Security

The shape of the thing

Listen has no server and no account. There is nothing of yours for us to hold, lose, or be compelled to hand over: the only thing it can ever send is anonymous statistics whose complete dictionary is public, and never your content.

Recording, transcription, speaker identification and search all run on your own hardware. None of this page has to be taken on trust, and the way to check it is from outside the app rather than inside it: put a firewall in front of Listen and watch what it tries to reach, or pull the network connection and see that nothing stops working.

What runs on the device

• Transcription: NVIDIA Parakeet through MLX, or Apple Intelligence, on the Mac. Audio has no network path at all.
• Speaker identification: FluidAudio diarization and voice embeddings, on the Neural Engine.
• Search, notes, tags: plain files under ~/Library/Application Support/Listen, one folder per recording, no database.
• People & Memory: off until enabled. When it is on, transcript passages are read by whichever model you have configured, which may be a model on this Mac, your own API key, or an assistant subscription you already hold. Each detail it extracts keeps the sentence, speaker and timestamp it came from, is stored in the same local folder, and can be edited, retired or deleted. Nothing about it reaches a Listen server, because there is not one.
• The iPhone app records, transcribes and separates voices on the phone: Apple's SpeechTranscriber on iOS 26, which reads ten languages, and the same FluidAudio diarization the Mac uses. Audio has no network path there either. A language it does not read is left for the Mac rather than guessed at.

Every connection, declared

The repository ships InternetAccessPolicy.plist inside the application bundle, at Listen.app/Contents/Resources/: a machine-readable list of every outbound connection, which firewall tools such as Little Snitch read and display. It is in the copy you downloaded, so it is checkable without taking anybody's word for what the shipped build does.

• huggingface.co, once, for the speech model. No audio is ever uploaded.
• github.com, every two days, to ask whether a newer version exists. Updates are Ed25519-signed and notarized.
• iCloud, only if you turn sync on. Off by default.
• The Ask endpoint you configure, if you configure one. Nothing is set out of the box, and the local Ollama default sends nothing anywhere. The built-in OpenRouter connection requires a Zero Data Retention endpoint and denies provider data collection on every request.
• eu.i.posthog.com, on by default and turned off in Settings, Privacy. Counts and durations in rough buckets plus crash reports, under a random install ID; never recordings, transcripts, titles or names. TELEMETRY.md is the complete dictionary, and the filter that enforces it is public code.

An organisation can force the last three off with a device profile: see MANAGED.md.

How sync is sealed

Sync goes through your own private CloudKit database. There is no Listen server in the path, and Apple stores ciphertext it cannot read.

• Every payload is sealed on your device with ChaCha20-Poly1305 under a 256-bit key generated on your first Mac and carried between your devices by iCloud Keychain. The key never touches a Listen system, because there is none.
• Record names are HMAC-SHA256 of the content key, so even the names of records reveal nothing: no titles, no dates.
• Voiceprints live in their own zone that only Macs subscribe to. The phone never receives one, by construction rather than by politeness.

What CloudKit can see, exactly: record counts, change timestamps, asset sizes, and three plaintext coordination fields (claimedBy, claimExpires, audioOn) whose values are opaque device identifiers. That is the complete list, and listen sync inspect prints the container's actual shape so you can confirm it against a live account.

Protection at rest

• Mac: the library inherits your account's protections; FileVault is the disk-level answer and the deployment guide requires it for regulated use. Daily backups under ~/Backups/Listen are created owner-only (mode 700), keep 7 daily clones and 30 sidecar archives, then age out.
• iPhone: the library is held under iOS Data Protection (completeUntilFirstUserAuthentication, chosen so a recording survives a locked screen), and whether it rides device backups is a setting in Storage.
• Voiceprints are deletable everywhere. A voiceprint is biometric material, so "forget this person" exists as a first-class operation: it strips their embeddings from every recording, propagates through sync so every Mac and the CloudKit records follow, and a re-taught name is honoured again. listen forget is the CLI verb.

The activity log

Every MCP tool call, agent run, export, deletion and backup leaves one line in activity.jsonl beside the library: the event and recording ids, never transcript text, names or questions. It exists because an agent that can read your whole library should not be able to do so tracelessly. listen activity reads it back.

What this does not defend against

Honesty about the boundary is part of the design. Anyone who can run code as your user account can read the library, exactly as they could read your documents; the MCP server is a pipe available to processes on your Mac, which is the point of it, and connecting an agent to it is a decision you make. A person holding your unlocked phone can read what the phone holds. The protections above are about the network, other people's clouds, and devices at rest, not about an already-compromised session.

Regulatory mapping

For HIPAA-regulated deployments, the technical safeguards of 45 CFR 164.312 map to Listen and the OS as follows. The deployment guide turns this into a checklist.

Under GDPR, the operator of Listen is the controller of what they record; no personal data reaches the maker of the software. Erasure is real deletion propagated across devices, voiceprints included; portability is the file layout itself, open WAV and JSON on disk; and privacy by design is the architecture on this page: every network connection is declared, and every one of them is yours to turn off.

Checking, not trusting

# every outbound host, for your firewall
open InternetAccessPolicy.plist

# what the container actually holds, without decrypting it
Listen.app/Contents/MacOS/Listen sync inspect

# the whole sync design, proved offline in about a second
Listen.app/Contents/MacOS/Listen sync --fake

# who touched the library
Listen.app/Contents/MacOS/Listen activity

This page is engineering documentation, not legal advice. If you are deploying Listen under a regulatory framework, have counsel review your configuration; the architecture makes that review short.