Privacy & Architecture Attestation

Document version 1.0 · Last updated: April 25, 2026

1. Summary

StarWhisper is Windows desktop dictation and transcription software. In its default configuration ("Local Mode"), all audio recording, speech-to-text inference, and transcript handling happen on the user's local Windows PC; no audio and no transcript text is transmitted to StarWhisper, to OpenAI, or to any other third party. Only a small set of account metadata (account email, display name, subscription status, license validation events, and aggregate usage counters that contain no audio or transcript content) is transmitted to StarWhisper's servers in connection with account management and license enforcement. An optional "Cloud Mode" exists which sends audio to OpenAI's Whisper API for transcription; Cloud Mode is opt-in, can be disabled at the device level, and is the only configuration in which audio leaves the endpoint.

2. Editions covered and architectural equivalence

This attestation covers the Windows desktop application distributed as:

• StarWhisper (Base edition) — bundled whisper.cpp CPU build
• StarWhisper CUDA11 — bundled whisper.cpp CUDA 11 GPU build
• StarWhisper CUDA12 — bundled whisper.cpp CUDA 12 GPU build
• StarWhisper Lite — smaller installer with on-demand model download

All four editions use the same data-handling architecture. The differences are limited to which Whisper inference binary ships in the installer and which model files are pre-bundled. Privacy and data-flow behavior is identical across editions.

3. Data flow — Local Mode (default and recommended for clinical use)

[ Microphone ]
      |
      v
[ Electron renderer process ] ----- audio buffer (in memory)
      |
      v
[ whisper.cpp subprocess (local) ] ----- model file (local disk)
      |
      v
[ Transcript text (in memory) ]
      |
      v
[ Renderer UI / paste target / local history file ]

Concrete properties of Local Mode:

1. Audio is captured by the operating system's microphone APIs and held in memory in the Electron renderer process.
2. Audio is passed to a whisper.cpp subprocess running entirely on the local Windows PC. No network call is made for transcription.
3. Whisper model files (e.g., ggml-base.bin, ggml-medium.bin, ggml-large-v3.bin) are stored on local disk in the user-data directory.
4. The transcript text is returned in memory to the renderer and may be (a) pasted to the active foreground application, (b) shown in the StarWhisper window, and (c) optionally written to a local history file inside the user-data directory.
5. No audio file, no transcript text, no model file, and no inference-time data is transmitted off the device.

4. Data flow — Cloud Mode (opt-in; disable for clinical use)

When Cloud Mode is enabled by the user, audio buffers are sent to OpenAI's Whisper API over TLS for transcription. OpenAI's API terms state that data submitted via the API is not used for training. Customers with HIPAA or other regulated workflows should disable Cloud Mode at the device level so audio cannot leave the endpoint, even accidentally. The setting is exposed in the application's Settings panel.

5. Account and license data

In Local Mode, the only network traffic StarWhisper originates is for account management and license validation. Specifically:

Data field	Source	Purpose	Retention
Account email	User-provided at signup	Login, license keying, support	Until account deletion
Display name	User-provided	UI display	Until account deletion
Subscription status / plan	Stripe webhook	License entitlement	Until account deletion
License validation events	App, on launch and periodically	Entitlement check	30-day rolling log
Aggregate usage counters	App, on transcription	Free-tier word-limit enforcement	30-day rolling counters; integer counts only

The aggregate usage counters do not contain audio data, transcript text, model identifiers, or any content of the user's transcriptions; they are integer counts (e.g., dailyWordCount: 312) used to enforce the free-tier weekly word limit.

Account authentication is provided by Firebase (Google Cloud). Payment processing is provided by Stripe. Both subprocessors handle only account metadata, not audio or transcript content.

6. Local data storage on the user's PC

The application stores files on the user's local Windows PC at %APPDATA%\StarWhisper\. Notable files include:

• settings.json — application preferences, including custom vocabulary list
• history.json — optional transcript history (user-controlled; can be cleared from the UI)
• audio_cache/ — optional cached audio files (user-controlled; can be cleared)
• Whisper model files — stored under models/ or in the install directory
• License validation cache — encrypted; used for offline license checks

All of the above remain on the local device. None of these files is transmitted to StarWhisper. Customers can delete the entire %APPDATA%\StarWhisper\ directory to reset the application; doing so removes all local transcripts and cached data.

7. Subprocessors and third-party services

StarWhisper uses the following third parties. None receive audio or transcript content in Local Mode.

