaded to us
- Transcription
- on-device
- Notes
- built-in engine, or your own key
- Accounts
- none
Check it in Settings → Privacy → Privacy Ledger
- bytes sent to the internet
- 0
- 41,208 · 1 meeting
- audio sent to us
- never
- accounts
- none
- bots in your calls
- 0
- telemetry
- a first-launch mark and three first-step marks, once each, no identifier
what left, exactly
| when | what | to | bytes |
|---|---|---|---|
| Tue 14:41 | transcript of “Pricing sync”, its title and attendees, and your template | api.anthropic.com (your key) | 41,208 |
We never receive audio or this list, and notes requests go only to the provider you chose. Each one is written here before it is sent. With the built-in engine and no organisation archive, this table stays empty.
The app writes its network requests to its Privacy Ledger, with the host, the bytes sent, the reason, and whether each one stayed on this machine or went to the local network or the internet. Open it any time in Settings → Privacy.
Check it from outside the app
The Privacy Ledger is the app’s own record. For a view the app cannot shape, run a network monitor such as LuLu (free) or Little Snitch while you record a call. It shows every connection Recordist makes.
Recordist itself is not open source. The gateway that connects assistants such as Claude Desktop to it is, under the MIT licence. Its source.
The vendor pack, for IT, security and procurement
What a vendor review usually asks for, ready before anyone asks. Forward this page, or any one of these. Each restates what this Trust Center, the security page and the privacy policy already say, and each says "Not yet" where that is the honest answer.
The one-page security brief
Where meeting data lives, what the app sends out, AI, consent, retention, signing and assurance, on one printable page.
The pre-filled questionnaire
Our answers by domain, the way SIG Lite or CAIQ groups them, with the public source of each. Copy it as text or download it as CSV.
Data processing position
We process no meeting content. What we hold as controller, our processors, transfers, and what that means for a DPA.
Vulnerability disclosure
How to report a security issue, what is in scope, our response times and the safe harbour for good-faith research.
Managed settings for IT
A configuration profile for managed Macs: notes written on the Mac itself, retention caps, legal hold, update control.
Accessibility statement
The standard we work to, what the site and the app do today, and what we have not tested yet.
What a firm's IT can set on the Macs it manages, from notes written on the Mac itself to a legal hold, is on Ask IT for Recordist.
What the app sends out
By default, nothing about your meetings. Every case that can send anything is listed here with what, where and when. The app records the same events in its Privacy Ledger, in Settings → Privacy, so you can compare.
The ledger marks each request This machine, Local network or Internet (This Mac on a Mac before 1.0.4), and only the requests marked This machine stayed put. Each request that can carry meeting content is written to the ledger before it is sent, so one that fails or is cut off still has its row. A few kinds of request are not recorded yet, none of them carrying meeting content, and the ledger article lists them.
Scroll the table sideways to see every column.
| Feature | Data | Destination | When |
|---|---|---|---|
| Recording, transcription, search, Prep Briefs | Nothing | Nowhere | Never, unless the organisation that manages your Mac turns on its archive (below). |
| Local AI notes | Nothing with the built-in engine; with your own Ollama on another server, the same meeting content as cloud notes | The built-in notes engine on your machine, or your own Ollama at the address you set | Never leaves your machine with the built-in engine. If you choose your own Ollama and set its address to another server, the transcript text goes to that server, and the Privacy Ledger marks those requests Local network or Internet; status checks and model lists also go to that address, with no meeting content. Recordist refuses the Ollama cloud models it can recognise, which run on Ollama's servers, and the built-in engine writes those notes instead. |
| Cloud AI notes with your own key (optional) | The transcript text of that meeting, its title and attendee names, the date of the meeting and your template; for Ask, the transcripts of the meetings you ask about | The provider you chose (Anthropic, OpenAI or a compatible endpoint), directly | When notes are written, which happens after each meeting unless you turn off Write notes automatically when a recording stops in Settings → AI notes, and when you use Ask. Each request is written to the Privacy Ledger before it is sent. The Test button in Settings → AI notes sends one short request with no meeting content. |
| Transcription model download | A download request; nothing about you | Our download host (media.recordist.app), with Hugging Face as a fallback | During setup, and when you pick a model in Settings → Transcription. Each file is checked against a size and SHA-256 built into Recordist before it is used, and a file that does not match is deleted. |
