How end-to-end encrypted iCloud sync works
End-to-end encrypted iCloud sync works by encrypting your transcript on your device before it leaves, using a key kept in iCloud Keychain. The ciphertext is what reaches your private CloudKit database, so Apple and Parlo never hold the plaintext and the key together. History sync is on by default, and you can turn it off in Settings any time.
What does "end-to-end encrypted" mean here?
It means the encryption and decryption both happen on your devices, never on a server in between. Parlo encrypts a transcript on your device with a CryptoKit key kept in iCloud Keychain, then stores the result as ciphertext in your private CloudKit database. Apple and Parlo never hold the plaintext and the key together, so neither one can read the content of a synced dictation.
Where does the encryption key live?
In iCloud Keychain, which rides your existing iCloud Keychain sync, the same mechanism Apple uses for passwords and other sensitive items. Parlo does not generate a separate account or password for this. The key exists because you are signed into iCloud, and it moves between your devices the same way your other Keychain items do.
How is this different from the copy stored only on my device?
| Layer | Where it lives | Key location |
|---|---|---|
| Local history | On your device only | Device-only key, not carried by iCloud Keychain or a backup |
| Synced history | Your private CloudKit database | CryptoKit key in iCloud Keychain |
Local history is encrypted at rest with AES-GCM under a key that stays on the device. That protection exists whether or not sync is turned on. Synced history adds a second layer: the same content, encrypted again with a key from iCloud Keychain, so it can travel to your other devices without ever becoming readable in between.
Is history sync on by default?
Yes. History sync is on by default. This is only the encrypted cross-device copy of your history; the microphone, transcription, and your local on-device history are not affected by the setting either way. Sync only runs once a device has an iCloud identity: Sign in with Apple on iOS, or the system iCloud account on Mac. A device that is never signed in never syncs, and you can turn sync off in Settings at any time without losing your local notes.
What happens if I turn sync off, or never sign in?
Nothing changes about dictation itself. Your notes stay local, encrypted at rest the same way. Signed out, or with sync off, is a fully functional local-only mode, and a separate "Local only" privacy mode also exists if you want that as the default rather than a toggle you remember to flip.
Can Apple or Parlo see my transcripts in the CloudKit dashboard?
No. The content in your private CloudKit database is ciphertext. Apple's own dashboard tools would show the same encrypted bytes that a server-side attacker would see, since the decryption key never reaches a server. The developer collects no data; your content lives in your iCloud.
Does the keyboard extension see any of this?
No. The keyboard never links the sync stack and never touches CloudKit. It reads only the shared App Group used to hand text back and forth with the app. Encryption, decryption, and any iCloud sync all happen in the app on iOS and in Parlo for Mac, never in the keyboard extension itself.
Why encrypt on the device instead of trusting a server's own encryption?
Server-side encryption, the kind most cloud services use, protects data while it sits on a company's servers. The company still holds the key, though, and can read the content if it chooses to, or if it is compelled to. Encrypting on the device before anything leaves removes that step entirely. The server, in this case your private CloudKit database, only ever sees ciphertext. There is no point in the pipeline where a plaintext transcript and a working key exist on the same machine other than yours.
Is this the same protection Apple uses for other private data?
The mechanism is the same one Apple uses for other sensitive Keychain items: a key that rides iCloud Keychain sync rather than living on a company's server. Parlo did not build a new account or password system to hold this key. It relies on the iCloud identity and Keychain sync you already have set up, which is also why a device that has never signed into iCloud has no key to use and nothing to sync.
Does this cover audio the same way it covers text?
There is no audio to cover. Audio is captured, transcribed, and discarded on the device, so it never reaches a point where encryption or sync would apply to it. Only the finished transcript, the text, is ever a candidate for local encryption or synced encryption. This is worth knowing if you were picturing an encrypted audio archive somewhere: there is not one, on your device or in iCloud.
What if I want to remove everything from iCloud later?
On iPhone, Settings can delete your synced dictations, dictionary, and preferences from iCloud and sign you out. Local notes stay on the device untouched by that action, since deleting the synced copy is a separate step from deleting what is already on your phone or Mac.
What if I lose every device?
If you lose every device and your iCloud Keychain, the encrypted history cannot be recovered. This is the tradeoff of a design where neither Apple nor Parlo holds a spare key: there is no account recovery path that decrypts your history for you. The same design is why a breach of any server or a subpoena served on Apple would not expose readable content, since neither one has anything but ciphertext to hand over.
If you want the plain version of this idea for anyone asking what the beta actually promises, the beta page covers the same ground in its "What to expect" section: transcription and cleanup happen on your device, and history sync is end-to-end encrypted through your private iCloud and on by default.
Frequently asked questions
Who can read my synced dictation history?
Only your own devices signed into the same iCloud account. The key that decrypts your history lives in iCloud Keychain, not on a Parlo server, so Apple and Parlo hold ciphertext, not plaintext.
Is history sync something I have to turn on?
No. It is on by default, since it is what makes your history available on more than one device. You can turn it off in Settings, or skip signing in with Apple, and nothing syncs.
What happens to the local copy on my device?
Local history is encrypted at rest with a separate key that stays only on the device, not carried by iCloud Keychain or a backup, whether or not sync is on.
Does this apply to the audio I dictated?
There is no audio to sync. Audio is captured, transcribed, and discarded, so only the finished transcript is ever a candidate for encrypted sync.
What happens if I lose every device and my iCloud Keychain?
The encrypted history cannot be recovered. There is no separate copy Parlo or Apple can decrypt on your behalf, since neither one holds the key.
Does Parlo have an account system that holds my data instead?
No. There is no Parlo account and no server of ours holding your content. Sync runs through your own iCloud, and on iPhone, Settings can delete your synced data and sign you out at any time.