Security and architecture
No Safeclip server touches your content. That's the architecture.
Most privacy claims are policies. This one is an architecture. Here's exactly how it works, so you don't have to take our word for it.
What “local-first” actually means here
Safeclip runs Whisper and a local language model directly on your device. Your audio is captured, transcribed, summarized, and clipped entirely on your own hardware. Nothing is uploaded or transmitted to Safeclip's servers at any point in that pipeline. This isn't a setting you configure. It's the default architecture of the app.
The only data that ever leaves
- Account or installation identifier
- App version number
- Update channel
What stays on your device
- Audio or video data
- Transcripts or text content
- Recording metadata
- Filenames or file paths
How this compares
Most AI note-taking tools, including well-funded ones with strong reputations, capture audio locally but store the transcript in the cloud. Some route your audio through a private inference API instead of storing it. Both of those are meaningfully better than fully cloud-native tools, but both still involve a server somewhere holding your words. Safeclip has no such server for your content. It's a different category, not a more careful version of the same category.
What this means in practice
- No BAA required for regulated professionals, because nothing protected is transmitted.
- No data breach surface for your recordings on our end, because we never receive them.
- No policy that can change on you later, because there is no server-side retention of your content.
- Works with no internet connection at all, because it was never designed to need one.
The trade
Every tool here involves trade-offs. Here is ours, plainly.
| Safeclip | Cloud notesGranola, Otter, Fireflies | Therapy scribesMentalyc, Upheal, Blueprint | |
|---|---|---|---|
| Where the recording lives | On your machine. Not sent to Safeclip. | Their servers. | Their servers. |
| Who can read it | You. Safeclip never receives your recordings or notes. | The vendor, and whoever they process with. | The vendor, and whoever they process with. |
| Joins the meeting for you | No. You start the recording yourself via the menu bar or in-app. This is the trade. | Usually yes: a bot or desktop agent. | Usually yes: a bot or dedicated recorder. |
| Clinical notes / EHR | SOAP/DAP draft, on-device (Founding License). You paste it into whichever system you already use. Not a chart replacement. | Meeting notes. Not clinical. | Session notes aimed at documentation. Closer to the chart, still not the EHR. |
| Clip or audiogram on disk | Yes. Waveform file and captions saved locally. | Not the focus, or a cloud render. | No. |
SafeclipCloud notes (Granola, Otter…)Therapy scribes (Mentalyc…)
Where the recording lives
- Safeclip
- On your machine. Not sent to Safeclip.
- Cloud notes
- Their servers.
- Therapy scribes
- Their servers.
Who can read it
- Safeclip
- You. Safeclip never receives your recordings or notes.
- Cloud notes
- The vendor, and whoever they process with.
- Therapy scribes
- The vendor, and whoever they process with.
Joins the meeting for you
- Safeclip
- No. You start the recording yourself via the menu bar or in-app. This is the trade.
- Cloud notes
- Usually yes: a bot or desktop agent.
- Therapy scribes
- Usually yes: a bot or dedicated recorder.
Clinical notes / EHR
- Safeclip
- SOAP/DAP draft, on-device (Founding License). You paste it into whichever system you already use. Not a chart replacement.
- Cloud notes
- Meeting notes. Not clinical.
- Therapy scribes
- Session notes aimed at documentation. Closer to the chart, still not the EHR.
Clip or audiogram on disk
- Safeclip
- Yes. Waveform file and captions saved locally.
- Cloud notes
- Not the focus, or a cloud render.
- Therapy scribes
- No.