GDPR-compliant dictation software for Mac: local storage instead of a U.S. cloud

Dictation saves time. But for schools, government agencies, law firms, and medical practices, it can quickly become a sensitive issue: The most popular dictation tools send recorded speech to servers in the U.S. As soon as student, citizen, client, or patient data is processed there, it’s no longer just a matter of convenience—it becomes a question of the GDPR and professional confidentiality.

This article explains why U.S.-based cloud dictation poses a risk for regulated organizations, how local speech recognition solves the problem at its root, and what you should look for in GDPR-compliant dictation software for the Mac.

Why U.S. Cloud Mandates Are Risky for Regulated Entities

Many popular dictation and transcription solutions follow the same pattern: Your microphone records the audio, which is then transmitted to a cloud service, converted to text there, and sent back to you. It’s convenient, but the crucial step takes place on third-party servers, often outside the EU.

GDPR and Transfers to Third Countries

Voice recordings constitute personal data as soon as a person is identifiable or is being discussed. If this audio data is transferred to a service provider in a third country, such as the United States, the GDPR’s requirements for transfers to third countries apply (Chapter V, Article 44 et seq.). You need a valid legal basis, a data processing agreement (DPA), and must document the data transfer in your record of processing activities. For public authorities, this is often precisely the point at which the procurement process comes to a halt.

§ 203 StGB: Professional Confidentiality

For doctors, lawyers, tax advisors, and similar professions, Section 203 of the German Criminal Code (StGB) also applies. Anyone who discloses another person’s confidential information that was entrusted to them in their professional capacity is liable to criminal prosecution. The use of external service providers is permitted only under strict conditions, and the uncontrolled uploading of dictations containing client or patient information to a U.S. cloud service rarely falls within this framework. This is not merely a matter of a fine, but of criminal liability.

Guidelines and Reality in Practice

In many government agencies and school districts, the U.S. cloud is simply blocked by internal policy. Teachers who want to provide students with writing, motor skills, or dyslexia-related challenges with a dictation tool then hit a wall: The tool exists, but it cannot be used because the data would leave the organization.

How Local Processing Solves the Problem

The straightforward answer is technically simple: If speech recognition runs entirely on the device, the audio never leaves the Mac. There is no transfer to a third country because there is no transfer at all. There is no external processor that would need to be included under Section 203 of the German Criminal Code (StGB). And there is no cloud policy being violated.

In concrete terms, local speech recognition means:

• The language model is stored directly on the Mac and performs computations on-device.
• There is no account, no login, and no server round trip.
• The dictation feature continues to work even without an internet connection.
• You retain full control over where data is created and stored.

This fundamentally changes the GDPR assessment. Instead of having to justify a high-risk transfer to a third country, you document that processing is conducted entirely locally. This is the basis for ensuring that a tool can be used in compliance with the GDPR.

Flinktext: Local dictation software for the Mac

Flinktext is a native macOS menu bar app from Lighthouse Consultings that is designed specifically around this local approach. The interface is intentionally simple: hold down the hotkey, speak, and release. The recognized text appears immediately at the cursor, in any app—whether it’s Mail, a browser, Word, or a specialized application.

Four modes cover everyday needs:

• Roh provides the verbatim transcript without any editing.
• Poliert refines filler words and grammar to produce clean, standard German.
• Compose accepts a spoken command and generates the text.
• Emoji adds relevant emojis if desired.

The Verifiable Data Protection Features

These points can be verified in the open-source code:

• 100% local by default. Speech recognition uses a bundled Whisper model that runs on the device. Your audio never leaves the device.
• No telemetry, no tracking, no account. There are no analytics or crash reporters sending data in the background.
• Keys are stored only in the Keychain. Login credentials are stored exclusively on the device in the macOS Keychain, without iCloud sync.
• Open source under the MIT license. The code is publicly available on GitHub and can be reviewed by your IT department or your data protection officer.
• Hardening against prompt injection is built in to prevent tampered inputs.

Optional cloud backends (for particularly complex formulations, for example) are available but are disabled by default. They become active only if a user explicitly enables them and provides their own API key. By default, everything remains local.

Ready-made app, not a DIY project

Flinktext is the finished version of what the open-source project Blitztext (by cmagnussen, MIT license) created as a kit. With Blitztext, users had to compile the app themselves from the source code. With Flinktext, you simply download a ready-to-use DMG file, drag the app into the Applications folder, and get started. No compiler, no Terminal, no build.

You can find the download and the latest version on the Flinktext product page.

Can be used in compliance with the GDPR; not certified

It’s important to be honest about this: No software is “GDPR-certified” on its own. GDPR compliance always results from actual use—that is, from the combination of the tool, the process, and the documentation. Flinktext provides the technical foundation that enables local, data-minimal processing. We provide a data processing agreement and data protection documentation for institutional rollouts upon request.

If you would like to roll out Flinktext in a school, government agency, or institution, Lighthouse Consulting will guide you through the process, from the pilot installation to data-protection-compliant operation.

Frequently Asked Questions

Is Flinktext GDPR-compliant? By default, Flinktext processes language entirely locally on the Mac, without telemetry and without an account. This means the app can be used in compliance with the GDPR. Final compliance always depends on the specific use case and the documentation within your organization. We can provide a Data Processing Agreement (DPA) upon request.

Are my voice recordings uploaded to the cloud? No, not in standard operation. Speech recognition runs on-device using a bundled Whisper model. Optional cloud backends are disabled by default and are only activated if you enable them yourself and provide your own key.

Does the dictation feature work without an internet connection? Yes. Since processing takes place locally, dictation works entirely offline.

How much does Flinktext cost? The app is free and open source under the MIT license. You can download the ready-to-use DMG file; no need to compile it yourself.

Is Flinktext suitable for lawyers or doctors (Section 203 of the German Criminal Code)? Local processing addresses precisely the issue that professionals bound by professional secrecy are not permitted to disclose confidential information to external service providers. Since, by default, no audio leaves the device, this transmission does not occur. For mandatory use in your law firm or medical practice, please review the setup with your data protection officer.

Which Macs is the app designed for? Flinktext is a native macOS app and runs as a small application in the menu bar.

Next step

If you want to use dictation in the classroom, in administrative settings, or in a regulated practice without sending data to the U.S. cloud, the local version is the safer option. Download Flinktext for free from the product page and contact us to discuss an institutional rollout.

Related Guides

• Blitztext Alternative: Flinktext, the all-in-one dictation app for Mac
• Wispr Flow Alternative: Dictate Locally, Without the Cloud and Without a Subscription
• Dictation Software for Schools: Inclusion Without a U.S. Cloud
• Free & Local Dictation Software for Mac: An Honest Comparison
• Dictation Software for Law Firms: Local Dictation Subject to Confidentiality Obligations (Section 203 of the German Criminal Code (StGB))
• On-Premises Medical Speech Recognition: Dictation Software for Medical Practices Without a U.S. Cloud
• Dictation Software for Tax Advisors: Client Data Subject to Confidentiality
• Dictation Software and Confidentiality: Dictating Locally as a Bearer of Professional Secrets