Security and Trust

Updated September 6, 2026

Beam transcribes speech on your own Mac. No audio, no transcript, and no document ever reaches us, because there is nothing on our side that could receive one. This page is the evidence for that claim, written for the people whose job is to check it.

Beam is published by SparQan LLC, a Texas limited liability company. Security contact: [email protected], also published at /.well-known/security.txt.

The architecture, in one paragraph

Speech recognition runs on-device through models executed locally on Apple silicon. The optional cleanup pass, which fixes grammar and formatting, is a language model that also runs locally. Meetings and notes are captured, transcribed and summarised on the same machine. There is no account, no login, no server-side transcription queue and no cloud inference of any kind. Beam works with the network cable pulled out, and that is the simplest way to demonstrate it.

Every network call Beam can make

This list is exhaustive. Nothing below is required for transcription to work.

Destination	When	What it carries
Update feed	Periodically, and on demand	A request for a static XML file. No identifier is sent. We keep no per-person record.
Model download	First setup, and when a model changes	A request for a static model file. No identifier is sent.
License activation	When you enter or receive a key	The license key and an install identifier derived from the Mac's hardware UUID. Returns a signed license file.
License check	Daily on licensed Macs	The license id and the install identifier, nothing else. Fails open: if it cannot be reached, the license keeps working.
Purchase	Only if you choose to buy	Opens your browser at our payment provider. Card details never touch Beam or our servers.
Support email	Only when you press send	Composed in your own mail app, shown to you in full first. Nothing is transmitted automatically.

Beam contains no analytics SDK, no advertising identifier, no crash-reporting service and no third-party tracker. There is no telemetry to disable because none was written.

Verify it yourself, in about ten minutes

We would rather you tested this than believed it.

Watch the network. Run Little Snitch, Wireshark, or tcpdump while dictating for several minutes. You will see no outbound connection carrying audio, because none is made.
Pull the cable. Disable networking entirely and keep dictating. Everything continues, which is only possible if the work is local.
Check the signature and notarization.
```
codesign -dv --verbose=4 /Applications/Beam.app
spctl -a -vvv /Applications/Beam.app
```
The Team Identifier must read 6P8A7DR398 and Gatekeeper must report the app as accepted and notarized by Apple. Anything else is not our build.
Read the file list. Transcripts and notes are plain files in your own Library folder. Open them, move them, delete them.

What we store, and where

The complete set of personal data SparQan LLC holds about a customer:

The email address used to buy or to request a download.
The license key and its identifier.
Install identifiers for the Macs a license is activated on, up to the seat limit, with activation timestamps.

That is all of it. We hold no audio, no transcripts, no documents, no usage history, no IP-address logs of our own, and no payment details. The complete data-flow account for end users is in the Privacy Policy.

Subprocessors

Provider	Purpose	Data reaching them
Cloudflare	Website hosting, file distribution, license records, inbound email routing	License records and email addresses; standard web request logs
Stripe	Payments and subscriptions	Payment details and billing information, held by Stripe, not by us
Resend	Transactional email, such as license delivery	Recipient email address and message contents
Google	The support mailbox	Whatever a correspondent chooses to write to us

No subprocessor receives customer speech, transcripts or documents, because Beam never transmits them.

Certifications, stated plainly

Beam is not SOC 2 audited and holds no ISO 27001 certificate. We will not imply otherwise, and if you see a badge claiming either on any page of ours, it is not ours.

The reason is worth a sentence, because it is structural rather than a gap we intend to close on a schedule. SOC 2 exists to give assurance over how a vendor handles customer data in its own systems. Beam holds no customer content in its own systems. The controls such a report would attest to are, for the data reviewers usually care about, controls over something that does not exist here.

What we offer instead is verifiability. Every claim on this page can be tested from outside in an afternoon, which is a stronger form of assurance than an annual report about a system you cannot inspect. If your process requires a completed questionnaire, write to us and we will answer it.

Regulatory posture

Framework	Where Beam stands
GDPR / UK GDPR	The personal data we hold is an email address, a license key and install identifiers. Access, correction and erasure are handled by writing to support. A data processing agreement is available on request.
CCPA / CPRA	We do not sell or share personal information, and we run no cross-context behavioural advertising.
HIPAA	No business associate agreement is required, because we never receive protected health information. Dictated content stays on the clinician's Mac and is never transmitted to us.
AI and model training	Nothing you say or type is used to train any model, by us or anyone else. The models ship fixed and run locally; they do not learn from your input and send nothing back.
Data residency	Customer content never leaves the customer's own device, so residency questions do not arise for it. The limited license records described above are held in the United States.

Software supply chain

Beam is distributed directly, signed with an Apple Developer ID under Team Identifier 6P8A7DR398, built with the hardened runtime, and notarized and stapled by Apple before every release. Updates are delivered through Sparkle over HTTPS and each update is cryptographically signed; an update that fails signature verification is refused.

Third-party components and their licenses are listed in full inside the app, under Settings, and ship with the bundle.

Reporting a vulnerability

Write to [email protected]. Tell us what you found and how to reproduce it. We will acknowledge within three business days and keep you informed until it is resolved. We will not pursue legal action against anyone who researches in good faith, acts against their own installation, and gives us reasonable time before disclosing. We do not currently run a paid bounty.

Deployment and procurement

Beam installs as a standard macOS application. It requires the Microphone permission, and Accessibility to insert text into other applications. For meetings it additionally requires system audio capture, which macOS grants only with explicit consent. It does not install a kernel extension, a background daemon outside the user session, or a system-wide network filter.

Managed deployment through Jamf, Kandji or Intune, invoicing and purchase orders, security questionnaires, and a data processing agreement are all available. Write to [email protected] and a person will answer.

If anything on this page turns out to be inaccurate, we want to know before your security team does. Tell us and we will correct it here.