Security

Last updated 30 September 2026

What Tachyn does with your voice and text, in plain words. It covers what the service does today.

1. Encryption in transit

The app talks to Tachyn's backend at https://api.tachyn.ai, and live speech goes over a secure WebSocket (wss://) to the same address.
The backend reaches our AI gateway over HTTPS, and its live speech channel is also wss://.
This website is served with HTTP Strict Transport Security, so browsers keep to HTTPS.

2. On your Mac

Your Tachyn sign-in token is kept in the macOS Keychain, not in a file or a log. The short-lived token that proves your sign-in to the backend is never stored.
Your dictation history and saved recordings are kept only on your Mac. Audio passes through Tachyn's backend for recognition and is not stored there.
You never enter a speech or AI provider key. The one key for those services is held by Tachyn's backend, not by the app.

3. What is processed, where and by whom

While you hold the key, audio is streamed from your Mac to Tachyn's backend, which checks your sign-in and plan and passes it through our AI gateway to the providers below. Only these leave your Mac:

Audio, for live text: Soniox (model soniox/stt-rt-v5). Fallback: OpenAI (openai/gpt-live-transcribe).
Finished audio, for the final text: OpenAI (openai/gpt-transcribe).
Recognised text, only when it needs clean-up after the local rules have run: a language model, deepseek/deepseek-v4.1-flash, through our AI gateway.
To help recognise names and jargon, a request can carry your personal vocabulary, the name of the app you are typing in, the window title and the text just before the cursor.
Our AI gateway is given an opaque identifier made from your account (a keyed hash), not your email address or name.
Payments are taken by Stripe. Card details are entered on Stripe's pages, not in Tachyn.

4. What we keep, and for how long

Tachyn's servers do not store your audio or your text. The database holds accounts (sign-in identifier, plan, trial end, subscription status) and usage counts (words, seconds of audio, and the day). No content.
Clean-up requests tell the model provider not to store them (the request is always sent with store set to false).
Service logs and error reports never contain audio or text, and error reports are scrubbed before they leave the service.
Usage counts are kept for a limited period, then deleted automatically. Deleting an account (Settings, Account, Delete account) removes its account, usage rows and sign-in; an account with a live subscription must cancel first.
If you ask on the download page to be emailed the macOS build, we keep your email address with the notice you accepted and the time, and use it only to send that link.

5. Training

Tachyn does not use your audio or text to train models.

6. Sign-in and payments

You use Tachyn sign-in in your browser. The backend checks every request's token signature against the issuer's public keys, and that it was issued to the Tachyn app.
Payments are handled by our payments service; Stripe is the payment processor.

7. Report a problem

If you find a security problem, email hi@tachyn.ai. The privacy policy sets out how we handle personal data and lists our sub-processors by name.