Service	Purpose	Data shared	When active
Firebase (Google Cloud)	Account authentication	Email, password hash, account metadata	All modes
Stripe	Payment processing	Email, payment method (handled by Stripe), subscription status	At purchase / renewal
OpenAI Whisper API	Optional cloud transcription	Audio buffers (only when Cloud Mode is enabled by user)	Cloud Mode only
Google Analytics 4	Aggregate usage analytics on the marketing website only	Standard web analytics on starwhisper.ai; not in the desktop app	Website only

8. Compliance posture

StarWhisper's architecture is designed to support privacy-sensitive use cases including clinical documentation in HIPAA-regulated environments. The relevant statements are:

1. HIPAA. In Local Mode, no PHI is transmitted off the device by StarWhisper. The user's covered entity remains responsible for their own HIPAA compliance program. StarWhisper is not "HIPAA-certified"; no software certification under HIPAA exists.
2. Business Associate Agreements (BAAs). StarWhisper does not sign BAAs. The architectural reason is that StarWhisper does not receive PHI in Local Mode; the data flow keeps the customer outside the definition of disclosure to a business associate. If a customer's compliance program nonetheless requires a signed BAA from a transcription vendor, StarWhisper may not be the right fit.
3. GDPR. StarWhisper processes account metadata only; users can delete their account and all associated data via written request to [email protected]. Users in the EEA have rights of access, rectification, erasure, and data portability under the GDPR; these rights are described in the Privacy Policy.
4. FDA / medical device. StarWhisper is not a medical device. It is not FDA-cleared, FDA-approved, CE-marked as a medical device, or otherwise certified for clinical decision support, diagnosis, or any other regulated medical use. It is general-purpose dictation and transcription software.
5. AI-generated output (where applicable). Where the application provides any generative-AI feature (e.g., the local LLM summarization beta described in §10), that output is explicitly draft assistance only and must be reviewed by a qualified human before any clinical, legal, or other professional reliance.

9. Security architecture summary

• Transport: HTTPS / TLS 1.2 or higher for all server traffic.
• Authentication: Firebase Authentication; user-controlled passwords or third-party identity providers (Google).
• Local storage: App settings and local history are stored unencrypted in the user's profile directory. Customers requiring at-rest encryption should rely on Windows BitLocker or equivalent full-disk encryption on the endpoint.
• License validation: Periodic license check signed payload with offline grace period.
• Update mechanism: Updates are not auto-installed without user consent. The application checks for updates and surfaces a prompt; users may decline.
• Crash and error reporting: Aggregate, no audio or transcript content; user can opt out.

10. Local LLM summarization (beta, Department Pack only)

A locally-hosted summarization feature is being developed and offered as a beta to Department Pack customers. The feature uses llama.cpp to run an open-weight language model entirely on the user's Windows PC and generates draft summaries from transcripts. Properties:

• Runs locally; no transcript data is transmitted off the endpoint by the summarization feature.
• One-time additional model download (approximately 5 GB).
• Output is draft only; clinician review is required before any chart entry. The UI presents the summary alongside the verbatim transcript and never auto-inserts content into an EHR.
• StarWhisper does not represent the summarization output as medical-grade or FDA-cleared, and customers may not represent it as such.

11. Customer-side configuration recommendations for clinical deployment

1. Disable Cloud Mode at the device level so audio cannot leave the endpoint.
2. Set a custom vocabulary list to capture clinic-specific terminology.
3. Enable Windows BitLocker or equivalent full-disk encryption on the device.
4. Restrict the Windows account that runs the application to the clinician(s) who need it.
5. Disable transcript history if your retention policy prohibits local copies, or set a retention/clearing schedule.
6. If using the local LLM summarization beta, train clinicians that the summary is a draft and chart entry requires clinician review.

12. Limitations and disclaimers

This document describes the current architecture in good faith. It is not a legal opinion, a regulatory certification, or a warranty. The customer remains responsible for its own compliance review and for verifying that the architecture meets the customer's regulatory and contractual obligations. The application is provided "as is" subject to the StarWhisper Terms of Service, which include limitations of liability that the customer should review in connection with any clinical or other safety-critical use.

13. Contact

• Privacy or architecture questions: [email protected]
• Legal correspondence: [email protected]

This attestation is intended to be reviewed by the customer's compliance, privacy, or IT security team. It does not constitute a Business Associate Agreement, a Data Processing Agreement, or any other contract. Use of StarWhisper is subject to the StarWhisper Terms of Service and Privacy Policy. StarWhisper is operated by Regios GmbH, St. Martinstrasse 70, CH-6430 Schwyz, Switzerland.