Klarword is designed for a computer. You can read these pages here, but to transcribe, open the site on a desktop or laptop: the model weighs hundreds of megabytes and the computation runs on your machine.

Nothing is sent, and you can check it

Klarword does not ask you to believe it. Processing happens in your browser, the browser forbids the page to connect anywhere else, and you can see it for yourself in thirty seconds.

Check for yourself

Disconnect the network. Load a model, then turn off Wi-Fi or unplug the cable. Drop a file and transcribe: everything works. Even reload the page; it comes back.
Open the Network tab. In the developer tools (F12), Network tab, drop a file and start transcribing. No request leaves during the work; the first time, only the model files arrive, from this site.
Read the content security policy. It is in the header of every page and reproduced below. The line connect-src 'self' forbids the browser any connection to another domain. The browser enforces it, not us.
Compare the fingerprints. Every model file has a SHA-256 fingerprint, published on the fingerprints page. The tool checks it before use, and you can recompute it yourself on the downloaded file.

The architecture

The site is a set of static files: pages, code, a compute engine and models. The server serves them and does nothing else. There is no server-side application, no database, no account, and no address to which a recording could be sent.

An architecture rather than a promise

An online service can promise to delete your recording; you have no way of seeing that it does. An architecture, on the other hand, can be seen.

	An online transcription service	Klarword
Where the audio is processed	On the provider's servers, or at its model supplier	In your browser, on your computer
What you have to believe	Its retention policy and its terms	Nothing: cut the network and watch
Processors	Host, model supplier, sometimes outside the European Union	None: there is no processing to subcontract
Retention period	Whatever its terms say, to be negotiated	Not applicable: nothing is received
Reuse to train a model	Depending on its terms	Impossible: we receive nothing
Dependence	On the service, its prices, the law of its country	None: the self-hosted package runs on your network, with no connection
Account, cookies	Often required	None

What is downloaded, and from where

When the tool opens, the browser downloads the page, its code and its style sheet. The first time a model runs, it downloads the compute engine and then the files of the chosen model. When you ask for them, it also downloads the example (a one-minute recording and its text) and the fonts for burned-in subtitles. Everything comes from this site, and nothing else is requested: no font from a third-party service, no third-party script, no analytics.

The library that runs the model (transformers.js) knows how to fetch its files from Hugging Face and its engine from a content delivery network. In Klarword it is not allowed to: its download function is replaced by one that refuses, and it only reads the verified files stored on your computer. An unexpected request fails with a message instead of going out.

What it changes for the GDPR

We receive no recording, so we process none of the data it contains. In practice, for an organisation:

No transfer of data to a third party: the recording does not leave the computer of the person transcribing it. The question of a transfer outside the European Union does not arise, since there is no transfer.
No processor to assess for the content of the recordings, so no data processing agreement to sign for the transcription itself.
No retention period to set and no erasure to request: there is no copy anywhere else. What stays on the computer, a piece of work you asked to keep, is deleted in one click.
No artificial intelligence provider sees your interviews: the models are published under open licences (MIT, Apache 2.0), pinned, verified and served by this site, and then run on your computer.
No cookie, no tracker, no third party: no consent banner, because there is nothing to consent to. The site's only measurement is the counter described below.
The site is hosted in France, by OVH, and only serves files. To depend on no one, the self-hosted package runs on your internal network, with no internet access.

What remains your responsibility

Klarword does not do two things for you: inform the people recorded and, depending on the context, obtain their consent; and add the transcription to your record of processing activities. The terms of use say so too.

What is never sent

Not the audio, not the video, not the transcribed or translated text, not the minutes, not your corrections, not the names of your files. No analytics, no cookie, no telemetry.

This site's server keeps no access log. The hosting provider keeps its own technical logs at machine level, under its security rules.

The only thing that leaves: a counter

When a transcription finishes, your browser sends this site one request, and only one: POST /compte?m=precis&d=10-60. It says which model was used and which band the recording's length falls into (under 10 minutes, 10 to 60, over an hour). Nothing else: not a word of the text, not a file name, not an identifier.

The server writes a single line: the date, the model, the band. No IP address, no browser, no referring page: two transcriptions by the same person cannot be told apart from two by strangers. The total is published as is on the statistics page.

A browser that asks not to be tracked (Do Not Track, Global Privacy Control) sends nothing. Offline, nothing leaves, and nothing is kept for later: the request is never replayed. The self-hosted package is built without the counter. In every case the tool works exactly the same.

To put it plainly: we record the number of finished transcriptions, with the model used and a length band. We therefore know, day by day, how many transcriptions were made with each model, and that is exactly what the statistics page shows. Nothing in those lines says who made them, from where, or what they contained.

What is stored on your computer

The models and the engine are stored in the private space the browser keeps for this site (Origin Private File System), after their fingerprint has been checked. This avoids downloading them again, and makes offline work possible. The tool's “On this computer” panel lists them and lets you delete them.

Your recording is not stored there unless you ask. By default, it is read into memory, in the tab, and forgotten when the tab closes; so is the transcript. That is why the tool asks you to save it.

