What we mean by private
Contents
Every mainstream AI notetaker works the same way: your meeting audio is recorded, uploaded to the vendor’s servers, transcribed there, and stored there. That means the vendor can hear your meetings, and so can their subprocessors, anyone who compromises them, and anyone with a subpoena.
We built Vertebrae the other way around. The transcription model runs on your phone, and your call audio never leaves it.
#The model runs on your phone’s own chip
Vertebrae transcribes in real time, during the call, using a state-of-the-art speech-to-text model (NVIDIA’s Parakeet v2, running via Argmax’s inference stack) executing on your iPhone’s neural engine. There is no transcription server. The audio is consumed as it is spoken, on the device, and the words appear in your transcript as the conversation happens.
Because there is no recording step, there is nothing to retain: when the call ends, the audio is gone. What remains is the transcript and the notes, and those live in storage on your device, not on our servers.
#The call itself is end-to-end encrypted
On-device transcription would not mean much if the call audio were readable in transit. Calls between Vertebrae users are end-to-end encrypted with a fresh key that exists only on the participants’ devices. The audio passes through our servers only in a form we cannot decrypt.
Outbound phone calls to regular numbers are the honest exception: no one can end-to-end encrypt the phone network. We encrypt the Vertebrae leg and hand the call to our carrier for the rest, and we say so plainly rather than pretending otherwise.
#Summaries run in hardware we can prove
Summarization uses a model too large for a phone, so it runs on our GPUs inside a trusted execution environment: confidential computing hardware that even we cannot look inside. Before your device sends a transcript for summarization, it verifies a hardware-signed attestation that the environment is running exactly the code we published, over an end-to-end encrypted channel. The environment neither stores nor logs your transcript, and we publish the attested measurements so you can check them yourself.
#The one exception, on purpose
When you publish a note link to share it, that note is stored on our servers in plaintext, because a link anyone can open has to be readable by the server that serves it. That is the single, deliberate exception to the model above, it happens only when you choose it, and it is spelled out in our privacy policy.
Privacy claims are easy to make and hard to verify. Ours are testable: the transcription runs where you can see it, the encryption keys never leave your devices, and the server-side inference proves what it runs before it receives a byte.