saywork

Trust & security

The worry with a tool that hears you and works on your computer is that someone is reading everything and knows what each person does. Here is, in plain words, why that is not how Saywork works — and how you can check.

Our practices

We don't listen all the time

The microphone records only while you hold the dictation key, while a meeting you started is recording, or after the wake word — and the wake word is detected on your computer.

Your stuff stays on your computer

History, notes, meetings, the agent's memory, dictionary and settings are files on your computer. We don't have a copy.

A Wallet nobody else can open

Logins and cards you save are encrypted by your operating system on your computer. Saywork fills them in without the value ever reaching our server or an AI model.

Google data, only for your task

Connected Google products use the narrowest permissions we could choose. Their content passes through, is not stored, is never used for ads, and never trains AI models.

Processed, not kept

Turning speech into text and doing a task needs an AI model. What that request needs goes through our server to the model and back. We don't store it, and we don't train on it.

We learn what happened, not what you said

Counts, timings, error codes, which step failed. Content fields are removed on your computer, and our server refuses anything that still has them.

Opt-in means off

Sharing corrected dictations to improve recognition is off unless you turn it on, stored without your name, and withdrawable.

Export or delete, any time

Settings → Privacy shows what is sent right now, gives you everything in one file, and deletes your account and everything our server holds.

Where your data goes

Every arrow is in section 3 of the privacy policy, and Settings → Privacy in the app shows which ones are active on your computer right now.

Who processes data for us

Provider category	Purpose	Data	Processing region
Cloud hosting and infrastructure	Server, database, storage and request logs	What our server stores or relays	Global; United States
Speech and language AI services	Speech recognition and text cleanup	Audio and text per request, not stored by us	United States
Language model services	Models for the agent, Ask and skill research	Requests per task, not stored by us	United States, China and other countries
Account and connected-service platforms	Sign-in and services you connect	Account and your requests	United States
Payment and subscription services	Checkout and payments for paid plans	Payment details collected by the provider; plan and status	United States
Email services	Email	Address, name and message	United States
Messaging platforms	The Saywork bot, if you link it	Messages to the bot (held ? 24 h)	Under the platform's terms
Website hosting	This website	Request logs	United States
Software distribution platforms	App distribution and updates	Information handled under the store's terms	Global

This public page groups providers by service category to limit unnecessary disclosure of business relationships. You can request current provider details at privacy@getsaywork.com. Processing details and legal bases are in the privacy policy.

Security controls

TLS on every connection between the app, our server and our providers.
Connected-service grants encrypted (AES-GCM) with a key held outside the database.
Agent working files, Ask conversations and queued task records on your computer encrypted with a per-install key protected by the operating system.
The Wallet encrypted by the operating system; values are injected straight into the one website chosen for them, never returned to the agent or the model, and every use is recorded on the device.
Content removed on the device; the server enforces an allow-list on every upload and refuses content fields.
Least-privilege OAuth scopes, each tied to a named feature and connected one product at a time; each scope can call only an allow-listed set of API routes; disconnecting revokes access at the provider.
No content from Google or other connected services is written to logs, events or storage on our server.
The agent asks before anything another person will see, or that costs money, is sent or changed.
Prompts and model instructions stay on the server, never in the app.
The API answers only our site and app (locked CORS); admin routes have no CORS at all.
Admin access through a separate sign-in with an authenticator code, every action written to an audit log.
Retention enforced by an hourly job, not by promise; account deletion clears storage within the hour.
IP addresses stored only as keyed hashes; no third-party analytics or cookies on the website.
Releases distributed and updated through the Microsoft Store.

Standards we align with

ISO/IEC 27001aligned with ISO/IEC 27701aligned with ISO/IEC 42001aligned with NIST AI RMF 1.0aligned with OWASP ASVSaligned with OWASP Top 10 for LLM Applicationsaligned with GDPRaligned with

"Aligned with" is not "certified". We use these standards' controls and guidance to design and check how Saywork works. Saywork is not certified to any ISO standard and has no SOC 2 report: those require an independent audit by an accredited body, which is on our roadmap below. No ISO logo is used on this page because ISO does not allow its logo to suggest certification.

Standard	What it covers	How we use it
ISO/IEC 27001	Information security management	Our security controls are mapped to its Annex A themes (access, cryptography, operations, supplier relationships).
ISO/IEC 27701	Privacy information management	Records of processing, data-flow map, retention schedule, rights handling.
ISO/IEC 42001	AI management systems	We document what each AI feature does, its data, and its human checks (approval before sending).
NIST AI RMF 1.0	Managing AI risk	Map, measure and manage: failures are counted by step and fixed through the skill library.
OWASP ASVS	Application security verification	Used as the checklist for our security reviews of the app and API.
OWASP Top 10 for LLM Applications	Risks specific to AI apps	Prompt injection, excessive agency and sensitive-information disclosure are addressed by approvals, server-side prompts and content stripping.
GDPR	EU data protection law	Legal bases, rights, retention and transfers are in the privacy policy; export and delete work in the app.

Assurance: where we are

Item	Status	What it means
Data-flow map and retention schedule	Done	Published in the privacy policy; retention enforced in code.
Google OAuth app verification	In progress	Google's review of how Saywork uses Google data, including the Limited Use requirements. Our handling of Google data is in section 12 of the privacy policy.
Google CASA security assessment (for Gmail)	Planned	The independent security assessment Google requires for apps that read or send Gmail on a person's behalf.
CSA STAR Level 1 self-assessment	In preparation	A public questionnaire (CAIQ) about our security controls, listed in the Cloud Security Alliance STAR Registry. It is a self-assessment, not an audit.
Independent penetration test	Planned	An outside firm tests the app and API.
SOC 2 Type I, then Type II	Planned	An independent auditor's report on our controls at a point in time (Type I), then over a period (Type II).
ISO/IEC 27001 certification	Planned	Certification of our security management system by an accredited body.

Report a problem

Found a vulnerability? Write to security@getsaywork.com. Please give us a reasonable time to fix it before making it public; we will not pursue good-faith research that respects people's privacy and does not disrupt the service. Privacy questions and requests: privacy@getsaywork.com.