| Built-in notes engine download | A download request; nothing about you | Our download host (media.recordist.app), with the Ollama project on GitHub (github.com) as a fallback | After you finish setup with the built-in engine chosen (the default), and again at launch until it is installed. It is checked against a size and SHA-256 built into Recordist before it is unpacked. |
| Notes model download | A download request made by the notes engine itself; nothing about you | Ollama's model registry (registry.ollama.ai) | Once per model, right after the notes engine is installed or when you pick another built-in model in Settings → AI notes. The notes engine checks each part against the SHA-256 values in the model's manifest from the registry; Recordist does not ship those values. |
| Calendar feeds (ICS) you add (optional) | A request for the feed address you entered; nothing about you or your meetings | The address you entered, such as Google Calendar | Every five minutes while the app runs, except during a recording, once you add a feed in Settings → Detection → Calendar feeds. None are set by default. |
| Update check | A request for one fixed file. It carries no app version, platform or identifier; its user agent names only the updater component and that component's version. | Our release host (media.recordist.app) | At launch and every six hours while the app runs; the switch is Settings → General → Check for updates automatically. |
| First-step marks (from version 1.0.7) | Three requests at most, one per step, each for one fixed address whose path names only the step (a first call recorded, the Pro trial started, the License screen opened), the app's version and the platform. No identifier and nothing about any meeting, only what any web request carries. | Our release host (media.recordist.app) | Each once, with an update check after the step happens; never while update checks are off or while Settings → General → Count first steps anonymously is off. |
| First-launch mark (from version 1.0.3) | One request for one fixed address whose path names only the app's version and the platform, such as a Mac with Apple silicon, so we can count new installs. No identifier, only what any web request carries. | Our release host (media.recordist.app) | Once, with the first update check after you install the app; never again, not after an update or a reinstall over your data, and never while update checks are off. |
| Withdrawn-keys list | A plain request for the public list of withdrawn licence keys; it carries no key, licence id or account, only what any web request carries. The app compares the list with your key on your machine. | Our licence service (license.recordist.app) | With each update check, only while a licence key is stored in the app; turning update checks off turns it off too. |
| Automatic renewal of a Pro subscription (from version 1.0.5) | Once, the subscription key with a one-way code of a random secret kept in your keychain; after that, only the key's licence id and that secret. Nothing about your meetings. | Our licence service (license.recordist.app) | With the update check, only while a Pro subscription key is stored: once when the key is saved, then about once a day in the last days of each paid period until the renewed key arrives. Turning update checks off turns it off too, and the renewal email still brings each key. |
| Pro after you buy from inside the app (from version 1.0.9) | Only a random code the app made for that checkout, from nothing about you or your machine. When the key bought with it is ready, the answer brings the key, and the app checks it as it would a pasted one. The page the app opens carries only a one-way code made from it, which cannot collect the key; that one-way code can appear in our host's standard server logs for up to 30 days and goes to Stripe with the order. | Our licence service (license.recordist.app) | Only after you open Pro checkout from the app: every few seconds for 15 minutes, then when the app starts, when you switch back to Recordist and about once an hour, until the key arrives or 24 hours pass. A note of which licence the code bought is kept for 7 days, then deleted; the key also arrives by email. |
| Your email for the Pro key (from 1.0.10, optional) | The address, a random code for this install, the platform, the app's version, your time zone and which words you saw. The optional answer about how you found Recordist, if you give one, goes on its own, as a count | recordist.app | Only if you give it, when Recordist first opens or after the update; it tries again while offline for up to 7 days. Listed in the Privacy Ledger. |
| Update download | A download request; nothing about you | Our release host (media.recordist.app) | From version 1.0.9, by itself in the background after a check finds a new version, never during a recording, while Settings → General → Install updates automatically is on, as it is unless you turn it off; otherwise when you choose to install an update. It is installed only if its signature matches the key built into the app. |
