Security

Last updated: July 26, 2026

ADI-AI is built around a single architectural decision: your audio is processed on your machine, not ours. This page explains what that means in practice, exactly what does and does not leave your device, how to verify that a release really came from us, and how to report a security problem.

Local transcription architecture

The transcription engine and its models are installed on your computer and run there. There is no cloud transcription service behind ADI-AI, so there is no server-side copy of your recording to protect, subpoena, breach, or mishandle.

This is why the installers are large: the complete AI engine and its models are bundled up front rather than fetched at runtime. Once installed, transcription needs no network connection at all.

Everything the Software produces — transcripts, subtitles, hashes, integrity records, evidence sets — is written to a folder on your machine that you choose. It stays there. We have no ability to read it, because we never receive it.

What is and is not sent to ADI-AI

Never sent to us

Your audio or video recordings
Transcripts, subtitles, and readable output
Speaker labels, timestamps, and analysis
Hashes and chain-of-custody records
Evidence sets and case folders
File names and folder paths of your case material

Sent, and only for this

A license key and device identifier, at launch, for paid editions
Purchase and billing details, handled by Stripe
Whatever you write to us, when you contact support

We do not claim the Software never uses the network — that would be untrue. We claim something narrower and more useful: no recording or transcript is ever uploaded to ADI-AI, and we perform no cloud transcription.

Importing media from a link

If you choose to import media by pasting a URL rather than selecting a local file, the Software contacts the source you named in order to fetch that media. That connection is to the site you chose, not to us, and it happens only when you use that feature. Choosing a local file involves no network activity whatsoever.

License-validation boundaries

Paid editions confirm at launch that a subscription is active. The boundaries of that check are deliberately narrow:

What is sent: a license key (or the stored subscription reference) and a device identifier derived from the machine.
What is never sent: audio, transcripts, case data, file names, or anything about the work you are doing.
Offline tolerance: after a successful validation, paid editions keep launching offline for up to 7 days before re-validating. Losing your connection mid-case does not stop your work.
Device binding: a license is active on one device at a time and can be released and moved to another machine by you, without contacting support.
Scribe50 FREE: contains no licensing component at all. It has no account, no key, and makes no validation call.

Code signing

Every installer we publish is code-signed as ADI-AI LLC and timestamped. The certificate was issued to ADI-AI LLC after an identity-validation process, and the timestamp keeps each signature verifiable long after signing.

A valid signature tells you two things: the build came from us, and it has not been altered since we signed it. To check it yourself, right-click the installer, choose Properties, then Digital Signatures. The signer name should read ADI-AI LLC.

About SmartScreen. Windows SmartScreen builds reputation per publisher and per file, based on how widely a release has been downloaded. That is a separate system from code signing, and a correctly signed installer from a newer publisher can still trigger a one-time prompt. We cannot promise such a warning will never appear, and you should be skeptical of any vendor who does. What matters when it appears is the signature: if the publisher reads ADI-AI LLC, the file is ours and is intact. If it does not, do not run it — tell us instead.

SHA-256 release integrity

Alongside each release we publish a SHA-256 checksum, linked from the download page. It lets you confirm independently that the file you received is byte-for-byte the file we published, even if you obtained it from somewhere other than our site.

Download the installer and open its published .sha256 file.
In PowerShell, run Get-FileHash .\<installer-file> -Algorithm SHA256.
Compare the two values. They must match exactly.

If they do not match, do not run the file. Delete it, download again from adi-ai.ai, and if it still does not match, contact us at support@adi-ai.ai.

Payment separation

Payments and subscription management are handled by Stripe, on Stripe's own pages. We do not build, host, or operate a payment form, and we do not receive or store your full card number. We receive confirmation of payment and the limited details needed to issue your license and manage your subscription. Stripe's handling of your payment data is governed by Stripe's own terms and privacy policy.

This separation is intentional: card data never touches our systems, so it cannot be exposed by them.

Your device is part of the boundary

Because your case material lives on your machine and nowhere else, the security of that machine is the security of your data. That is the trade we have made, and it is a good one — but it puts real responsibility on you:

Keep Windows and your security software current.
Use full-disk encryption, and a strong account password or PIN.
Control who can physically or remotely reach the machine.
Back up your case folders. We hold no copy and cannot recover them for you.
Store license keys somewhere only you can reach.

We cannot protect data on a device that has already been compromised, and we cannot restore work that only ever existed on a disk that failed.

Reporting a vulnerability

If you believe you have found a security vulnerability in our software, website, or license service, we want to hear about it.

Contact: support@adi-ai.ai, with "Security" in the subject line.

Please include enough detail for us to reproduce the issue: what you found, the steps to trigger it, the affected product and version, and what you believe the impact is.

Responsible disclosure

We ask that you:

Give us a reasonable opportunity to investigate and fix the issue before disclosing it publicly.
Avoid accessing, modifying, or deleting data that is not yours, and avoid degrading our services for other people.
Do not use social engineering, physical attacks, or denial-of-service testing.

In return, we will acknowledge your report, keep you informed as we work on it, and credit you if you would like to be credited and the finding is valid. We will not pursue action against researchers who report in good faith and follow the guidance above. We do not currently run a paid bug-bounty program.

What we do not claim

No software is perfectly secure, and we will not tell you otherwise.

We design carefully, we sign and publish checksums for what we ship, and we keep the amount of your data we hold as close to nothing as we can. But we do not guarantee that the Software is free of vulnerabilities, that it cannot be defeated by a sufficiently determined attacker, or that a compromised device can still keep your case material private.

Our security and data-handling practices are built to align with the principles of NIST SP 800-53 and NIST SP 800-88. Alignment with published principles is not the same as certification against them, and we do not claim any compliance certification we have not completed.

Privacy Statement — what personal information we handle and why. Terms of Service — licensing, billing, and the limits of what the Software guarantees.