Threat model and limitations
Current boundary
Section titled “Current boundary”Synthezia is a local-first desktop application. The core local path processes audio with local FFmpeg and Whisper, then uses a local Ollama runtime for Local Mode summaries, chat, and embeddings. It stores session data and indexes locally. External API is an opt-in boundary that sends supported text, context, and embedding input to the configured endpoint.
This design reduces the need to send the original recording to an AI provider in the current flow. It does not remove the risks below.
Risks not eliminated by the application
Section titled “Risks not eliminated by the application”- A person with access to the signed-in macOS account can potentially access local application data, exports, or webview-stored settings.
- Malware or another process running with the user’s permissions may access local files or data available to that user.
- A copied export can be stored, synchronized, shared, or backed up by the destination you choose.
- A remote provider operates under its own endpoint, identity, retention, access-control, and incident-response practices.
- A configured provider URL is not restricted by the current setting to an HTTPS scheme.
- Transcription, summarization, retrieval, and generated answers can be wrong, incomplete, or misleading.
Current implementation limits to review
Section titled “Current implementation limits to review”- The application has no configured application-level encryption layer for SQLite, normalized audio, model storage, or webview local storage.
- Remote API keys are not held in macOS Keychain.
- Ordinary session deletion and Reset app data do not remove normalized WAV copies. Remote copies are outside the local deletion flow.
- The application configuration currently leaves a content-security policy unset and permits the asset protocol to read from
/tmp/**,$HOME/**, and$APPDATA/**. This is an in-app webview configuration that requires release security review; it is not a claim that every file in those locations is exposed to a remote website. - Signing, notarization, Gatekeeper behavior, platform compatibility, and capture behavior require manual validation on the exact release artifact.
Out of scope for this documentation
Section titled “Out of scope for this documentation”This page does not certify a deployment, assess a particular provider, guarantee regulatory compliance, or replace a penetration test, legal review, endpoint-management review, or incident-response process.