| Save as PDF, Save as Word, exports and auto-export (optional) | Nothing; the file is written to a folder on your machine | The export folder, or the folder you chose. If that folder syncs to a cloud drive, the sync app copies the file there. | When you save or export a meeting (PDF and Word from version 1.0.3), or after each meeting if you turn on Auto-export Markdown in Settings → Privacy. Off by default. |
| Share (Mac, from version 1.0.3) | The meeting as a Word file, handed to the app you pick; Recordist itself sends nothing | The app you pick in the Mac share menu, such as Mail, Outlook, Messages or AirDrop, which sends it from your own account | Only when you click Share on a meeting. When your organisation keeps exports in one folder, Share is off and says so. |
| Privacy receipt | Nothing | Nowhere | Made on your machine from the database and the Privacy Ledger. Save as image writes a file to your export folder. |
| Managed settings from your organisation (MDM) | Nothing | Nowhere | Recordist reads the policy from the Mac's managed preferences and reports nothing back, to your organisation or to us. |
| Organisation archive, on a Mac your organisation manages (optional) | Each finished meeting's record: the audio as recorded, the transcript, the notes, the notice marks and that meeting's record-log entries | Your organisation's own storage (Amazon S3 or an S3-compatible store), signed with its own key; never us | After each meeting, and only when your organisation's profile names its storage. Each upload is written to the Privacy Ledger before it is sent. |
| AI assistants you connect (MCP, A2A) | Whatever the assistant asks for | A connection on your own machine only | When your assistant calls a tool. Where it sends what it read is up to that assistant. |
| This website: early-access form (until version 1.0), checkout interest, team contact form, support ticket | What you type: your email, which platform you would run it on, the plan you chose if you asked from the pricing page, and the time you asked; for the team contact form, the details and message you chose to give; for a ticket, the text you wrote. The privacy policy lists everything each form stores. | Our hosting provider's storage for this site | Only when you submit a form here. Nothing from the app. |
| Wren (support assistant, AI) | Your chat messages, with anything that looks like a key removed | Anthropic's API, through this site | Only when you chat with Wren on this website. Message bodies are not logged. |
No analytics, tracking or crash reporting exist in the app; the exceptions are the first-launch mark (from version 1.0.3) and the three first-step marks (from version 1.0.7) above, each sent once with no identifier. The website counts page views without cookies or identifiers. The only diagnostic is Settings → General → Export diagnostics, which writes a file you choose whether to send. It contains no audio and no transcript text. In current versions it also contains no meeting or calendar titles, shows calendar feeds only by their host and server addresses without any path or password, and replaces the tokens and keys it recognises and your home folder's name. It does contain your settings and the last 400 lines of the app's log, so read it before you send it.
Permissions we ask for, and why
These are the Mac's. On Windows, Recordist needs the two microphone switches in Settings and nothing else to record: which Windows permissions Recordist needs.
- Microphone
- To record your side of the call. Without it, only the other participants are captured.
- Screen & System Audio Recording (macOS 14.6 or later)
- macOS gates system-audio capture behind this permission. Recordist uses it to capture audio and never captures screen images or video. If you grant full Screen Recording, it also reads window titles, as the next entry explains.
- Calendar (optional)
- To title meetings and build Prep Briefs from attendee names. Read-only; can be declined.
- Notifications (optional)
- To tell you when notes are ready.
- Screen Recording or Accessibility (optional)
- To read the window titles of the app or browser using the microphone, so the meeting gets its name. Either one works, and Settings → Detection has a button for each. Recordist reads the titles only. You can turn window titles off in Settings → Detection; the app still reads a browser's window titles when the browser starts using the microphone, to tell which meeting site is open.
- Not requested
- Contacts, Location, Camera, Full Disk Access, Automation. The Chrome extension is limited to the supported meeting sites and to the app on your own machine.
How it's protected
No software is perfectly secure and we don't claim Recordist is. What we can say is where the meeting lives, who can reach it, and what we did about each.
Reachable only on-device
The app's local connections for your AI assistants and the extension exist only on-device. They are unreachable from your network by design and refuse requests that arrive any other way.
