Your exposure multiplies with your team
Ten clinicians trying ten note tools means ten vendors, plus whatever hosting and AI providers sit behind them. Each is a company you'd have to notify clients about if it were breached.
The supply chain behind an AI scribe
In October 2026, LiteLLM, a widely used gateway that connects apps to cloud AI models, had its release pipeline hijacked. For about two hours its official package shipped malware that stole credentials, including AI provider keys.
Days earlier, researchers found more than 6,800 shared conversations from Meta's Muse AI assistant exposed in public DNS records. Cloud AI involves more moving parts than most vendor pages show.
Questions to put to any vendor
- Which companies touch the recording and transcript?
- How long is audio kept, and who deletes it?
- Is session content used to train models?
- What client data would a breach of your systems expose?
One standard for the whole team
Astralcyte Notes runs on each clinician's own computer and sends nothing to a cloud AI service, so there's no vendor copy of your clients' sessions. Licences are per device, and you can book a 15-minute demo to see it with your team.