The key
Keychain, this device only.
A 256-bit key, stored as a generic password under the service com.lockedinflow.app with the “after first unlock, this device only” class.
SEC Security architecture
Security, in plain facts.
LockedIn Flow records, recognizes, cleans up and pastes on the Mac. Its only entitlement is the microphone. Its own source has no networking code. Your audio is never saved and never sent. What you keep is encrypted.
- 1
- Entitlementaudio input
- 2
- Code dependenciesboth pinned
- 39
- Model filesSHA-256 checked before load
- 256-bit
- AES-GCM keyin your Keychain
01 Architecture
Every stage runs on the Mac.
Capture, recognition, cleanup, storage and delivery each live in a single-purpose library inside one app. The speech model is installed once, before first use, and verified every time it loads.
- 01MicThe input selected in macOSmacOS
- 02Capture16 kHz mono · memory onlyAudio
Capture - 03SpeechParakeet TDT v3 · Core MLSpeech
Engine - 04CleanupLocal rules · your vocabularyText
Intelligence - 05SaveHistory first · AES-256-GCMVoice
Core - 06One paste⌘V once · clipboard put backInsertion
Engine - 07CursorThe app you're inYour app
Read-only · before first useSpeech models39 files · size and SHA-256 checked before load · never fetched, never repaired
KeychainAES-256-GCM keyAfter first unlock · this device only
02 Invariants
Eight properties the code keeps.
Written into the threat model and held by the source. Read them as the contract a dictation follows from the microphone to your cursor.
- P·01
Audio and transcripts stay on the Mac. Neither is sent to a remote service.
- P·02
Recording never waits on the app. It is never refused because of Accessibility or the app in front.
- P·03
Saved before it's typed. No delivery result removes a finished transcript.
- P·04
At most one paste. Never retried, so never doubled.
- P·05
Identified password fields get nothing. A field macOS identifies as a password field receives no text.
- P·06
Models are read, never fetched. The app does not download, repair or modify a speech model.
- P·07
Logs never hold your words. Dictated text is not written to logs.
- P·08
Release builds carry no diagnostics. Diagnostic commands are compiled out and checked on the binary.
03 Datasheet
Every stage, and where it runs.
The complete path of one dictation, then everything the build is made of. Nothing in the first table leaves the Mac; the text leaves only if the app you paste into sends it.
| Stage | What happens | Leaves the Mac |
|---|---|---|
| Capture | 16 kHz mono, held in memory and never written to disk. Optional Voice Focus, off by default, reduces steady background noise and falls back to standard capture. | No |
| Silence trim | An on-device voice-activity model trims silence at the edges. On by default. | No |
| Recognition | Parakeet TDT v3 through Core ML on Apple silicon, after you finish speaking. | No |
| Cleanup | Local rules and your vocabulary. Optional contextual cleanup uses Apple's on-device model on macOS 26 with Apple Intelligence, with a meaning check and an instant fallback to the rules. Off by default. | No |
| Save | Saved to History before delivery. In memory until you quit, by default; AES-256-GCM on disk if you keep it longer. | No |
| Delivery | Clipboard, then one ⌘V to the app in front, then your previous clipboard is put back. Kept off Universal Clipboard and marked so clipboard managers skip it. Fields macOS identifies as password fields are skipped. | Into the app you're in, under its own policies |
| Edit learning | Opt-in, off by default. Three in-memory checks over 30 seconds of the field just pasted into. Never a password field; field values are never stored. | No |
| Model install | Once, before first use, by a separate script or your own package. Pinned revisions; every file's size and SHA-256 checked. | Downloaded once, outside the app |
| Updates | No updater. Installing a new version is always an explicit act. | No |
Supply chainPinned
- Speech runtime
- FluidAudio · Apache-2.0 · exact version pinned, commit recorded
- Shortcuts
- KeyboardShortcuts · MIT · source vendored
- Models
- Parakeet (CC BY 4.0) and Silero VAD (MIT) · 39 files pinned by revision, size and SHA-256; the hashes are compiled into the app
- Every build
- CycloneDX bill of materials and a provenance record: source commit, clean or modified tree, hashes, tool versions
- Release builds
- Diagnostic commands compiled out and checked on the binary
RequirementsFor Mac
- Hardware
- Apple silicon
- System
- macOS 15 or later. Optional AI features need macOS 26 with Apple Intelligence; dictation doesn't.
- Disk
- About 484 MB for the speech model, installed once. Optional English Precision model: about 614 MB more.
- Signing
- Your Developer ID · hardened runtime · notarized by you
- License
- MIT. No account, no activation, no license server.
04 Storage and encryption
Nothing kept unless you choose.
What's kept is encrypted: AES-256-GCM, under a key that stays in this Mac's Keychain. Audio never touches the disk.
| Data | Where it lives | Protection |
|---|---|---|
| Microphone audio | Memory only. One failed recording can be held in memory for Retry. | Never written to disk |
| History | Memory until you quit, by default. On disk only if you choose a longer period. Up to 500 entries. | AES-256-GCM on disk |
| Recovery log | The last 100 transcripts, under the same retention setting as History. | AES-256-GCM on disk |
| Vocabulary and snippets | On disk when you add them. | AES-256-GCM |
| Meeting notes | On disk only if you turn Meeting notes on (macOS 26 with Apple Intelligence), until you delete them. | AES-256-GCM |
| Usage totals | Word and dictation counts, speaking time, first-use date. No dictated text. Resettable. | AES-256-GCM |
| Settings | macOS preferences, domain com.lockedinflow.app. No dictated text. | Not encrypted |
| Speech models | On disk before first use. Root-owned system location on managed Macs. | SHA-256 checked before every load |
| Logs | macOS unified logging, subsystem com.lockedinflow.app. | Fixed messages only · never dictated text |
The files
One folder. Unreadable files set aside.
