Security
Effective October 6, 2026
Reporting a vulnerability
Send the report to security@knightaiav.com. Useful reports describe what you did, what happened, and why it matters. Please include the Talk DAT! version, your operating system, and the steps needed to reproduce the behavior. A short recording or screenshot helps more than a long description. If a finding involves a real person's data, describe the shape of it rather than sending the data itself.
If that address bounces for any reason, use Build@KnightAIAV.com and put "security" in the subject. A security report should never be lost to a mail configuration problem.
Machine-readable contact details are published at /.well-known/security.txt in the format described by RFC 9116.
What Knight commits to
An acknowledgement from a person within three business days. An assessment, including whether the report is accepted, within ten business days. Credit in the advisory log if you want it and anonymity if you prefer that. Notification when a fix ships, along with the release that carries it.
Knight does not currently run a paid bug bounty. Nothing on this page promises payment.
Safe harbour
Knight will not pursue or support legal action against anyone who reports a security issue in good faith, provided the research stays within these limits: work only against your own installation, your own account, and your own data; do not access, alter, or keep another person's information; do not degrade the service for other people; give Knight a reasonable opportunity to fix the issue before describing it publicly. If a test seems likely to cross one of those lines, write first and ask.
Scope
In scope: the Talk DAT! desktop applications for Windows and Mac, this website and its browser demo service, and the Talk DAT! account service. Out of scope: findings that only affect an unsupported or heavily modified installation, reports produced solely by an automated scanner with no demonstrated impact, missing hardening headers with no exploitable consequence, and social engineering of Knight or its customers.
What Talk DAT! has not certified
Talk DAT! has not completed a SOC 2 audit, holds no ISO 27001 certification and does not offer a HIPAA Business Associate Agreement. Local processing does not satisfy HIPAA, GDPR or security obligations by itself. Organizations must assess their storage, access controls and any selected providers. The app is still not intended for protected health information or other regulated data. Work that carries those obligations should use a product that already carries the paperwork.
Talk DAT! is in public beta. Windows binaries are signed through Azure Trusted Signing and the Mac disk image is notarized by Apple; both confirm the publisher and that the bytes were not altered after signing. Neither is a statement that the software is free of defects.
The browser demo
The home page's browser demo uses Knight's demo service, and it runs only when a visitor presses it. Selected provider routes in the desktop app connect directly to the provider under the user's own account. The page streams microphone audio straight to Deepgram with a token that expires in about 30 seconds, minted by Knight's demo service at demo.talkdat.app; the provider key never reaches the browser. The rough text goes through the same service to OpenRouter to be finished. That service answers only this website's own origin, requires a per-browser demo identifier, rate-limits each browser and each network address over a five-minute window, refuses text over 700 characters, and stores nothing it receives. The desktop apps contain no code that calls it. The demo service is in scope for security reports.
Subprocessors
Talk DAT! is free and has no cloud of its own for speech or writing: dictation runs on your device, and a bring-your-own-key request goes from your device straight to the provider you chose, under your account with them. Nothing you dictate reaches Knight unless you choose to attach a formatting log to a feedback report, and providers selected in the app act under your own account and their own terms. The table lists third parties that process data on Knight's behalf; it does not list every provider you may choose yourself. Railway, Resend and Apple are involved only if you use the optional account or visit this website; Deepgram and OpenRouter process dictation on Knight's behalf only for the optional browser demo on this website, which the apps never use (see the Privacy Notice).
| Subprocessor | Purpose | Data it can see |
|---|---|---|
| Railway | Hosting for this website and for the account service, including its Postgres database | Account records (email address, sign-in methods, signed-in computers, theme and menu order), feedback reports you send from the app (with a formatting log only if you ticked the box to attach one), anonymous app counts, and ordinary request logs |
| Resend | Sending the six-digit sign-in code | The email address you sign in with and the code message sent to it |
| Apple | Sign in with Apple | Your sign-in with Apple, handled under Apple's own terms; Apple tells us an identifier and, if you choose, your email address and name |
| Deepgram | Website demo only: transcribing speech in the browser demo on this website | Microphone audio streamed from your browser while the demo is listening, with model improvement opted out; not a desktop route managed by Knight |
| OpenRouter | Website demo only: finishing the demo's text in the Chill or Executive style, through Knight's demo service | The demo's rough transcript or the text typed into the demo, with data collection denied and zero data retention required; not a desktop route managed by Knight |
Distribution is separate from processing: the Microsoft Store, GitHub (for the Mac disk image and the direct Windows installer) and Hugging Face (for the speech models you choose to download) serve those files to you under their own terms, and receive only the download request. Earlier versions of this list named Google Cloud and Firebase, Stripe, ElevenLabs and Google AI; none of them is a current processor on Knight's behalf. Deepgram and OpenRouter used to serve the apps' managed cloud as well; they now serve only the website demo on Knight's behalf. A selected provider route in the app uses your own account with that provider.
This list was last reviewed against the code of the Talk DAT! apps, the account service and the website demo service on September 22, 2026. Material changes will be dated here. Questions about a specific processor can go to Build@KnightAIAV.com.
Advisory log
Resolved security issues are listed here once a fix has shipped, so the record is public rather than available on request.
No advisories have been published yet. Issues fixed before this log existed are described in the release notes for the versions that carried them.