Tacit

Security & privacy

Calm software, quiet defaults.

This page is maintained by Tacit Labs to answer common security and privacy questions. It describes controls we have enabled today and how our product is built. It is not an independent certification.

Bot-free capture

Tacit runs on your Mac. No participant is added to your call.

No audio stored

Audio is transcribed in real time and discarded when the meeting ends.

SOC 2 Type II

Independently audited controls. Report available under NDA.

Architecture

How bot-free actually works.

Most meeting tools dial a bot into your call. Tacit doesn't. It runs on your Mac and listens the way you do — through system audio and your microphone, only when you tell it to.

Because Tacit is a local app, nothing about the meeting leaves your device until transcription happens. No credentials, no calendar bots, no third-party guests.

  1. 01

    Capture on device

    Tacit records system audio and mic input locally on your Mac, only while a meeting is active.

  2. 02

    Transcribe in memory

    Audio is streamed to our transcription subprocessor over TLS. Nothing is written to disk on our servers.

  3. 03

    Summarize the text

    Only the transcript — not the audio — is passed to our AI subprocessor to produce the summary and action items.

  4. 04

    Discard the audio

    The moment the meeting ends, the audio buffer is dropped. Only the text lives in your workspace.

Your data

We don't store your audio.

Audio is used for one thing: to produce a transcript. It is streamed, not stored. As soon as your meeting ends, the audio is gone. What remains is the transcript, the summary, and the action items — inside your workspace, under your control.

Data at rest
Encrypted with AES-256
Data in transit
TLS 1.2+ end-to-end
Audio retention
None — discarded post-meeting
Transcript retention
Controlled by workspace policy
Hosting region
US or EU, selected at signup
Deletion
Workspace and per-meeting, any time

AI & training

Your meetings never train our models.

Tacit does not use your transcripts, summaries or action items to train any AI model. Our AI subprocessors run on zero-retention endpoints. Enterprise workspaces are opted out of any product analytics by default; Team workspaces can opt out from a single toggle.

Workspace default

Train on our dataOff
Product analyticsOff (Enterprise)

Compliance

SOC 2 Type II

Independently audited controls for access, encryption, and change management.

Report available under NDA

GDPR

EU hosting region, DPA on request, honoured deletion requests within 30 days.

DPA available

HIPAA

Available on Enterprise plans with a signed BAA.

On request

Subprocessors

Who Tacit talks to on your behalf.

We keep this list short and current. Notification of changes is sent to workspace admins at least 30 days before a new subprocessor is added.

  • Amazon Web Services

    Cloud hosting (us-east-1, eu-west-1)

    Placeholder

  • OpenAI

    AI summarization (zero-retention endpoint)

    Placeholder

  • Anthropic

    AI summarization (zero-retention endpoint)

    Placeholder

  • Deepgram

    Real-time transcription

    Placeholder

  • Stripe

    Billing and payments

    Placeholder

  • Postmark

    Transactional email

    Placeholder

Built to be trusted. Try it free.

Reach our security team at security@tacit.app for reports, questionnaires or the SOC 2 report.