A tax firm thrives on trust. Clients entrust the firm with their financial information, balance sheets, contracts, and sometimes very personal emergencies, confident that this information will not leave the firm without proper oversight. Dictation saves a lot of time in this regard: file notes, client letters, or call logs are often completed faster when dictated than when typed.
The question of where the dictation is sent becomes a sensitive issue. Many popular dictation and transcription apps send the spoken audio to servers in the U.S. for text recognition. As soon as client names, tax ID numbers, or trade secrets appear in the data, this not only raises GDPR concerns but also violates the tax advisor’s professional duty of confidentiality. This article provides an overview of the legal situation—without replacing legal advice—and shows how local speech recognition reduces the risk at its source.
The Tax Advisor's Duty of Confidentiality: Two Legal Sources
For tax advisors, confidentiality is not merely a matter of professional conduct; it is enshrined in two separate legal provisions.
§ 57 StBerG: The Professional Obligation
Section 57(1) of the Tax Advisory Act (StBerG) requires tax advisors to exercise their profession with confidentiality, among other things. This duty of confidentiality extends to everything that has come to the advisor’s knowledge in the course of their professional practice. It also applies to the advisor’s own employees to the extent necessary, and the firm must, in turn, require its employees to maintain confidentiality (Section 62 StBerG). A violation constitutes a breach of professional ethics.
§ 203 StGB: The Criminal Law Threshold
Section 203 of the German Criminal Code (StGB) makes the disclosure of private secrets a criminal offense. Tax advisors and tax agents are expressly listed there as persons bound by professional secrecy. Anyone who discloses another person’s secret that was entrusted to them in this professional capacity may be liable to criminal prosecution. This is therefore not merely a matter of a potential fine under the GDPR, but of a criminal offense.
Important and often overlooked: Since the revision of Section 203 of the German Criminal Code (StGB) in 2017, the use of external service providers—for example, for IT or software—is not generally prohibited. It is permitted under certain conditions. The person involved may only be informed of what is necessary for their work, and they must be bound by a confidentiality obligation. Anyone who fails to fulfill this obligation or discloses more than necessary is committing a criminal offense. This is precisely where unchecked cloud dictates become problematic.
Why Cloud Dictation Can Pose a Compliance Risk
Broad generalizations are misleading in this context. Cloud dictation is not always prohibited, nor is it automatically a criminal offense. Whether it is permissible depends on the specific circumstances: which provider is involved, whether a robust data processing agreement (DPA) is in place, whether the data is transferred to a third country such as the United States, and whether the service provider has been effectively bound by a confidentiality obligation.
In practice, risks usually arise in the following ways:
- Transfers to third countries. If text recognition is performed on U.S. servers, the GDPR requirements for transfers to third countries (Chapter V, Art. 44 et seq.) apply, with their own legal basis and documentation.
- Contributors without an obligation. A cloud-based dictation service is a contributor within the meaning of § 203 of the German Criminal Code (StGB). Without an express confidentiality obligation, there is no basis for disclosure.
- Too much information is revealed. Dictations often contain more plain text than the service provider would need for text recognition alone, which violates the necessity standard.
In short: Depending on how it’s set up, cloud dictation can pose a compliance risk. The safer approach is to prevent the problem from arising in the first place.
How Local Processing Mitigates the Problem
If speech recognition runs entirely on the Mac, the dictation data never leaves the device. In that case:
- No transfer to a third country, because no transfer takes place,
- no external processor who, under § 203 of the German Criminal Code (StGB), would be required to be designated as a participating party,
- No cloud policy of the law firm is being violated.
This fundamentally changes the assessment. Instead of justifying a transfer to a third country, you are documenting purely local processing. This supports compliance with confidentiality obligations and provides the technical basis for using a dictation tool in a GDPR-compliant manner. Ensuring that the tool is integrated into the law firm’s processes in a legally compliant manner remains the law firm’s responsibility.
A Comparison of Cloud Dictation and Local Dictation
| aspect | Cloud Dictation (U.S. Server) | Local Dictation (Flinktext) |
|---|---|---|
| Where is it processed? | on external servers, often in a third country | on-device on the Mac |
| Client audio leaves the device | yes | No (by default) |
| Transfers to Third Countries (GDPR Chapter V) | most relevant | N/A |
| § 203—Obligation of the Provider Required | yes | Not applicable; no third party involved |
| AVV required | yes | Not for local processing |
| Can be used offline | no | yes |
| Account / Registration | usually yes | no |
| Verifiable code | no (proprietary) | Yes, open source (MIT) |
| expenses | usually a subscription | free |
Note on Fairness: Specialized legal solutions such as Dragon Legal are mature, trained in legal terminology, and well-established in many law firms. However, they come at a cost (often in the range of several hundred euros per workstation) and, depending on the edition, are either cloud-based or server-based. Flinktext isn’t competing as the top performer in terms of features; rather, it occupies a different niche: it’s locally installed by default, free, open-source, and therefore particularly easy to justify from a data protection perspective.
Flinktext: Local Dictation Software for Law Firms
Flinktext is a native macOS app from Lighthouse Consultings that relies entirely on local processing. Its interface is intentionally simple: hold down the hotkey, speak, and release. The recognized text appears immediately at the cursor, in any application—whether in law firm software, Outlook, Word, or a document management system.
