Choosing dictation when someone else has to sign it off

Last updated 11 September 2026

The two requirements, which are not the same

Both are legitimate. They are answered by different kinds of product and an evaluation that has not decided which it is asking for will waste everyone's time and probably end in a rejection late in the process.

Working out which one you have

1. Find the actual policy sentence Not what someone remembers it saying. The information security policy, the data protection policy, the professional regulator's guidance, or the client contract. The wording decides this.
2. Look for the word "processor" If the policy is built around assessing and contracting with processors, you are in the second world and the process expects a vendor to assess. If the policy forbids transfer of certain categories, you are in the first.
3. Ask who signs it off and what they need to see A security team usually accepts a demonstration. A procurement function usually needs a document. These are different people with different evidence standards.
4. Ask whether the client has a say In professional services the client's own policy often flows down through the engagement terms, and it may be stricter than yours.
5. Then evaluate products Not before. The architecture question is settled by the policy, not by a feature comparison.

What on-device recognition answers

When recognition runs on the endpoint, most of a standard security questionnaire stops applying — not because the answers are good but because the questions are about a transfer that does not occur.

• Subprocessors handling voice data: none.
• Data residency of transcripts: the endpoint.
• Retention by the vendor: none; the vendor never receives it.
• Vendor breach exposure: no dictation content.
• Cross-border transfer: none.
• Training on customer data: not possible; never received.
• Evidence: disconnect networking and dictate. Repeatable by the reviewer.

That last point is unusual and worth using. Most vendor assurances have to be taken on trust. This one can be tested by the person doing the review, in their own hands, in two minutes.

What it does not answer

• Central policy enforcement. If you need to guarantee every user's history retention, an app with per-machine settings cannot do that. Vaitly Voice has no MDM profile and no admin console.
• Audit logging. There is no central record of who dictated what. For some regulated environments that is disqualifying.
• Certification. Architecture is not an audit. If the gate is a certificate, it is a certificate.
• Endpoint security generally. On-device means on the device. Disk encryption, device management and physical security remain yours.
• Where the text ends up. Dictating into a cloud system puts the text in that system, governed separately.

The note to write

Whatever you choose, write down what you can demonstrate rather than what you believe. A short factual note survives a review far better than a vendor's marketing page, and it is what a regulator or a client would ask for.

The risk nobody puts in the questionnaire

You are speaking confidential information aloud. In an open-plan office, a shared room, a train or a café, the architecture is irrelevant — the sentence is in the room.

This is, in practice, the most likely confidentiality failure associated with dictation, and no product addresses it. The mitigations are physical: a door, a close headset microphone that lets you speak quietly, and judgement about which material is dictated where.