Security by construction.
The content pipeline is enforced in code, not only in a policy document. Account and product operations use cloud services and are disclosed separately.
The five invariants
The AudioRingBuffer type has no write-to-disk method. By design. This invariant is load-bearing.
AudioRingBuffer.swift · no serialization API
destroyAudio() is called on every code path: success, error, early exit, crash recovery.
CaptureController.finishSession() · every exit path
Transcription and note-writing use on-device models and localhost Ollama. Call audio, transcripts, and notes are not uploaded to Fazit. Account, licensing, updates, optional product analytics, and first-run model downloads may contact remote services. That is a separate lane, not the content path.
OllamaClient.swift (127.0.0.1) · analytics and entitlement are opt-in or account traffic
We deliberately do not implement speaker recognition. No BIPA surface, no training data.
no speaker-ID model shipped, by decision
One Markdown file written to a location you control. Frontmatter always declares audio_retained: false.
NoteWriter.swift · .md, text only
Four stages. One of them never exists on disk.
This diagram is the content path in the shipped code. Account, licensing, updates and optional analytics are a separate lane, described on the legal page.
Architecture and compliance posture
Fazit was designed so call audio never needs to be written to disk or sent to a transcription vendor. That removes the surface cloud notetakers create. It does not replace your obligations under recording-consent or professional rules, and it is not a legal guarantee.
The content lane is the call itself: RAM-only audio, local speech-to-text, local note-writing, and text output you control. No call audio or transcript is uploaded to Fazit for note generation.
The account lane is everything else: email, licensing and trials, device slots, payments, and optional product analytics. It runs on cloud services, is described on the privacy page, and never carries conversation content.
Recording law still applies to you. Consent rules vary, from German §201 StGB to all-party US states, and architecture cannot decide whether you may capture a given call. Fazit ships an in-app consent notice with a one-line disclosure you can say out loud. This is not legal advice.
Auditability is on request: customers can get source access for independent security review. We do not claim works-council approval, GDPR certification, or fitness for every regulated use case.