inlaut at work: dictation without the cloud

inlaut turns speech into text on the Mac. There is no server that dictations could be sent to, no account and no telemetry. This page sums up for IT, data protection and information security what the app does and what it does not.

As of 12 October 2026, inlaut 0.3.0. This page describes how the app works and is not legal advice. Whether you may use it is for you to decide based on your own processes.

AI-generated

At a glance

• Processing: entirely on the Mac, also without a network.
• Data held by the developer: none. No account, no telemetry, no crash reports, no usage statistics.
• Storage: no recordings, no history of dictations.
• Code: open source under GPL-3.0-or-later, fully readable.
• Delivery: signed with a Developer ID, notarized by Apple, signed updates.
• Cost: none, including commercial use.

Which data is processed where

• Audio: The microphone is only active while someone dictates. The recording sits in memory, is turned into text there and then discarded. inlaut does not write it to disk.
• Recognised text: inlaut inserts it at the cursor via the clipboard. The entry is marked as transient so that clipboard managers do not keep it; inlaut then restores the previous contents. What happens to the text next is up to the app it lands in.
• Settings and replacements: stored locally in the user account's preferences.
• Logs: The system log contains lengths, timings and error messages, never dictated text.

There are two ways to recognise speech: the Parakeet Ultra speech model that inlaut downloads and runs on the Neural Engine, or the on-device speech recognition of macOS.

Network connections

inlaut makes exactly these connections:

• Speech model (once): On first launch the app downloads about 630 MB from Hugging Face (huggingface.co and its download servers). The revision is pinned, every file is checked by SHA-256 and only used after that.
• Update check (daily, can be turned off): a request for inlaut.de/updates/appcast.xml. It reveals the IP address and the app version, nothing else. No system profile is sent.
• Update download (on request only): from GitHub Releases, when someone installs an update.

If you choose Apple's speech recognition, you allow macOS to download language assets from Apple when needed. None of these requests contain dictations. Once the model is loaded, dictation works without a network.

AI-generated

Data protection and GDPR

Dictated content goes neither to the developer nor to third parties. As we understand it, dictating therefore involves no processing on your behalf and no transfer to a third country; a data processing agreement for the dictations is not needed because nobody outside your company receives them.

You remain responsible for the content: for what is dictated and for the application the text is inserted into. Which connection data arises during download and update checks is described in the privacy policy.

inlaut holds no privacy or security certification. What we can offer is verifiability: every statement on this page can be checked in the source code.

IT security

• Open source: The code is on GitHub. You can audit it and build the app yourself.
• Signature: The app is signed with a Developer ID, notarized by Apple and uses the Hardened Runtime.
• Updates: Feed and update archives are signed; the app only installs updates with a valid signature. Updates are never installed without someone confirming.
• Model: pinned revision, a checksum per file, our own downloader with no third-party components fetched at runtime.
• OpenSSF Best Practices: inlaut meets the “passing” level of the OpenSSF Best Practices Badge. It is a self-assessment; the answer to every criterion is public there.
• No App Sandbox: inlaut runs outside the sandbox, like other tools that insert text into other apps.

Permissions

• Microphone: to record while dictating.
• Accessibility: to paste the text with ⌘V and to use the fn key as a trigger. Without this permission the text stays on the clipboard.
• Speech Recognition: only if Apple's speech recognition is selected.

Deployment and operation

• Requirements: Mac with Apple Silicon, macOS 26 or later, about 630 MB for the speech model per user account.
• Installation: as a DMG or with Homebrew: brew install --cask tobymarks/tap/inlaut.
• Identifier: bundle ID de.tobymarks.inlaut, for example for approvals in device management.
• Firewall: setup and updates only need huggingface.co, inlaut.de and github.com with their respective download servers.

What inlaut does not offer

inlaut is an open-source project by a single developer, not an enterprise product. That means:

• no support contract, no guaranteed response times, no warranty (GPL-3.0),
• no central management, no admin console, no documented device management policies,
• no certification such as ISO 27001,
• German and English only, Macs with Apple Silicon only,
• no recording or transcription of meetings.

If one of these is what keeps you from using it, write to us. What is needed ends up as an issue on GitHub.

Frequently asked questions

Do dictations leave the Mac?

No. Recording and recognition run on the Mac. inlaut operates no server that audio or text could be sent to, and it stores neither recordings nor a history of dictations.

Do we need a data processing agreement?

For dictating, as we understand it, no: the developer of inlaut receives no dictations and does not process them on your behalf. This is not legal advice; the assessment is up to your data protection officer.

Which network connections does inlaut make?

Three: the one-time download of the speech model from Hugging Face, the daily request for the update feed on inlaut.de and, when you install an update, the download from GitHub. None of these requests contain dictations.

Can the update check be turned off?

Yes, in the app's settings. inlaut then only looks for updates when someone explicitly asks it to.

May we use inlaut in a company for free?

Yes. inlaut is licensed under GPL-3.0-or-later. The licence permits commercial use without fees and without an account. It excludes warranty, and there is no support contract.

Can we audit the code?

Yes. The entire source code is on GitHub, including the places where the app goes online. You can also build inlaut from source yourself.

Contact

We answer questions from IT, data protection or information security at hallo@inlaut.de. Please send security reports there as well.

More about inlaut