No single SOC 2 report proves that every dictation mode keeps text local or excludes model training. SOC 2 is an examination of controls for a defined service organization's system and selected Trust Services Criteria. It can be useful evidence about security, availability, processing integrity, confidentiality, or privacy within its scope and period. A buyer still needs to trace audio, transcript text, optional AI providers, local history, clipboard insertion, telemetry, and destination apps for the actual signed release.
AICPA describes SOC 2 as reporting on a service organization's system and related controls. The report, rather than a website badge, tells you what was examined. SuprFlow 1.0.0 includes on-device speech recognition, optional hosted formatting, local history, and release telemetry; these are different pathways. This page does not state that SuprFlow currently holds a SOC 2 report. Ask the vendor for evidence rather than assuming certification.
Read the scope first
Before scanning for a favorable opinion, ask these questions about the full report:
- Which entity and system? Is the desktop app, license service, telemetry service, cloud formatter, or support workflow included? A report for a payment processor or unrelated SaaS does not automatically cover the Mac release.
- Which period and type? Does the report cover the build and providers your firm will use? A later product update may introduce a new path after the examination period.
- Which criteria? Security is one possible criterion; confidentiality and privacy need to be checked rather than inferred from a “SOC 2” label.
- Which subservice organizations? Are AI model providers, analytics, hosting, and support tools included or carved out? What separate evidence is needed for them?
- Which complementary user controls? Does the report assume the buyer enforces device access, provider selection, account management, or backup policy? Put each required control in an owner’s hands.
- Which exceptions and changes? Read test results, deviations, management responses, and any gap after the period end. Ask for a bridge letter when appropriate, but do not treat it as equivalent to a new examination.
AICPA material explains that SOC 2 reports address controls, and that user-entity and subservice-organization controls can affect the conclusion. A confidential dictation workflow spans more than one system; map each segment to its responsible party.
Use the report alongside a product test
Give the vendor a synthetic sentence with a name, number, and negation. In the approved configuration, record the downloaded signed version, microphone and Accessibility permissions, formatting mode, endpoint, network destinations, local history, clipboard behavior, telemetry parameters, and final document. Repeat after an update. The release-verification guide describes this test.
For a bank, the result can feed its vendor and model-risk review. For a law firm, it can answer confidentiality and subprocessor questions. If optional cloud formatting is prohibited, the crucial evidence is that the firm can actually prevent that mode on managed devices; a broad organizational report does not establish a particular product setting is enforced. No central lock for local-only formatting was confirmed in SuprFlow 1.0.0, so request current deployment documentation.
Questions people ask
Does “SOC 2 certified” mean no one can access or train on our transcripts?
The phrase is imprecise. Request the actual report, its scope, criteria, and tested controls, plus a specific contractual no-training provision for any provider that receives transcript text.
Can a SOC 2 report replace a privacy policy or data-flow map?
No. The buyer needs a clear account of which data moves through each feature and where it is stored. The report can support control claims for the examined system, but it does not describe every workflow by itself.
What if the app only processes speech on device?
That reduces one processing route, but setup, license, telemetry, optional formatting, clipboard, backups, and destination apps still need review. Test the signed build and approved configuration.
Related guides
- Verify privacy claims in a signed Mac release
- No-AI-training agreement questions
- Bank dictation vendor checklist
- Law-firm dictation vendor questions
- Where does my dictation go?