Dictation your security team can actually sign off

Last updated 11 October 2026

The question a review actually asks

Security reviews of dictation software converge on one thing: where does the audio go, and who else can hear it? Everything else — encryption, retention, subprocessors, breach notification — exists because the answer is normally "to the vendor".

When recognition runs on the endpoint, most of that questionnaire stops applying. Not because we have good answers, but because the questions are about a transfer that does not happen.

What we do not have

Listing this properly is more useful than a sales conversation that discovers it in week three.

• No certifications. Not ISO 27001, not SOC 2, not HIPAA-attested. We are a small UK company and we claim none of them. If a certification is a hard gate, we will not pass it.
• No SSO or SCIM. Licences are per user, managed by the individual or by whoever bought them.
• No MDM policy. No configuration profile on the Mac and no Group Policy or Intune template on Windows. Settings are per machine. You cannot centrally enforce, for example, a maximum history retention.
• No admin console. No central view of who is using what.
• No audit log. Dictation history is local to each machine and visible to that user.
• Two platforms, with limits on each. Mac: Apple Silicon (M1 or later), macOS 14 Sonoma or later; Intel Macs are not supported. Windows: 64-bit x64 PC, Windows 10 22H2 or later; Windows on ARM is not supported. One licence covers both.
• No phone app. There is no iPhone, iPad or Android version.
• Updates are manual. A new version is downloaded from our website and installed by the user or by you; settings, vocabulary and history are kept. There is no silent or centrally pushed update.
• Elevated windows on Windows. Windows does not let an ordinary program type into a window running as administrator, such as an elevated command prompt. Dictation does nothing there.

What deployment looks like

1. One machine first Install, complete first run, verify the architecture by disconnecting the network and dictating. Record the date.
2. Check your permission policy On a Mac, dictation needs Accessibility permission to type into other applications. Managed Macs often restrict this, and it must be allowed or nothing works; it is the most common blocker. On Windows only microphone access is needed, and the installer runs per user with no administrator prompt — check that your application control policy allows it.
3. Decide the retention position Users can set history retention themselves. Decide what you want it to be and tell them, because you cannot enforce it centrally.
4. Confirm disk encryption is enforced The local history sits on the disk. FileVault on a Mac and BitLocker on Windows are what protect it, and you probably already require them.
5. Decide on cloud features An optional rewrite step can be pointed at a cloud provider, and VV Pro adds Cloud Polish, which sends the text of a dictation (never the audio) to our server for AI editing. Meeting summaries also send a transcript's text. If any of these is not acceptable, say so in the rollout note — speech recognition is always local, and the cloud steps are features people choose to use.
6. Pilot with five people for a fortnight Then decide. Dictation adoption is highly individual; some people take to it immediately and some never do.

Who this suits

• Professional services firms. Law, accountancy, consultancy — client-confidential material and a partner who has to sign it off.
• Healthcare administration. With the caveat that we hold no HIPAA attestation; the architecture helps, the paperwork does not exist.
• Security and engineering teams. Where the content of a note is the thing being protected.
• Organisations with air-gapped or restricted machines. On-device recognition works where nothing else does.
• Small teams without a procurement department. Where architecture is the assurance and a certification would be theatre.

Who it does not suit: organisations needing central policy control, a certification, SSO, phones, or Windows on ARM machines. See dictation for confidential work for the decision framework.

Licensing

A paid plan covers 5 active devices per licence, in any mix of Mac and Windows, which handles the laptop-and-desktop case. For a team, buy volume rather than individual seats — talk to us rather than putting twenty purchases through expenses.

Pro is £9.99 a month or £99 a year per person; organisations that prefer an invoice to card payments should ask about Enterprise. Prices are in pounds sterling; VAT is added at checkout where it applies. Every purchase is refundable in full within 14 days.

VV Pro, at £9.99 a month or £99 a year, adds Cloud Polish and Vaitly Meetings (beta), which records calls in the background with no meeting bot joining and no Teams or Zoom admin permission needed. It is a different answer for a review: its AI features need an account and a connection, and the text of a dictation or a meeting transcript goes to our server, which uses OpenAI. Audio never leaves the machine. If the questionnaire above has to be answered "local only", roll out dictation with Cloud Polish and meeting summaries switched off.