Trust & security
How FlyType protects your account and data (Wispr/Otter-style honesty — no dictation E2EE).
In transit
Production API and Hub use TLS 1.2+. We do not expose plaintext authentication or billing endpoints on the public internet.
At rest
Server volumes use provider disk encryption; object storage uses AES-256 SSE. Device refresh tokens and one-time device auth blobs are stored encrypted (device:v1:), not as plaintext JWTs.
App-layer secrets
- Device sign-in: one-time encrypted blob between Hub approve and client poll.
- MFA TOTP secrets: AES-GCM at rest (mfa:v1:).
- Clients: Keychain (Mac/iOS), Windows DPAPI, Android EncryptedSharedPreferences.
Dictation audio
Cloud dictation is not end-to-end encrypted — the API must decrypt audio to transcribe, same as Wispr Flow and Otter. Use local/offline engine mode to keep audio on-device.
Private Cloud Sync
Always synced when signed in: dictionary, snippets, account preferences (cloud domains).
Opt-in: dictation history, voice library audio, notes cloud sync — controlled per client.
Mind vault
Optional mind_e2e_encryption uses server-side AES-GCM with your account key material — transport security plus at-rest protection, not true client-only E2EE.
Chat AI (Mind, Meetings, Self)
Smart text features use a regional language model. Dictation paste never uses this chat LLM (rules and punctuation only).
- On flytype.ru / RU accounts: generation may be processed in Yandex Cloud (YandexGPT) when regional routing is enabled — not sent silently to overseas chat providers.
- On flytype.net / international accounts: chat LLM stays on DeepSeek (or your admin override).
- Cloud dictation audio still uses STT (sidecar/Groq) as described above — separate from chat LLM.