A token only your account can read
Every request to the app's local API that reads or changes meetings must carry a random token created on first launch and readable by your user account only. The gateway's optional network ports ask for the same token in current versions of the gateway. Each connected program has a token of its own with only what it needs, and the Chrome extension's cannot read meetings. A token is personal to your machine and should never be shared; the app never asks you to.
Keys in the keychain
A cloud AI key, if you add one, lives in your operating system's keychain, never in settings files, exports, diagnostics or logs. The app writes no transcript text and no meeting titles to its log.
- Data at rest: regular files under your user account. The app does not encrypt them itself; full-disk encryption protects them at rest (FileVault on a Mac, BitLocker on Windows, LUKS on Linux), and we recommend turning it on.
- Licences: keys carry a digital signature the app checks offline; the signing key is held by us and is never on your machine.
- Builds: macOS builds are signed with our Apple Developer ID (Team ID JNC57WQK69) and notarised by Apple, and the installer's SHA-256 is on the download page;
SHA256SUMS.txtcovers the latest update archive. The Windows installer is signed by us through Microsoft; the app it installs is signed too. Dependencies are pinned, and updates to them are proposed automatically. - Check the signature yourself: on a Mac, run
spctl -a -vv /Applications/Recordist.appin Terminal. It answersacceptedandsource=Notarized Developer ID, and its origin line ends with our Team ID,(JNC57WQK69). - Website: static, no cookies, page views counted without identifiers, security headers on every page. Payments are hosted by Stripe; card details never touch our infrastructure.
Data retention and deletion
With you
- Audio is deleted 30 days after a meeting by default, and you can choose 7 or 90 days, forever, or deletion right after transcription; this works the same on every plan. On a Mac your organisation manages, its managed settings can cap how long audio and meetings are kept.
- Transcripts, notes and the search index stay until you delete them, or until the age you set in Settings → Privacy → Delete meetings after (off by default; starred meetings are always kept).
- Delete one meeting: removes its records and its audio, overwrites them in the database file and takes them out of search at once. A meeting on hold is not deleted until the hold is released.
- Delete all my data (Settings → Privacy) removes every meeting, transcript, note and audio file, the copies of the database the app set aside before upgrades or after a repair, the exports in the data folder and the Privacy Ledger. Your settings, templates, models, licence, API keys and log stay, and the app keeps running.
- Remove everything and quit (same place) also removes your own templates, the models, the notes engine, your settings, the licence, the API keys in the keychain and the app's log files, switches off launch at login and quits.
- What stays after that, even once you drag the app to the Trash: the data folder with the emptied database, which keeps the built-in templates and the date the Privacy Ledger was emptied; the app's small records in the keychain, such as when its trial started; the log folder in ~/Library/Logs; small macOS folders for the app's window in ~/Library; the permissions you granted in System Settings → Privacy & Security; exports you saved to a folder of your own; and, if you used the gateway, npm's cached copy of it and the entry in your assistant's settings. How to delete everything says how to remove each one.
With us
- If you buy a plan: your email, the plan, the amount and a payment reference, kept while your licence may be valid and then for as long as tax law requires.
- If you asked for early access before version 1.0, when the form closed: your email, which platform you chose, when you asked, how we answered and which version you downloaded, kept until the draw is complete, then for up to 12 months in case of a dispute.
- If you ask to hear when checkout opens: your email, the plan and the time, kept until that checkout opens, then for up to 12 months.
- If you give an address for your key for 14 days of Pro (from version 1.0.10): the address, kept about three weeks and never longer than 30 days, then only a one-way code of it with the key's dates and the words you saw (Privacy 3.2).
- If you open a ticket: what you typed, kept for up to 2 years after the last message.
- If you chat with Wren: nothing is stored beyond the request; message bodies are not logged.
- On any form: short-lived counts against your connection's IP address and, on some, your email address or its domain, kept for a day at most, only to limit repeated tries.
- Notifications to our team through Slack show an address only masked, as its first letter and its domain.
- Never: audio, transcripts, notes, or anything from inside the app.
