What leaves the phone, and who keeps what

No server we operate can read your audio or dictated text, in either edition. This is everything we hold:

1. The mic runs only while the keyboard panel is open and you're dictating, never in password or other sensitive fields.
2. Speech recognition and cleanup run on the phone, with its stored vocabulary. Audio stays in memory and is never saved.
3. The text goes into your app through Android's standard keyboard connection, not the clipboard.

Network: nothing leaves from the app. Its manifest has no android.permission.INTERNET entry, and Android doesn't let an app without it open network connections. It passes dictation to other apps only by typing it at your cursor.

Billing and models: Its models arrive through Google Play, adding background-download permissions. These let Google Play fetch files. The app itself still can't connect.

1. When you tap the mic, the phone asks the provider's server for its attestation report. That's a list of the software it loaded, signed with a key built into the chip. It works like a tamper-evident seal with the contents printed on it.
2. The phone checks the signature and compares the list with the provider's published one. On any difference, it sends nothing and shows why.
3. On a match, it encrypts the audio, and any vocabulary names the dictation needs, so that only that server can decrypt them.
4. The server's processor keeps its memory encrypted, even from the data center's staff. It turns the speech into text and sends it back.

A few routing fields, such as the model name, stay readable in transit.

No connection: it switches to processing on the phone and shows it. If your firm has turned that off, dictation waits for a connection.

The account key is ours, not your firm's. The IP address it logs is the one your phone connects from. Ask us at support@ergonomc.com which provider we use and where it processes requests. Before any change of provider, we update this page and the privacy policy (opens smfahim.com) and email account holders.

Other third parties: Google Play distributes the apps and models. Our payment processor and email provider handle billing and mail, and receive no dictation unless you email some.

Models: both editions run speech-recognition and cleanup models built on third-party models. We don't train any model on customer dictation. Ask us for the model list, with each maker and license.

Vocabulary import: a list is read from a file you choose in Android's file picker, with no storage permission.

Backups: history, vocabulary and settings are excluded from Android backup and device-to-device transfer.

Voice data: no voiceprints or speaker profiles, anywhere.

Administrators set these through Android Enterprise managed configuration in any console that supports it, including Microsoft Intune. Staff can't change a locked setting on a managed phone.

On Intune, also add each app's package ID, which we send with your licenses, to the Approved keyboards list for Android.

• Attestation shows what software a server loaded, not that the software or the chip is free of flaws. Researchers have found and makers have patched weaknesses in such hardware before.
• The provider writes the expected-software list. The check accepts whatever that list contains.
• The provider's metadata is real data (section 4).
• Text you put into another app is handled by that app. Dictating into Gmail sends that text to Google, as an email would.
• History on your firm's phones is your firm's record, discoverable like anything else on them. We hold no dictation, so we have none to produce.
• The phone is the boundary. A compromised phone, or one without a screen lock, exposes what's on it.
• Locks hold on managed phones. A rooted or unmanaged phone is outside what device management can enforce.

• HIPAA. We don't describe Copperplate as HIPAA compliant and don't offer a business associate agreement. Whether a particular use meets your duties is your counsel's call; this page gives them the facts. We don't market it for clinical use.
• Privilege. We don't claim that using it preserves attorney-client privilege. That depends on how it's used, and by whom.
• Ethics opinions. We don't claim it satisfies any bar opinion, including ABA Formal Opinion 512.
• Certifications. We claim no SOC 2 report, ISO certification or third-party audit, and show no badges. A certificate the provider holds is the provider's.
• GDPR. We claim no GDPR compliance label.
• Zero retention. Not for the Private Cloud edition, because of the metadata in section 4.
• Accuracy and speed. We publish no accuracy or speed figures.
• Integrations. It types into apps on the phone. It doesn't connect to case management or document systems.
• Platforms. Copperplate runs on Android phones. We make no claims about other devices.

No internet permission (On-Device edition)

1. On a test phone, run adb shell pm path <package-id>, then adb pull the base.apk it lists.
2. Run apkanalyzer manifest permissions base.apk or aapt2 dump permissions base.apk.
3. Confirm that android.permission.INTERNET isn't listed. Repeat this on each update before you approve it. We run the same check on every build.

No traffic while dictating

1. Put a test phone behind a network monitor you trust.
2. Dictate for several minutes with the On-Device edition. The app should make no connections. Background model downloads come from Google Play, not the app.
3. Repeat with the Private Cloud edition. You should see only encrypted connections, to the hostnames we give you.

The server check (Private Cloud edition)

On a demo, we show the phone refusing a server whose report doesn't match. In our own test of that check, we changed one digit of the expected value, and no audio was sent. We ran it in October 2026, on a laptop client against the server check. Ask us for the write-up, dated October 2026.