The Verifiable Data Protection Features
These points can be verified in the open-source code:
- 100% local by default. Speech recognition uses a bundled Whisper model that runs on the device. Your audio never leaves the device.
- No telemetry, no tracking, no account. There are no analytics or crash reporters sending data in the background.
- Keys are stored only in the Keychain. Login credentials are stored exclusively on the device in the macOS Keychain, without iCloud sync.
- Open source under the MIT license. The code is publicly available on GitHub and can be reviewed by your IT department or your data protection officer.
- Hardening against prompt injection is built in to prevent tampered inputs.
Optional cloud backends (for particularly complex queries, for example) are available but are disabled by default. They become active only when a user explicitly enables them and provides their own API key. By default, everything remains local, and that is precisely the key point when it comes to client data.
Four Modes for Everyday Law Firm Life
- Roh provides the verbatim transcript, suitable for a literal file note.
- Poliert smooths out filler words and corrects grammar to produce polished written German, such as for client correspondence.
- Compose accepts a spoken command and generates the text.
- Emoji adds relevant emojis, which are rarely used in a law firm context.
For the law firm, what matters most are "Rough" and "Polished": either the exact wording or a clearly legible draft.
Ready-made app, not a DIY project
Flinktext is the finished version of what the open-source project Blitztext (by cmagnussen, MIT license) created as a kit. With Blitztext, users had to compile the app themselves from the source code. With Flinktext, you simply download a ready-to-use DMG file, drag the app into the Applications folder, and get started. No compiler, no Terminal, no build.
You can find the download and the latest version on the Flinktext product page.
Can be used in compliance with the GDPR; not certified
It’s important to be honest about this: No software is, by itself, GDPR-certified or guaranteed to be compliant with Section 203. Flinktext is a tool that enables local, data-efficient processing and thus supports the maintenance of professional confidentiality. Compliance always arises from actual use—that is, from the combination of the tool, the process, and the documentation. We provide a data processing agreement and data protection documentation for the law firm rollout upon request. Please coordinate the legally compliant implementation with your data protection officer and, if applicable, your chamber of tax consultants.
If you'd like to implement Flinktext in your law firm, Lighthouse Consultings will guide you through the process, from the pilot installation to data protection-compliant operation. 🧭
Frequently Asked Questions
Can tax advisors use cloud software to dictate? There is no one-size-fits-all answer to this question. It depends on the specific arrangements: the provider, the data processing agreement, data transfers to third countries, and the service provider’s duty of confidentiality under Section 203 of the German Criminal Code (StGB) must all be clearly defined. Local processing avoids these issues because no data is transferred.
Does my dictation leave the device when using Flinktext? Not in standard mode. Speech recognition runs on-device using a bundled Whisper model. Optional cloud backends are disabled by default and only become active if you enable them yourself and provide your own key.
Do I need a Data Processing Agreement (DPA) for Flinktext? For purely local processing, a Data Processing Agreement is not required because no external service provider processes your data. For institutional rollouts and data protection documentation, we provide a DPA upon request.
Is Flinktext compliant with Section 203 or legally sound? Flinktext is a tool, not a legal guarantee. Local processing helps ensure confidentiality because, by default, no audio leaves the device, and thus no disclosure to third parties occurs. You should consult with your data protection officer to determine whether your specific use complies with Section 203 of the German Criminal Code (StGB) and the GDPR. Software alone does not make a law firm compliant.
Does the dictation feature work without an internet connection? Yes. Since processing takes place locally, dictation works entirely offline.
How much does Flinktext cost, and do I need to know how to program? The app is free and open source under the MIT license. Unlike the Blitztext template, you don't need to compile any source code. Just download the ready-to-use DMG file and launch the app.
Is Flinktext also suitable for attorneys and certified public accountants? Yes. Attorneys, certified public accountants, doctors, and other professional groups are also subject to Section 203 of the German Criminal Code (StGB). The local approach addresses the same fundamental problem: confidential content should not be transmitted to external services without proper control.
Next step
If you want to use voice dictation at your law firm without sending client data to the U.S. cloud, the local version is the safer option. Download Flinktext for free from the product page and contact us to discuss a rollout for your law firm.
Related Post: GDPR-compliant dictation software for the Mac: local storage instead of the U.S. cloud
Flinktext: The Dictation App for Mac
Free, open source, 100% local by default. Download, open, dictate.
Related Guides
- Blitztext Alternative: Flinktext, the all-in-one dictation app for Mac
- Wispr Flow Alternative: Dictate Locally, Without the Cloud and Without a Subscription
- GDPR-compliant dictation software for Mac: local storage instead of a U.S. cloud
- Dictation Software for Schools: Inclusion Without a U.S. Cloud
- Free & Local Dictation Software for Mac: An Honest Comparison
- Dictation Software for Law Firms: Local Dictation Subject to Confidentiality Obligations (Section 203 of the German Criminal Code (StGB))
- On-Premises Medical Speech Recognition: Dictation Software for Medical Practices Without a U.S. Cloud
- Dictation Software and Confidentiality: Dictating Locally as a Bearer of Professional Secrets