If you tick “Keep this work on this computer”, the recording and its transcript are stored in that same private space, on this disk, and updated at every correction, so that you find them on your next visit. They are not sent anywhere, and can be deleted in one click, from the start screen or from “On this computer”. Without the box, nothing is kept.

Two settings are kept from one visit to the next, in the browser's local storage, on this computer: the glossary you wrote, and the style chosen for burned-in subtitles. They do not leave the computer; you export the glossary yourself as a text file to share it.

Recording from the microphone

The tool can record straight from the computer's microphone. The browser asks for your permission first; the sound is then kept in memory in the tab, exactly like a file you had dropped, and transcribed the same way. It is not sent anywhere. If you want to keep it, the tool offers to save it on your computer; otherwise it disappears when the tab closes.

The site's Permissions-Policy header allows the microphone for this site only, and forbids the camera, geolocation and the rest.

Transfer from a phone

To move a recording from the phone to the computer, the tool shows a QR code. The file then goes straight from one device to the other over an encrypted WebRTC channel, on your local network: it passes through no server, ours or anyone else's.

For the two devices to find each other, the site's server acts as a letterbox for a few seconds: each one drops a connection description there (its local network addresses and its encryption key fingerprint), and the other reads it. These descriptions are signed with a secret that only the QR code carries, in the part of the address the browser never sends to a server: the relay therefore cannot pose as either device. It keeps them in memory for ten minutes at most, with no log, and refuses any message over 16 KB.

No STUN or TURN server is used: a public STUN would be a request to a third party, a TURN a server the file would end up passing through. The trade-off is stated on screen: both devices must see each other on the same network.

Unplugged, the tool still works

A service worker keeps a copy of the tool's pages and code so that it reloads with the network off; the models are stored separately, after their fingerprint has been checked. That is the demonstration a service that uploads cannot copy, since it needs its server to do the work.

A service worker is a program that installs itself between the page and the network: exactly the place from which your recordings would be taken out. Here is what ours does, and what it does not.

It opens no connection. Its job is to answer with what it already holds. It talks to no other domain: the content security policy would forbid it anyway.
No recording goes through it. Your file goes from your disk to the memory of the tab; what it keeps is this site's pages and code, nothing else.
It does not touch the counter, and never replays it. A service worker can hold a send back and repeat it when the network returns: that would mean keeping a trace of your work while waiting to send it to us. Offline, the counter does not count.
It empties itself at every new version of the site, and pages go to the network first when it is there: you always read the content security policy in force.
It can be read. It is the file /sw.js, at the root of the domain, commented, and it opens in a tab.

To remove it, if you prefer: developer tools (F12), Application tab, Service workers, Unregister. The tool will work as before, online.

The spell checker

The browser's spell checker is off by default in the editor. The basic one in Chrome, Edge and Firefox works on the computer; but Chrome's “enhanced spell check” sends the typed text to Google. If you turn it on in Klarword, check your browser's setting first.

What this architecture does not guarantee

An extension installed in your browser can read the page and make its own requests. For sensitive work, use a profile without extensions.
A compromised computer stays compromised: Klarword does not protect against spyware installed on the machine.
The browser itself sends information to its publisher (updates, crash reports) according to its own settings.
The request list shown in the tool is kept by the page. The browser's Network tab is the check that counts.

Owning it entirely

The site is a folder of static files, models included. There is no application, no database, no running service. It can therefore be placed elsewhere:

on your organisation's intranet, with no access to the internet;
on a web server on your network, however small;
on your own hosting, if you would rather depend on no one.

That is the second meaning of the word “sovereign”: depending on no domain, no subscription, no model provider and no supplier's financial health. If this site disappeared tomorrow, a copy placed on your own server would keep working exactly the same. The self-hosted package is that folder, with its fingerprints.

How it is built, in three sentences

The recording is decoded by your browser, then transcribed by a Whisper model running in the tab, on the graphics card when there is one (WebGPU), on the processor otherwise (WebAssembly). Speakers, minutes and translation are handled the same way, by other open models, on the same computer. Everything the browser downloads comes from this site, is pinned to a specific version and checked against its fingerprint before use.

An independent audit

The code served can be read in the browser, and the self-hosted package is identical to the site's, with its fingerprint. An organisation can therefore have it audited by the provider of its choice, or ask its security officer to review it before approving it. Write to us to receive the package to audit.

The content security policy

Sent by the server with every page, and repeated in the page itself in case it is placed on another server:

default-src 'self';
script-src 'self' 'wasm-unsafe-eval' blob:;
worker-src 'self' blob:;
style-src 'self' 'unsafe-inline';
img-src 'self' blob: data:;
media-src 'self' blob:;
font-src 'self';
connect-src 'self' blob:;
object-src 'none';
frame-src 'none';
base-uri 'none';
form-action 'none'

File fingerprints

Every file the tool can download, the engine as well as the models, has its size and SHA-256 fingerprint published on a separate page: file fingerprints.