Threat model and limitations
Current boundary
Section titled “Current boundary”Synthezia is a local-first desktop application. The core local path processes audio with local FFmpeg and Whisper, then uses a local Ollama runtime for summaries, chat, and embeddings. It encrypts meeting data and search indexes locally. External API is an opt-in, explicitly authorized generation boundary that can send supported text and context to the configured endpoint.
This design reduces the need to send the original recording to an AI provider in the current flow. It does not remove the risks below.
Risks not eliminated by the application
Section titled “Risks not eliminated by the application”- A person with access to the signed-in macOS account and its Keychain access can use the application’s local decryption boundary.
- Malware or another process running with the user’s permissions can potentially access data while it is available to the application or misuse the user’s account.
- A copied export can be stored, synchronized, shared, or backed up by the destination you choose.
- A remote provider operates under its own endpoint, identity, retention, access-control, and incident-response practices.
- A remote provider operates under its own endpoint, identity, retention, access-control, and incident-response practices.
- Transcription, summarization, retrieval, and generated answers can be wrong, incomplete, or misleading.
Current implementation limits to review
Section titled “Current implementation limits to review”- SQLCipher and encrypted vault audio protect managed meeting data at rest, but do not encrypt imported originals, exports, or downloaded models.
- Remote API keys are held in macOS Keychain, but Keychain availability and account controls still need release validation.
- Managed audio is deleted with its session and can be deleted after successful transcription. Remote copies and user-owned originals or exports are outside the local deletion flow.
- The asset protocol is restricted to short-lived application playback files. Release security review must still validate the packaged webview configuration.
- Signing, notarization, Gatekeeper behavior, platform compatibility, and capture behavior require manual validation on the exact release artifact.
Out of scope for this documentation
Section titled “Out of scope for this documentation”This page does not certify a deployment, assess a particular provider, guarantee regulatory compliance, or replace a penetration test, legal review, endpoint-management review, or incident-response process.