DRAFT — not yet reviewed or approved by counsel. Not in effect.
Last updated: 2026-11-14 (draft)
Cannoli Security Overview
Written for the person who has to approve Cannoli for their organization. Everything below describes the product as it exists today; section 12 lists what does not exist yet.
1. Architecture
Cannoli is a macOS app (macOS 26 or later, Apple silicon) plus a small web service at cannoli.ai. The app captures microphone and system audio during a meeting and turns it into a speaker-labelled transcript on the Mac itself, using Apple's SpeechAnalyzer and an on-device diarization model. The web service handles accounts, billing and entitlements and, in Managed mode only, runs a stateless relay to Anthropic's API. Cannoli operates no storage for transcripts, notes or audio.
Customer's Mac cannoli.ai (Vercel) Third parties
+-----------------------------+ +---------------------------+
| Cannoli.app | JWT | Accounts, billing, |----> Stripe (cards)
| mic + system audio ------+ |<------->| entitlement API |----> Neon (account DB)
| on-device speech-to-text | | no | |----> Resend (email)
| on-device diarization | | content | Relay: memory only, |
| transcripts on local disk| | | metadata logs only ------|----> Anthropic API
+-----------------------------+ text +---------------------------+ (Managed mode)
| BYO-key mode: text -> api.anthropic.com directly, customer's own account
| Local-only mode: no content leaves the Mac
2. What never leaves the device
Audio, in any mode: the app does not transmit it and does not write a recording to disk; it exists in memory only while being transcribed. Transcripts and notes are written to ~/Library/Application Support/Cannoli/ and nowhere else. In Local-only mode, transcript text never leaves the Mac either.
3. Data flows by mode
| Mode | Audio | Transcript text | Sent to Cannoli | Third parties that see content |
|---|---|---|---|---|
| Local-only | On device | On device only | Entitlement and update checks if signed in (device id, app and macOS version); nothing if not | None |
| Bring your own key | On device | Mac → api.anthropic.com under the customer's Anthropic account | Entitlement and update checks only | Anthropic, under the customer's own terms |
| Managed | On device | Mac → Cannoli relay (memory only) → Anthropic under Cannoli's account | Entitlement, request metadata, token counts | Anthropic (processor to Cannoli: 30-day default deletion, no training); Vercel (relay runtime, no persistence) |
Experimental, hidden until the customer enables them in the app's configuration: Live mode (text sent repeatedly during the meeting), web research (Anthropic's server-side search tool runs queries derived from the transcript; fetched websites see the request) and research folders (excerpts of files the user selects are sent with the transcript). Enterprise administrators can force a mode and disable these organization-wide.
4. The relay
A serverless function on Vercel. It accepts only the two Anthropic Messages API paths and three models the app uses, validates the device's bearer token, checks the organization's allowance, swaps in Cannoli's Anthropic key, forwards the body unchanged and streams the response back. Nothing is written to disk, database or cache. Logged per request: timestamp, organization, device id, job type, model, token counts, latency, status. Never the prompt or the completion. Platform request logs (IP address, user agent, timestamp) are kept 30 days.
5. Encryption
TLS 1.2 or higher on every connection. The account database is encrypted at rest by Neon. Secrets (Anthropic key, entitlement signing key, database credentials) live only in Vercel's encrypted environment configuration. On the Mac, transcripts are protected by macOS file permissions and data protection; we recommend FileVault. The BYO API key and the device refresh token are stored in the macOS Keychain.
6. Identity and access
Sign-in is by single-use email link; Cannoli stores no passwords. Devices are bound to an organization through a device-code flow and hold a revocable refresh token. Entitlements are Ed25519-signed JWTs that the app verifies with an embedded public key; the private key exists only in Vercel's environment.
No one at Cannoli can read transcript text: none is stored and the relay does not log it. Personnel with database or Stripe access can see account emails, device records, plan and billing status, and usage counts. Every vendor console (Vercel, Neon, Stripe, Resend, Anthropic, Apple Developer) is restricted to named individuals with multi-factor authentication.
7. Application security
The app is signed with an Apple Developer ID certificate, built with the hardened runtime, and notarized by Apple. It sends no telemetry and has no crash reporter. It requests three macOS permissions: Microphone, Screen & System Audio Recording (used for call audio only) and Speech Recognition. It does not request Accessibility, screen recording of video, Full Disk Access or keyboard input monitoring, and reads no files outside its own data folder and the research folders a user explicitly selects.
8. Software updates
Sparkle 2, from an appcast at cannoli.ai signed with an EdDSA key; the app refuses unsigned updates. The daily check sends only the app and macOS versions; Sparkle's system-profile reporting is off. Installers are notarized DMGs served from cannoli.ai.
9. Vendor security
According to each vendor's published trust information: Anthropic publishes SOC 2 reports at trust.anthropic.com and its subprocessors at anthropic.com/subprocessors; Vercel and Neon publish SOC 2 reports; Stripe is PCI DSS Level 1. Anthropic is Cannoli's processor under its DPA (effective February 24, 2025), deletes API inputs and outputs within 30 days by default, and may not train on customer content (Commercial Terms, effective June 17, 2025, section B). Full list: cannoli.ai/legal/subprocessors.
10. Incident response
Contact: [SECURITY EMAIL] (security@cannoli.ai). If an incident affects a customer's personal data, we notify the organization's administrators without undue delay and within 72 hours of becoming aware, with what we know, what we have done and a named contact, updating as facts develop. Because the relay stores nothing, a compromise of Cannoli's infrastructure cannot expose stored transcripts; the exposure to assess is account data and requests in flight.
11. Vulnerability disclosure
Report to [SECURITY EMAIL] with steps to reproduce; we acknowledge within two business days and keep you informed until resolution. Do not access other customers' data, disrupt the service or test the relay with real transcripts. Good-faith research that follows these rules will not be the subject of legal action by Cannoli.
12. Roadmap: what we do not have yet
- SOC 2: not started; planned once Enterprise demand warrants it (Type 1 first, then Type 2 after an observation period).
- Penetration test: not yet performed; planned before the first Enterprise contract, summary available under NDA.
- HIPAA business associate agreement: not offered. Do not transcribe PHI in Managed mode.
- Zero data retention at Anthropic: not in place; Anthropic's 30-day default applies to Managed mode. ZDR is available only by separate arrangement with Anthropic, which we have not obtained; if we do, this page, the DPA and the subprocessor page will say so. Customers with ZDR on their own Anthropic organization get it today via BYO-key mode.
- Self-hosted diarization model: downloaded once from Hugging Face at first run today (your IP address visible to Hugging Face, nothing else); mirroring on cannoli.ai is planned.
- SSO (SAML/OIDC): not available.