“We never train on your dictation” is too broad unless the parties define whose systems, which data, and which enabled features. Local speech recognition may run entirely on a Mac, while optional hosted formatting sends transcript text to a provider. App analytics, support reports, destination apps, and backups are separate paths. A bank or law firm should request an agreement and evidence that cover the actual configuration, including any model provider selected by the user.
This is a procurement checklist, not a ready-to-sign contract or legal advice. A firm's counsel must decide the governing law, data roles, and wording. The UK Information Commissioner's Office explains that a processor contract should specify the nature, purpose, duration, data types, instructions, subprocessors, security, end-of-contract handling, and audit rights. Those are useful questions even when the buyer is outside the UK, but local requirements vary.
Define the data and forbidden uses
Ask the vendor to identify audio, raw speech transcript, cleaned text, formatted text, user-defined names or modes, support attachments, diagnostics, and telemetry separately. Define whether “training” includes model fine-tuning, evaluation sets, human review for model improvement, retrieval corpora, prompt logging for product improvement, or training by a subprocessor. A prohibition that only names “audio” leaves transcript text ambiguous; a prohibition that only names “foundation model training” may leave evaluation and retention unaddressed.
For each data category, ask: Is it processed on the device, by the app vendor, by a chosen provider, or by the destination? What is the permitted purpose? Who can change that choice? What data is stored, for how long, and where? Which party can obtain a copy for support or legal process? Require the answers to match the product's actual menus and the signed release.
Match the agreement to each route
| Route | Contract or policy question |
|---|---|
| Local speech model | Does any transcript or audio leave the device during recognition? Distinguish model download and license traffic from content traffic. |
| Local history and clipboard | What does the app retain on the Mac? What can device backups and third-party clipboard tools retain? |
| Optional hosted formatter | Name the provider and model route. Does it retain prompts, use them for training or evaluation, or allow human review? What terms bind that provider? |
| Custom endpoint | If the buyer enters a remote Ollama address, who governs that server and its logs? |
| Telemetry and support | Can event parameters or error strings include user-authored content? What is collected, retained, and shared? |
| Destination app | A CRM or document service may sync final text under its own contract. The dictation agreement cannot erase that independent route. |
SuprFlow 1.0.0 uses on-device recognition by default, has optional Cloud API formatting, permits a configurable Ollama endpoint, keeps local transcript history, and emits release telemetry. The current privacy policy distinguishes these paths. A buyer should not accept a universal no-training promise based solely on default local recognition.
Request operational proof
Ask for a current subprocessor list, provider terms for the exact mode offered, retention schedule including backups, breach notification path, security contacts, and a procedure for product or provider changes. If the vendor claims a training prohibition, request the clause that flows it to subprocessors and a way to verify compliance. The ICO's processor-contract guidance discusses documented instructions, subprocessor authorization, return or deletion at contract end, and audit information; those are stronger than a homepage statement alone.
The agreement should say what happens if a user selects a provider outside the firm's approved set. A personal API key or custom endpoint may put the processing under a different account and contract. An administrator control would be useful, but no firm-wide enforced local-only setting was confirmed in SuprFlow 1.0.0. In the meantime, a buyer must specify permitted configuration and test it on managed Macs.
Questions people ask
If speech recognition is local, do we still need a no-training clause?
That depends on the enabled features and data path. Optional hosted formatting and provider accounts can create a separate transcript-text route. The contract should cover those routes or explicitly prohibit their use for the approved workflow.
Is “zero retention” the same as “no training”?
No. One addresses how long a recipient keeps data; the other addresses permitted use. Ask about both, plus logs, abuse monitoring, backups, subprocessors, and support copies.
Can a vendor promise that Google Docs or our CRM will never train on the final note?
The dictation vendor cannot set another service's contractual terms. Review the destination separately under the organization's own account and agreement.
Related guides
- Does SuprFlow use my dictation to train AI?
- Where does my dictation go?
- What should a law firm ask an AI dictation vendor?
- What should a bank ask before approval?
- Does dictated text sync from the destination app?