Accuracy of transcripts and notes
Notes are generated by an AI model, a local one by default or a provider you choose, and may be inaccurate, incomplete or misattribute who said what. Transcripts are automatic and can contain errors. Recordist keeps the recording, for as long as you set, so you can check. The app shows this notice above the notes unless you turn it off in Settings → Appearance, at the top of every Markdown export, and in every PDF and Word file note. Do not rely on notes for legal, medical, financial, employment or safety decisions without verifying them.
Recording law is your responsibility
Recordist records only after you click Record or press the recording shortcut yourself. There are two exceptions, and both are off by default: apps you add to Record without asking for in Settings → Detection, and Allow agents to start recordings in Settings → Integrations, which lets programs that use the app's local API with its token, such as the MCP gateway, start a recording. One-party consent rules cover only conversations you take part in. Recordist records whatever your machine's microphone picks up and whatever plays through its sound output, so it can also record a call or a room you aren't part of, and that needs the consent the law sets for it. Whether you must tell or ask the other people depends on where everyone is. Before your first recording the app asks you to confirm that you understand this. We keep a plain-English summary of US, Canadian, UK, EU, Australian and Indian rules, with the caveat that it is general information and not legal advice.
This website
- No cookies, no third-party analytics, no tracking pixels; we count page views without identifiers. Pages load their fonts, scripts and images from recordist.app and from no other host.
- The films on this site are served from our own domain with the browser's built-in player. No third-party video player, no tracking, no autoplay with sound.
- Wren, the support assistant, is an AI and is labelled as one everywhere it appears. A human reads every ticket.
- No testimonials, user counts or press quotes appear on this site unless they are real and attributable. There are none yet.
Vulnerability disclosure
Email security@recordist.app with a description, steps to reproduce and the app version. We acknowledge within 3 business days and aim to fix confirmed high-severity issues within 14 days. Please give us reasonable time before disclosing, do not test against other people's machines or data, and tell us if you want credit in the changelog. There is no paid bounty at this time. The disclosure policy gives the scope and the safe harbour for good-faith research, and security.txt carries the same contact for tools.
Third-party licences
Recordist is built on open-source software. The app lists its components and their licences under Settings → About → Third-party software; the full licence texts come with each component's own source. The main components:
- whisper.cpp and ggmlMIT
- OpenAI Whisper model weightsMIT
- TauriMIT / Apache-2.0
- cpal (audio capture)Apache-2.0
- RNNoise / nnnoiselessBSD-3-Clause
- SQLitePublic domain
- rusqliteMIT
- Model Context Protocol SDKMIT
- Qwen2.5 and Qwen3 (built-in notes models)Apache-2.0
- OllamaMIT
- Inter, Instrument Serif, JetBrains MonoSIL OFL 1.1
Whisper is a model released by OpenAI under the MIT licence; Qwen is released by Alibaba Cloud under Apache-2.0; Ollama is an open-source project under the MIT licence. "Powered by" statements are factual and imply no endorsement. Every model the app offers for download is under the MIT or Apache-2.0 licence.
What we hold ourselves to
We wrote down what anyone who keeps a record of a conversation owes the people in it, as ten articles, each with a test you can run yourself. The same paper goes through our own product article by article and says what is still open. Read Nobody Owns What Was Said.
Who we are
Recordist is made and sold by an independent software studio incorporated in Canada. Its legal name and registered office are in the terms and the privacy policy. Current version 1.0.12; every release is on the changelog and every open limitation on known issues.
Recordist was built in good faith by people who wanted meeting notes without a bot in the room or a vendor holding the recording. It is a tool for remembering your own conversations. It is not a tool for recording people who do not know, monitoring staff, or surveilling anyone. By default the app asks before it records a call. While it records, an amber dot shows in your menu bar. Only you see it; the other people on the call don't, so telling them is up to you; Recordist can copy a short notice for you to read out or paste into the chat, and keeps a mark of when you said you gave it. Our recording-law guide has notice templates you can use, because we think the people you talk to deserve to know. Use it responsibly; the recording is yours, and so is the responsibility for it.
Questions about anything here: hello@recordist.app.