Parrot ScribeParrot Scribe
Security/Encryption Architecture

Encryption Architecture

Technical deep-dive into how Parrot Scribe secures your data

Section: SecurityUpdated March 5, 2026

Encryption Architecture

Parrot Scribe is built on a local-first architecture. Session artifacts and the session metadata index are encrypted at rest in app storage, and core processing does not require sending raw session data to a server. We never see your keys or your data.

Root of Trust: Your Mac's Keychain

The foundation of Parrot Scribe's security is your Mac's Keychain. A root key is generated on first launch and stored in the keychain, protected by the operating system. Working keys are derived from it.

  • Keychain-held root key: The root key lives in your Mac's Keychain, not in app files on disk.
  • Carried by iCloud Keychain: The root key syncs through iCloud Keychain (Apple's end-to-end-encrypted keychain sync), so a replacement Mac or a second Mac signed in to your Apple ID can open your library.
  • Free recovery key: Every user gets a free 24-word recovery key that reconstitutes the root key on a machine without iCloud Keychain. We never see or store it.
  • Never transmitted to us: The root key is not sent to us or to any Parrot Scribe server. We never see your keys.

Key Hierarchy

Parrot Scribe uses domain-separated key derivation to isolate different storage surfaces.

[ Mac Keychain ]
       |
       v
[ Root Key ]
       |
       v
[ HKDF ]
       |
       +-----------------------+-----------------------+-------------------+
       |                       |                       |                   |
       v                       v                       v                   v
[ Session Artifacts ]   [ Speaker Artifacts ]   [ Comments ]       [ SQLite Index ]
 (AES-256-GCM)           (AES-256-GCM)           (AES-256-GCM)      (SQLCipher key)
  1. Root Key: Held in your Mac's Keychain.
  2. Key Derivation: Key derivation uses the keychain-held root with domain separation so storage domains remain isolated, based on constructions like HKDF.
  3. Per-Artifact Isolation: Transcript, audio, speaker, comment, and index keys are separated so compromise in one path does not automatically expose another.

Data Encryption

  • Session and speaker artifacts use AES-256-GCM (GCM overview).
  • Transcript chunks include authenticated data (AAD) with session context and sequence information.
  • Session metadata index is encrypted with SQLCipher using a key derived from the same keychain-held root.

This provides confidentiality plus tamper detection for artifact files and encrypted index-at-rest for metadata.

Cryptographic Deletion

When you delete a session or forget a speaker, Parrot Scribe destroys the associated per-session key and removes the encrypted artifacts and metadata references from app-managed storage. Once the key is gone, the remaining ciphertext can no longer be read on your Mac.

For session metadata, Parrot Scribe also performs database maintenance steps on the encrypted SQLite index to reduce residual references after deletion operations.

Local-First by Design

Your Parrot Scribe data stays on your Mac; only the encryption root travels, and only through Apple's end-to-end-encrypted iCloud Keychain.

  • Data never uploaded: Transcripts, audio, and metadata are not synced to any cloud service, and nothing is sent to Parrot Scribe servers.
  • Key carriage, your choice: The root key is carried by iCloud Keychain when you use it; without iCloud, the 24-word recovery key is the only way to open the library on another machine.
  • Cross-device behavior: Copying encrypted session artifacts to another machine yields no usable plaintext unless that machine also holds your root key (via iCloud Keychain or recovery-key restore).
  • Pre-migration backups: Backup snapshots taken before the portable-key upgrade remain tied to the original Mac's hardware and cannot be opened elsewhere; snapshots taken after the upgrade open wherever your root key does.

Further Reading