No admin rights. No IT ticket. Still transcribed.
The usual advice for keeping a recording private is "just run Whisper locally." On a managed work laptop that advice is useless, because you cannot install anything. This is the version that works anyway.
Opening a web page is not a privileged action. That is the entire trick, and it is why every other private transcription tool is unavailable to you and this one isn't.
Why every other option fails on a managed machine
This is not a coincidence. The two families of transcription tool fail this situation for two different structural reasons, and nothing in either category is going to fix it:
- Local desktop tools — MacWhisper, Whisper on the command line, the various privacy-first apps — are software you install. That needs an administrator, an App Store you can reach, or a Python environment you are allowed to create. Most managed laptops give you none of the three, and the ones aimed at Apple hardware are irrelevant the moment your employer issues Windows.
- Cloud services — Otter, Fireflies, Rev, Granola — install nothing, which is why people reach for them. But they work by uploading the recording to somebody else's server. If the recording is the thing that must not leave, you have swapped an installation problem for a much worse one.
A web page that does the work locally is the only shape that fails neither test. There is nothing to install, and there is nothing to upload.
What actually happens on your machine
You open a URL. The speech model downloads once into the browser's ordinary cache — about 235 MB, on your own disk, the same mechanism any website uses for images and fonts. You pick an audio file. The page reads it from disk, runs the model on your processor inside the tab, and assembles the transcript in the page.
No installer runs. No executable is written outside the browser profile. No service, no startup entry, no registry change, no extension. Clearing site data removes every trace. The mechanism in full, including the inconvenient parts.
The description to send IT
If you need to ask before using it, the accurate version of the question gets a better answer than a vague one. Copy this:
Subject: Assessment request — browser-based transcription tool
I need to transcribe a recording and would prefer it was not uploaded to a third-party
service. The tool I'd like to use runs entirely in the browser:
app.ratproof.app
What it is:
• A static web page. No installer, no executable, no browser extension, and no
administrator rights required.
• The audio file is read from local disk and processed inside the browser tab. Neither the
audio nor the transcript is transmitted anywhere.
• It is served with Content-Security-Policy: connect-src 'self', which
instructs the browser to block the page from connecting to any other origin. This is
verifiable from the response headers rather than taken on trust.
• About 235 MB of model files are cached by the browser on first use and re-used
afterwards. Clearing site data removes them.
• The components are open source and listed with their licences at
app.ratproof.app/licenses.txt
What I'd like confirmed:
• That the domain is permitted on this network.
• That a cached download of roughly 235 MB is acceptable on this machine.
I'm not claiming this satisfies any specific compliance requirement — I'd just like it assessed on what it actually does.
That last line is deliberate, and you should keep it. A request that overstates its case is the one that gets refused; a request that describes the software accurately and leaves the judgement to the people whose judgement it is tends to get read properly.
What IT will ask, and the honest answers
"Does it upload the audio?" No, and the response header is the evidence rather than our word. Press F12, open the Network panel, transcribe something: there are no requests after the page and model have loaded.
"Where does the data go?" Nowhere. The audio is read from the file you picked and discarded when the tab closes. The transcript exists in the page until you export it. Nothing is stored unless you are asked once and agree to keep a local history, which lives in your own browser.
"Can we audit it?" The components are listed with licences. The security policy is in the response headers. The error rate is published, measured, and includes the numbers that don't flatter us — which is more than any cloud competitor discloses.
"Is it approved / certified?" No, and we won't pretend otherwise. There is no compliance certification here, and any tool that tells you it settles your obligations for you is overselling. What there is, is an accurate description — which is what an assessment needs.
When this still won't work
Three cases, stated plainly, because finding out later wastes your time:
- The domain itself is blocked. No browser tool survives that. It is the case a copy served from your own network exists for — the same software, hosted by your organisation instead of by us.
- The machine is too constrained. A browser tab needs about 2 GB of memory, or about 3 GB when it uses the graphics card. A thin client or a heavily shared virtual desktop may not have it. Both figures are measured.
- You need speaker labels. Not shipped yet. If "who said what" is a requirement rather than a preference, this is not ready for you.
The trade
Your laptop does the work a server would, so it takes longer than a cloud service — roughly 11 to 50 minutes per hour of audio, depending on the machine. That is the price of the recording not going anywhere. Every figure is published here.