Is Paraspeech Safe? What "Local-First" Leaves Out

Paraspeech is safe for sensitive work in exactly one configuration: an Apple Silicon Mac, running a local on-device model, with Cloud Cleanup switched off. In that setup your audio never leaves your machine, and the app works with the network disconnected. That is a real, verifiable privacy guarantee, and Paraspeech deserves credit for shipping it.

Outside that configuration, the picture changes. On an Intel Mac there is no local option at all. If you need the 100+ language Multilingual Large model, you are on the cloud path. And if you use Cloud Cleanup — Paraspeech's AI rewrite feature — your transcribed text goes to a third party by design.

Paraspeech names those third parties in its own privacy policy, which is more than most competitors do: Deepgram receives audio for cloud transcription; Groq and Cerebras handle the rewrite step. This investigation walks the whole data path so you can tell which side of the line you are on.

Every claim below is sourced to Paraspeech's own published materials — its pricing page, documentation, privacy policy and App Store listing — checked on 30 July 2026.

Paraspeech ships four speech models, and the split between them is the whole safety story:

• English-only local — runs on your Mac, Apple Silicon required
• 25-language local — runs on your Mac, Apple Silicon required
• Japanese and Mandarin Chinese — dedicated models, on-device
• Multilingual Large — 100+ languages, tied to the cloud-backed path

Paraspeech's documentation states that supported local speech-recognition modes "can run on your Mac after model setup." Once a model is downloaded, dictation in that mode does not require an internet connection. If you disconnect the network and it keeps typing, that is the proof — and it is a test you can run yourself in the 7-day trial.

The Intel exclusion is absolute and easy to miss. Paraspeech's system requirements call for macOS 14.0 or later, with Apple Silicon for supported local models, "or Intel with cloud-backed models." There is no degraded local mode for Intel Macs. If you are on a 2019 or 2020 Intel MacBook Pro, every word you dictate through Paraspeech goes to a server, regardless of which plan you bought. The same is true by omission on Windows, where Paraspeech does not ship at all; our Windows dictation apps roundup covers what does.

Most dictation apps describe their cloud vendors as "trusted third-party service providers" and leave it there. Paraspeech names them. That is the single most creditable thing in its privacy documentation, and it lets you assess the risk instead of guessing at it.

Deepgram handles cloud transcription. The policy language is unambiguous: "When a user selects or is eligible for cloud transcription, Paraspeech may transmit selected audio and related request metadata to Deepgram for cloud transcription." Note the phrase "or is eligible for" — that covers the Intel case, where the cloud path is not a choice you actively make but a consequence of your hardware.

Groq and Cerebras handle the Cloud Cleanup rewrite. These receive your transcribed text rather than your raw audio. Both are AI inference providers known for high-speed model serving, which is consistent with Paraspeech's speed-first positioning.

Beyond the speech path, the policy lists a conventional stack: PostHog, Ahrefs, Cloudflare and Simple Analytics for analytics and delivery; Supabase for hosting and authentication; Hetzner and BunnyWay for infrastructure; Loops and Resend for email. Data is processed across the United States, Germany, Singapore, Canada, Poland, Slovenia, the Netherlands and the wider EU.

Retention is described in general terms — personal data is "processed and stored for as long as required by the purpose they have been collected for," with journey events deleted after 90 days and account data held while the account exists. There is no specific stated retention period for audio or transcripts, which is a gap worth noting.

Paraspeech's founder answers support tickets publicly, and that habit produced a documented record of the product's direction. Among the replies logged on the company's feedback board in April 2026 was a statement that a cloud LLM was coming for users who needed maximum performance and speed.

That feature now exists. Cloud Cleanup is the rewrite pass, and Paraspeech's own documentation describes it plainly: it "uses cloud processing and requires internet access," and is "available only when cloud processing is allowed."

I want to be careful about what this does and does not mean. It is not a betrayal — the feature is opt-in, gated behind a cloud-processing permission, documented, and its providers are named. That is close to the best-case version of adding a cloud feature to a local-first app.

What it does mean is that "local-first" is now a description of the default, not a description of the product. The homepage headline and the feature set have drifted apart, and a buyer who reads only the marketing will not know which mode they end up in. The same public support record contains the founder's explanation of why the fast local model cannot support a proper custom-vocabulary dictionary — single-model architectures force trade-offs, and the cloud is where vendors go to escape them.

This is the pattern to watch across the whole category, not just here: cloud versus local dictation is rarely a permanent architectural commitment. It is a position that moves under commercial pressure.

Paraspeech's companion iOS app, Paraspeech Voice Keyboard, carries an Apple privacy label — the vendor-declared disclosure Apple requires on every App Store listing. It is worth reading, with one important scoping caveat first.

This label covers the iOS app only. The Mac app ships directly from paraspeech.com rather than through the Mac App Store, so it has no Apple label at all. Nothing below should be read as a statement about the Mac app's behaviour.

Under "Data Linked to You," the iOS listing declares: Contact Info (email address, name); Identifiers (user ID, device ID); Usage Data (product interaction and other usage data); Purchases (purchase history); Diagnostics (crash data, performance data, other diagnostic data); and User Content — including Audio Data, customer support content and other user content. The declared purpose for the audio category is App Functionality.

