Security
Tahlk is built so that describing the architecture is the security pitch. Below is the exact path a session takes, and the control in force at every step — not a summary written to sound reassuring, but the actual data flow.
The data path
Everything below is on the clinician's device unless a step is explicitly marked otherwise. Only one step ever sends anything off the device.
Microphone audio is captured locally through the OS audio APIs. Nothing leaves the device at this stage.
Audio is AES-256-GCM encrypted before it is ever written to disk, using a key derived from the database key via HKDF-SHA256 — a separate key, so a weakness in one can't compromise the other. Each file gets a fresh nonce; a tampered file fails to decrypt rather than opening silently.
A bundled speech-recognition model (Whisper) turns audio into text with no network call — nothing to download separately, nothing uploaded.
Before the transcript is touched in any way, Tahlk checks that a signed BAA/EULA acknowledgment is on file. No acknowledgment, no call — the transcript does not move.
The transcript is sent once, over TLS, to Greenbar's managed proxy, which forwards it to Anthropic under Greenbar's Business Associate Agreement and Anthropic's zero-data-retention terms. Clinicians never hold their own Anthropic key — there is no separate account to manage or lose track of.
The note, transcript, and audit trail are written to a SQLCipher-encrypted local database.
Signing locks the note and seals a SHA-256 fingerprint into a running hash chain. Export is provider-directed — a native Save-As dialog or clipboard, never automatic.
What's protecting it
The clinical database is SQLCipher-encrypted. Audio is encrypted independently under its own HKDF-derived key, so the two stores don't share a single point of failure.
A master password gates every launch: PBKDF2 at 210,000 iterations, AES-256-GCM key wrapping, and three offline recovery codes generated at setup. Shipped and enforced — not an optional setting.
Every signed note is chained by SHA-256 hash the instant it's signed. A note's integrity can be verified independent of anyone's word, including ours.
An opt-in setting blocks the app window from screen recording and screen-sharing tools, on macOS and Windows. Off by default, so it never silently breaks a legitimate telehealth share — and there's currently no equivalent on Linux. We say so rather than imply otherwise.
A one-click encrypted export, keyed by a separate passphrase from your login password, plus a staged and crash-safe restore path — so a lost or failed device doesn't mean a lost record.
Clinicians never hold an Anthropic key or manage a separate AI vendor relationship. Every note-generation call checks for a signed BAA/EULA before it's allowed to run, every time.
In progress
Touch ID and Windows Hello as a faster alternative to the password on supported platforms — additive to the existing recovery codes, not a replacement for them.
Provider-set retention periods, a confirmed destruction flow for records past that window, and a documented, auditable record of every destruction event.
Said plainly
We recommend enabling full-disk encryption (FileVault on macOS, BitLocker on Windows) as a complementary control alongside Tahlk's own encryption — it protects against a different part of the threat model than an application password does.
Losing your password, all three recovery codes, and biometric access at the same time means the records on that device are not recoverable, by design — no one, including Greenbar, holds a spare key that would let us reset it for you.
Screen-capture protection is opt-in and has no equivalent on Linux today. Treat any remote-support or screen-share session where PHI is visible as something to actively manage, regardless of platform.