Security

This page describes what actually protects your data. It doubles as Annex II to our data processing agreement, so a business customer's procurement questionnaire and a curious individual user get the same answers.

What we do not claim. Blurt is run by one person. We hold no SOC 2 report, no ISO 27001 certificate and no third-party penetration test. Saying otherwise would be easy and false. What follows is the concrete list of measures that are in place — judge it on that.

The strongest measure is architectural

On Apple Silicon, Blurt transcribes and cleans up on your Mac by default. In that mode there is no upload, no server, no provider and no account — the safest data is the data that never travels. Everything below concerns the optional managed Cloud plan.

Where your data lives

• Backend and PostgreSQL database run on Hetzner infrastructure in Germany.
• Audio is never written to disk on our side. The backend relays it to the speech provider in flight and holds nothing once the request completes.
• Your dictation history stays on your Mac and is never uploaded. Usage counters on the server hold numbers only — never the text you dictated.

In transit

• TLS on every connection: app to api.blurt.me, backend to every provider, browser to this website.
• The application server binds to localhost only. A reverse proxy terminates TLS in front of it; the application port is never exposed to the internet directly.

Credentials and sessions

• Passwords are stored only as scrypt hashes — never the password itself, and never anything reversible.
• Refresh tokens are stored only as hashes, alongside the device User-Agent, so a stolen database row cannot be replayed as a session and token misuse is detectable.
• Access tokens are short-lived and signed; comparisons of secrets use constant-time equality.
• The free-trial device marker is a salted hash of the Mac's hardware identifier. The raw identifier is never stored and the hash cannot be reversed into it.
• Provider API keys live only on the server. They are never shipped inside the app, which is why the app has no key for you to leak.

The running system

• The application container runs with all Linux capabilities dropped, no-new-privileges, and a read-only root filesystem with a small tmpfs for scratch.
• PostgreSQL authenticates with SCRAM-SHA-256 and is not reachable from outside the host.
• Rate limiting per authenticated account (falling back to per-IP) throttles abuse and brute force; the admin panel has its own stricter per-IP limit on top.
• The admin panel is protected by authentication and is not linked from anywhere on the site.
• Payment webhooks are accepted only with a verified signature, and each event id is recorded so a replay changes nothing.
• Card numbers never reach our servers. Stripe's payment element collects them directly.

Backups and recovery

• Database dumps are taken on a schedule and stored encrypted (age, or GPG as a fallback) — the backup host cannot read them.
• A rolling window of the most recent backups is kept and older ones are deleted automatically, so a backup archive does not quietly become a second, unmanaged copy of everything.

Data minimisation

• No third-party analytics, telemetry or crash-reporting SDKs in the app or on this website — nothing about your use of Blurt is reported to anyone but us. Blurt's own usage analytics is off unless you switch it on, carries no text and no audio, is not linked to your account, stays on this same German server, and is deleted after 90 days. It is described field by field in the privacy policy, and switching it off erases what was already sent.
• This website loads no third-party resources at all — no CDN, no hosted fonts, no trackers. Fonts are served from our own domain, so visiting a legal page does not tell anyone else that you did.
• Legal pages work with JavaScript switched off, including the statutory withdrawal and cancellation functions.
• We do not use your voice or your text to train models, and we do not authorise our providers to do so.

Supplementary measures for transfers

For the providers outside the EEA listed on our processor page, the measures above are what supplements the contractual transfer mechanism: encryption in transit end to end, no audio at rest anywhere in our control, minimum necessary content per request (a provider receives the audio or the text, never your account, your history or your other dictations), and no training use.

Organisational measures

• Blurt is operated by a single person; access to production systems is limited to that person, over key-based authentication.
• Secrets live in server-side environment files, never in the repository.
• Dependencies are pinned and updated deliberately; the release build is signed and notarised by Apple, and updates are delivered over a signed appcast, so an update cannot be substituted in transit.
• We have a written procedure for personal data breaches, including the 72-hour notification duty under Art. 33 GDPR to the Landesbeauftragte für den Datenschutz Sachsen-Anhalt, and notification of affected people under Art. 34 where required.

Reporting a vulnerability

If you find a security problem in Blurt, the backend or this website, please tell us at support-blurt@chbnk.one with "security" in the subject. We will confirm receipt within 72 hours and keep you updated until it is closed.

We will not take legal action against anyone who reports a problem in good faith, keeps it confidential until we have fixed it, and does not access, modify or delete other people's data while investigating. Please avoid denial-of-service testing and automated scanning of the production service — one small server serves everyone.

Related

See our Privacy Policy, the list of processors, the data processing agreement and the Terms of Use.