"Linked to you" is Apple's term for data associated with your identity rather than collected anonymously. For an app whose category promise is that your voice stays yours, having Audio Data in the linked column is the disclosure a privacy-conscious buyer should weigh — even though the App Functionality purpose is exactly what you would expect for cloud transcription, and even though it says nothing about the local Mac path.

The honest reading: the iOS keyboard is a cloud-leaning product and its label reflects that. The Mac app in local mode is a different animal. Do not let either fact stand in for the other.

One genuine structural advantage separates Paraspeech from nearly every competitor we cover: it is operated by an EU company. Burlis Management GmbH is registered at Philippstraße 27, 52349 Düren, Germany.

That matters in practical, unglamorous ways. The GDPR is the company's domestic law rather than a foreign regime it must accommodate for European customers. The privacy policy sets out lawful bases for processing, the right to withdraw consent, and the right to lodge a complaint with a supervisory authority — the standard EU apparatus, present because it has to be.

For a European buyer with a data protection officer to satisfy, an EU-domiciled controller is a materially shorter conversation than a US startup with a generic policy and a Standard Contractual Clauses appendix. If your organisation has ever been slowed down by a transfer-impact assessment, this is worth real money.

Two caveats keep it honest. First, EU domicile is not certification — we found no published SOC 2 Type II or ISO 27001 audit for Paraspeech, which competitors like Wispr Flow do publish at their enterprise tier. Second, the cloud path still routes through providers whose processing spans the United States among other jurisdictions, so "German company" does not mean "data stays in Germany."

Work through it in order:

1. Is your Mac Apple Silicon? If no, stop — you are on the cloud path permanently and the privacy proposition does not apply to you.
2. Is your language covered by a local model? English, the 25-language set, Japanese and Mandarin are on-device. Anything that needs Multilingual Large is cloud.
3. Is Cloud Cleanup switched off? If it is on, your transcribed text reaches Groq or Cerebras even when transcription itself ran locally.

Three yeses means Paraspeech is a genuinely local tool and reasonable for confidential work — drafting under NDA, private notes, unpublished writing. Any no means you are sending data to a third party, which may be perfectly acceptable, but should be a decision rather than a surprise.

One line overrides the entire tree: Paraspeech offers no HIPAA coverage and no business associate agreement at any tier, and publishes no SOC 2 or ISO 27001 certification. It is not a lawful choice for protected health information under any configuration. Clinicians should start from HIPAA-compliant dictation instead.

Paraspeech lands in a respectable middle. It is meaningfully more private than a cloud-first product like Wispr Flow, and more transparent than most about who its processors are. It is less verifiable than VoiceInk, whose GPL v3 source can be read line by line, and less certified than the enterprise tiers that publish SOC 2 audits.

Run these during the 7-day trial, before you pay for anything.

1. Confirm your chip. Apple menu → About This Mac. If it says Intel, the local models are unavailable to you and the rest of this audit is moot.
2. Download a local model, then pull the plug. Turn off Wi-Fi entirely and dictate a paragraph. If text appears, you are genuinely on-device. If it fails or stalls, you were on the cloud path without realising it.
3. Find the cloud-processing toggle and read its state. Cloud Cleanup is gated behind a cloud-processing permission. Know whether yours is on. If you want a purely local setup, it must be off.
4. Check your language against the local model list. English, the 25-language set, Japanese and Mandarin are on-device. If your language only appears under Multilingual Large, you are on the cloud path whenever you use it.
5. Decide about the iPhone app separately. Its Apple privacy label lists Audio Data under "Data Linked to You." If your threat model is strict, run Paraspeech on the Mac only and skip the keyboard.

Step two is the one that matters most, and it is the test we recommend for any app making an on-device claim. Marketing copy is not evidence; a working app with the network off is.

Paraspeech and Voibe — ours — are making broadly the same architectural bet: dictation should run on your machine. The differences are in where each draws the cloud line.

Paraspeech's cloud path adds capability — Multilingual Large for 100+ languages, and the Cloud Cleanup rewrite, both processed by named third parties. Voibe keeps transcription on-device on Apple Silicon and ships Smart Formatting as a bounded local cleanup pass: it strips filler, fixes punctuation and capitalisation, and converts numbers, dates and URLs. It does not paraphrase, does not change meaning and does not generate content, which removes the class of failures that come from letting a language model rewrite what you said.

The other practical difference is vocabulary. Paraspeech offers Word Replacements, a post-transcription substitution table; Voibe ships a custom-vocabulary dictionary that influences recognition itself. If you dictate technical terms or proper nouns daily, that gap is the one you will feel.

Where Paraspeech has the clearer advantage: it is an EU company, which matters for European compliance, and it offers dedicated Japanese and Mandarin models. Neither product offers HIPAA coverage.

The head-to-head with the cloud-first incumbent is in Paraspeech vs Wispr Flow, and the wider field is ranked in Paraspeech alternatives.

• Paraspeech Review — the full product assessment, scored
• Paraspeech Pricing — two storefronts, and the tier that isn't priced
• Paraspeech vs Wispr Flow — local-by-default against cloud-by-design
• Why Offline Dictation Matters — the architectural case
• Voice Data Privacy — what happens to recordings across the category
• The Privacy Hub — every safety investigation we've published