Encrypted files live in one folder in the user's Library, under Application Support. A file that can't be read is moved aside under a dated name, never written over.
Your part
Protect the session.
Encryption at rest guards the files. FileVault, screen lock and your admin controls guard the key: root, an administrator or an unlocked session can reach it.
05 Permissions
Two permissions. Nothing else.
Recording needs only the microphone. Accessibility lets it paste at your cursor; without it, your words are copied for you to paste, and Copy only mode needs no Accessibility at all.
Accessibility — every use, listed
- Deliver
- Post one ⌘V to the app in front.
- Undo
- Post one ⌘Z when you say “undo that”. It undoes that app's last step.
- Refocus
- Bring your app back to the front if a LockedIn Flow window is in front at delivery.
- Protect
- Ask whether the focused field is a password field.
- Restore
- Check the app is responding before your clipboard is put back.
- Learn
- Re-read the field just pasted into, only if edit learning is on. Off by default.
Never requested
- Contacts
- Calendar
- Location
- Camera
- Screen Recording
- Full Disk Access
macOS grants Accessibility as a whole, so it is a broad permission. On managed Macs it can be pre-approved with a PPPC profile for your signature; the microphone is always approved by each user.
06 Network behavior
No network requests of its own.
The app never downloads models, checks for updates, sends telemetry or calls a hosted service. Its speech library's downloader is switched off before any model loads.
The only download is the speech model, once, outside the app: a separate script fetches pinned revisions, limits each file to its expected size and checks every SHA-256 before moving the model into place. On managed Macs, your own package installs it instead.
After that, dictation needs no internet. A missing or altered model is never fetched; it's refused. Links in the app open in your browser only when you click them.
Enforce itThese statements describe what the source does. For an enforced boundary, deny the app outbound access with your firewall or endpoint policy. Install the models first, apply the rule, and confirm the speech model still shows as ready.
Connection ledgerNo requests of its own
- Speech service
- NoneRecognition runs through Core ML on the Mac.
- Hosted LLM
- NoneOptional cleanup uses Apple's on-device model.
- Telemetry
- NoneNo analytics, no crash reporting.
- Update check
- NoneNo updater, no release feed.
- Account
- NoneNo sign-in, no activation, no license key.
- Model download
- NoneLibrary downloader switched off before any model loads.
- Listener
- NoneNothing accepts inbound connections.
- Entitlements
- 1Audio input. No network entitlement.
07 Threat model
What could go wrong, and who controls it.
Each threat, what the app does about it, and the control that stays with you. The model assumes macOS and the signed-in session can be trusted.
| Threat | What the app does | Your control |
|---|---|---|
| Audio or text leaves the Mac | No networking code in its own source. No telemetry, updater or account. The library downloader is switched off. | Deny outbound access with a firewall or endpoint rule. |
| Text lands in a password field | Skips any field macOS identifies as a password field: nothing typed, nothing copied. | Use Copy only where an app presents password fields as ordinary text. |
| Text is inserted twice | Exactly one ⌘V per dictation, never retried. | If a paste doesn't arrive, re-insert it from History. |
| A dictation is lost | Saved to History before delivery. An unreadable file is moved aside, never overwritten. | Choose the retention period that fits your policy. |
| Clipboard exposure | Previous clipboard put back. Kept off Universal Clipboard, marked for clipboard managers to skip. | Govern clipboard tools by policy, or use Copy only. |
| Stored text is read at rest | AES-256-GCM, key in the Keychain, this device only. | FileVault, screen lock and admin controls protect the key. |
| A speech model is swapped | Every file's size and SHA-256 must match the list compiled into the app. A managed model folder must be root-owned. | Stage models in the system location your package controls. |
| A dependency is compromised | Two code dependencies, both pinned. A bill of materials with every build. | Deploy only builds made from a reviewed commit; reject a build whose provenance shows a modified tree. |
| A malicious update | No updater. A new version is always an explicit install. | Deploy only builds signed with your Developer ID. |
| Words end up in logs | The logging interface accepts no arbitrary strings. | Logs show which app received a dictation, never what was said. |
| Accessibility is broad | Used only for the six actions listed above. Recording never needs it. | Copy only works without it. Revoke the grant in System Settings. |
Outside the model: a compromised Mac, administrator account or management server; what a destination app does with text after the paste; modified or redistributed builds; and compliance certification for a particular organization.
08 Verify it yourself
Don't take our word for it.
Everything on this page is checkable on a test Mac with synthetic dictation. Evaluating organizations can review the full source on request.
- Read the entitlements. One key: audio input. No network entitlement.
- Open the build record. The bill of materials and provenance file sit inside the app bundle, with the source commit and whether the tree was clean.
- Check the model folder. On managed Macs:
root:wheel, directories0755, files0644, no ACLs, no symlinks. - Block egress, then dictate. Apply your firewall rule, confirm the model shows ready, and dictate synthetic text into the apps your teams use.
- Read the logs. Fixed messages, reason codes and the receiving app's bundle ID. Never your words.
- Test the edges. A password field, a focus change mid-dictation, Copy only, and re-insert from History.
ComplianceTakes the transcription vendor out of your data flow. Compliance is decided by your deployment. FileVault, screen lock, MDM and this app are inputs to your own risk analysis. Clinical teams can start with the healthcare evaluation.
MIT Free · optional services
Bring your security questionnaire.
We answer questionnaires and take vulnerability reports privately through the contact form. Managed deployment and support are optional services from LockedIn Labs.
Architecture statements reviewed against the source · October 2026