Map the data flow first
Draw where the audio goes: device, app backend, hosting platform, model provider. Each hop is a separate party with its own breach surface. A local-only tool collapses that map to one machine you control.
Supply chain
LiteLLM's official PyPI release 1.107.0 was malicious for roughly two hours on October 21, 2026, harvesting credentials. Any vendor that installed it during that window may have leaked its AI provider keys.
Secrets at the platform layer
Railway disclosed on October 21 that an unauthorized party may have accessed customers' encrypted environment variables and obtained some decrypted contents. Railway hosts more than 16 million services and believes the attack targeted platform companies to reach AI inference providers. Ask vendors where they host and how fast they rotate secrets.
Trust in transit
Eight eMudhra intermediate CA keys were generated weakly enough to be recovered, which Google says allowed forged HTTPS certificates. Browsers blocked them quickly; other software lags until updated. Encryption in transit is only as strong as the certificate ecosystem.
How Astralcyte Notes scores
Transcription and drafting run on the clinician's device. Notes live in a SQLCipher-encrypted vault protected by a passphrase and recovery key. The temporary audio is deleted once the transcript is durable, there is no telemetry or analytics, and nothing is sent to a cloud AI service.