SECURITY & ENTERPRISE · UPDATED AUGUST 2026

Security review, in plain facts.

Everything an IT or InfoSec team needs to evaluate LockedIn Flow: where dictation data is processed, what permissions the app requests, how it is signed, and which deployment features are available today.

The one-sentence posture

LockedIn Flow has no vendor transcription backend: dictation audio, transcripts, vocabulary, and screen content are not sent to us. Network access is limited to the initial model download and optional update checks.

Data flow (complete)

Scroll horizontally to inspect every column.

Permissions — the whole list

• Microphone — capture only.
• Accessibility — to insert text at the cursor and to refuse password fields. With the optional edit-learning setting off, as it is by default, normal field content is not read.
• Optional edit learning (available in v0.4.8) — when “Learn corrections from my edits” is explicitly enabled, the app briefly re-reads only the exact field where it just inserted a dictation: three checks over 30 seconds, with secure fields refused and Clinical Mode excluded. It can save the person’s own single-word fix as a reviewable, removable vocabulary rule. Field values are compared in memory and are never stored, logged, or transmitted.
• Never requested: Full Disk Access, Contacts, Calendar, Location, Screen Recording, Input Monitoring, Camera.

Code signing & supply chain

• Signed with Developer ID Application: Zero G Foundry LLC (643FW3ZH6M), Apple hardened runtime, minimal entitlements (audio input only).
• Notarized and stapled via Apple notarytool.
• Updates: Sparkle 2 checks the live HTTPS release feed and verifies every update with Ed25519 before installation.
• License validation: offline Ed25519 signatures. No activation server, no phone-home, no device fingerprinting.
• Dependencies are all MIT/Apache-2.0 (Parakeet model: CC-BY-4.0). No GPL. A human-readable dependency inventory is published here; a machine-readable SBOM is planned and not yet shipped.

Offline enforcement for locked-down fleets

After the one-time model download, the app works with all egress blocked — verified in our self-test with network fetches refused at the library level. Models can be pre-seeded via MDM into ~/Library/Application Support/FluidAudio/Models, and there is no account, activation, or revalidation heartbeat for a firewall to learn to hate.

Data governance

• Raw audio is never written to disk, ever.
• Transcript history: AES-256-GCM at rest, retention from off to forever, with a user-visible purge control.
• Logs are metadata-only; transcript content is never logged.
• No analytics or crash-reporting SDKs; dictation audio and transcripts are never uploaded. Third-party network behavior is limited to the speech-model download and optional update checks described above.

Deployment

• Individuals: notarized DMG, drag-install, guided first-launch permission flow.
• Managed fleets: the signed DMG and model can be distributed through existing deployment tooling. Organization-specific permission and MDM guidance is part of the team pilot.
• VDI: works subject to microphone redirection in your VDI stack — the same caveat as any dictation tool.
• Windows: not released. There is no Windows installer today; hardware validation, direct text-delivery work, signing, and packaging remain incomplete. Join the waitlist.

What we don't claim

No HIPAA, FedRAMP, or SOC 2 compliance or certification is claimed. The architecture reduces the cloud-transcription exposure because no transcription provider receives dictation content. FileVault, screen lock, MDM, and this app are inputs to an organization's own risk analysis; they do not by themselves establish compliance. We're happy to answer your security questionnaire through the contact and support form. Healthcare organizations should also read the dedicated healthcare and clinical teams page, which covers the Clinical Mode pilot program and its boundaries.

Architecture statements reviewed against the current app source, August 11, 2026. The signed release feed is active; team deployment controls remain a pilot.