What "private transcription" has to mean to be worth anything
Before comparing any two tools it helps to say what is actually being claimed, because "private" gets used loosely enough to be meaningless. Three claims are separable, and they are separable on purpose:
- Transport. The audio is encrypted in flight to a server you do not control.
- Rest. The audio and transcript sit in that vendor's database afterwards, where a breach, a subpoena, or a curious employee can reach them.
- Absence. The audio never leaves the machine, so there is nothing to breach, subpoena, or leak.
Only the third survives a determined attacker. The first two are policy commitments, and policy is exactly as strong as the vendor's controls on the day you need them. When a vendor writes a retention policy and a DPA, they are making a promise about a server they hold. When a product processes audio locally, there is no server, and the promise becomes a property of the architecture instead of a clause in a contract.
This matters more than it sounds for the specific class of material that ends up in a transcription tool. Therapy sessions. Medical intake. Depositions. Job interviews. Board meetings. The audio is not incidental — the words are the sensitive part, and they are usually spoken by people who did not know a recorder was in the room.
Where tl;dv puts your audio
tl;dv's own documentation is unusually direct on this point, and I would rather quote it than paraphrase it around the edges:
“Tldx Solutions GmbH does not use Customer Content to train, fine-tune, or improve foundation models for the benefit of tldx Solutions GmbH or any third party.”
The architecture underneath that sentence is Cloud, EU data residency. Your microphone buffer is encoded and shipped to infrastructure the vendor operates, the model runs there, and the transcript comes back. That design buys real advantages — the frontier models available server-side are more accurate on hard audio than anything that fits in a laptop's memory budget, and there is no thermal throttling when a two-hour interview has to finish before you leave the building.
It also means the material now exists somewhere that is not your laptop. Depending on the tier and the configuration, that can mean a retention window you set, a retention window the vendor set, or training on de-identified material by default.
The three clauses that decide it
| Question | tl;dv | Jot |
|---|---|---|
| Does audio leave the device? | Yes — cloud, eu data residency | No. Processing is local. |
| Is your content used for model training? | Never, contractually | Not applicable — nothing is transmitted. |
| Retention you control | Not published | Nothing retained, because nothing leaves. |
| Compliance posture | SOC 2 Type II, GDPR, EU AI Act; no HIPAA claim | None claimed. See the honest note below. |
| Who holds a breach? | The vendor, and every subprocessor | You, and nobody else. |
Zero data retention is three different claims
Vendors use the phrase for at least three materially different positions, and the badges are not interchangeable.
1. Zero retention at the subprocessor
The transcription vendor keeps your data for the length of the job and deletes it immediately after, with a contractual zero-day policy flowing down the chain. This is a real and meaningful guarantee — but it only describes the seconds-to-minutes window inside a vendor you have already handed the audio to.
2. Zero training use
Your content is never used to improve a model. This is the single most load-bearing privacy clause in the category, and the strongest version names third parties explicitly, so the promise survives the vendor swapping model providers.
3. Zero retention anywhere
Nothing is retained because nothing is transmitted. There is no copy on anyone's infrastructure, which means there is no retention window to configure, no DPA to negotiate, and no breach of yours to worry about on the vendor's side.
Most products in this comparison are at position 1 or 2. Position 3 is a different architectural claim, not a stronger version of the same one.
The specific gaps in tl;dv's posture
Training posture
All of that protection is defeated in practice by an August 2026 exposure of roughly 181,874 meeting records through a missing database authorisation rule. Residency and contracts do not substitute for correct access control.
What it does genuinely well
The cleanest no-training clause in the category — it extends the prohibition to any third party, not just to tl;dv's own models — plus genuine EU data residency for buyers who need it.
That second point is worth stating plainly, because it is the reason tl;dv is still the right answer for a great many people. A vendor that publishes audit artefacts and honours a DPA is doing something a single-purpose product cannot. It is doing it for a different threat model — protecting you from a breach at a company that is contractually obliged to handle your data — and not for the threat model Jot is built against, which is the case where the company itself, or a compelled disclosure, or a future change of ownership, is the problem.
Scale and incentives
A €4.3M seed round in 2022 and 3M+ users — by far the thinnest capitalisation of the five, against the largest user-facing trust surface. 3M+ users (vendor-reported). Platform coverage is Web, desktop, iOS, Android, Chrome extension, Zoom/Meet/Teams, API and webhooks, MCP server.
Worth naming plainly: a large, well-funded vendor has more resources to spend on security than a small one, and it is not honest to imply otherwise. The argument is not that tl;dv is careless. It is that a company whose business model is your ongoing subscription has a structural reason to keep your data in a useful place, and that reason does not evaporate when a policy page says otherwise.
Where the incumbent wins, and I will not pretend otherwise
A comparison written only by the winner is marketing, and it should not be trusted. Here is the case against Jot, stated as well as its proponents would state it.
The vendor under comparison here has engineers, a support organisation, a security team, and a compliance budget. Jot is a single-privacy-focused product with a price tag and a promise. When your procurement checklist demands SOC 2 Type II, ISO 27001, a signed DPA, a HIPAA BAA, a SAML SSO integration, and an audit log, the incumbent is not merely easier to buy — it may be the only thing you are permitted to buy.
Team features are the same story. Shared workspaces, admin controls, seat management, centralised billing, and an audit trail are real engineering, and Jot does not attempt them. If you are coordinating a department, an incumbent tool is the correct answer.
Model quality on difficult audio — overlapping speakers, heavy accents, bad microphones, background noise — still favours large frontier models that run on server GPUs. On-device models have narrowed the gap substantially, and they have not closed it.
All of that is true, and none of it is an argument against Jot for the person whose recordings must not leave their laptop. It is an argument about who should buy what. My position is that the two questions — where does the audio go and who has to be able to buy this — have different answers for different people, and that conflating them is how a good privacy posture ends up described as insufficient for work.
Verdict
If your recordings must not leave your device, the comparison is not close. tl;dv transmits your audio by design, and no configuration of that product changes the fact. There is no setting, no enterprise tier, and no DPA that converts a cloud architecture into a local one.
If your recordings are ordinary — team meetings, project notes, nothing with a legal or clinical consequence — then tl;dv's certifications and integrations are worth their price, and you should buy it without reading this post.
The decision is not about which vendor is more careful. It is about whether your threat model includes an adversary who has your data.
Sources
Primary sources, read on the date above. Quoted language is verbatim from the vendor's own pages.