Device security and encryption
Local-first does not mean encrypted by Synthezia
Section titled “Local-first does not mean encrypted by Synthezia”Synthezia stores session data in a local SQLite database and files in the macOS application-data directory. The inspected implementation does not configure an application-level encryption layer for the SQLite database, normalized audio copies, models, or webview local storage.
The remote-provider API key is stored in webview local storage rather than macOS Keychain. Do not treat this setting as a replacement for operating-system secret storage or an organization-managed credential system.
Device controls matter
Section titled “Device controls matter”The protection of local Synthezia data depends in part on the signed-in macOS account and the device controls your organization chooses, such as a strong account password, screen lock, managed device access, and FileVault. This page does not assert that any of those controls are enabled, sufficient, or compliant for a particular deployment.
Use a separate macOS or organization security review to decide whether the device, account, backup, endpoint-management, and remote-provider controls meet your requirements.
Practical handling guidance
Section titled “Practical handling guidance”- Limit access to the macOS account that stores Synthezia data.
- Treat transcripts, summaries, audio copies, exports, and the remote-provider API key as potentially sensitive.
- Review the export destination before saving a summary; exported files are outside Synthezia’s reset and session-deletion flows.
- Prefer Local Mode when external AI processing is not acceptable for the content.
- Use a provider-specific secret-management and access-control process before placing a production credential in External API settings.