Aftercall
Menu
Download for MacDownload
How it works · privacy

How Aftercall keeps your meetings private

Nothing leaves your Mac until NEAR AI's secure hardware passes its checks, and only the checked model can read your transcript.

The journey of one meeting

What each stop sees and keeps. Both trips to the models pass through the gateway; on the way to Qwen it only relays ciphertext.

  1. Sees:
    Your mic and the call's audio, as two tracks
    Keeps:
    The audio, sealed, until the notes are saved
  2. Sees:
    The audio, over TLS. The transcript only as ciphertext
    Keeps:
    Up to NEAR AI. Its logs aren't attested
  3. Sees:
    The audio, plus project and payee names as spelling hints
    Keeps:
    Up to NEAR AI's policy
  4. Sees:
    The transcript, as You and Others
    Keeps:
    The transcript, sealed
  5. Sees:
    The transcript and names, opened only inside the TEE
    Keeps:
    Up to NEAR AI's policy
  6. Sees:
    The signed notes
    Keeps:
    The notes, sealed. The audio is deleted
  7. Sees:
    A sha256 hash, the start time and the model name
    Keeps:
    Those, in public, for good. No content
1 of 7

Your Mac records your mic and the call's audio as two tracks, sealing the audio about once a second.

Your MacSecure hardware, checked firstNEAR, public

Checked every time, before it’s sent and when it comes back

Each recording gets a fresh nonce. Your Mac checks the gateway, Whisper and Qwen against it, then checks the signed reply: 25 checks before anything is sent and 5 on the signed reply, on a typical meeting with one node per model.

Before anything leaves your Mac 25 checks

Counted for one node per model; each extra node adds its own set
  1. 6 checks · gateway, Whisper, Qwen

    Each machine's Intel quote verifies against Intel's collateral, and debug mode is off.

    So an attacker can'tpass off an ordinary server, or one in debug mode, as secure hardware.

  2. 6 checks · gateway, Whisper, Qwen

    The quote holds the TEE's signing key and the nonce your Mac made for this run.

    So an attacker can'treplay an old quote, or sign with a key made outside the TEE.

  3. 1 check · gateway

    The gateway's quote binds the public key of its TLS certificate, and the audio is uploaded only on a connection whose certificate carries that key.

    So an attacker can'ttake the audio at a TLS endpoint whose key the gateway's quote doesn't bind.

  4. 3 checks · gateway, Whisper, Qwen

    Every boot event in the log replays to the RTMR3 value in the quote.

    So an attacker can'thide what the machine loaded when it booted.

  5. 3 checks · gateway, Whisper, Qwen

    The sha256 of the TEE's Docker compose matches the mr_config in its quote. The images it names are listed by digest, not checked against a list of NEAR's releases.

    So an attacker can'tshow one Docker compose while running another.

  6. 6 checks · Whisper, Qwen

    NVIDIA signs a token for each GPU, with this run's nonce, secure boot on and debug off.

    So an attacker can'tuse a GPU outside confidential mode, or replay old GPU evidence.

When the notes come back 5 checks

  1. 4 checks · Qwen

    The Ed25519 signature covers the exact request, response and model, from a key in a verified quote.

    So an attacker can'tchange the notes in transit, or answer from another model or machine.

  2. 1 check · Qwen

    The transcript was encrypted on your Mac to the key in Qwen's verified quote.

    So an attacker can'tread the transcript at the gateway. It only relays ciphertext.

If a check fails, it stops there. Nothing is sent unless the gateway, every Whisper node and the Qwen node you use all pass.

End-to-end encrypted summaries

The transcript is sealed on your Mac to a key bound in Qwen's verified quote, so the gateway passes on text it can't read.

Audio isn't end-to-end encryptedNEAR AI doesn't offer it for transcription. Audio goes over TLS pinned to the gateway's TLS key from its attestation, and transcriptions aren't signed per response. The Verify sheet says so next to the Whisper checks.
  1. Your Mac takes the key from a verified quoteQwen's Ed25519 key has to sit in the report data of a quote that passed every check, next to this run's nonce.
  2. The transcript is sealed to that key, on your MacEach message gets a fresh X25519 key pair. The shared secret goes through HKDF-SHA256, then XChaCha20-Poly1305 seals the text.[one-time key 32] [nonce 24] [ciphertext + tag]
  3. The notes come back sealed to your MacQwen encrypts its reply to a key pair made for this one request. If end-to-end encryption isn't available, the transcript isn't sent: it never goes over TLS instead.

On your Mac

Audio, transcripts and notes stay in Aftercall's folder, sealed with a key in your macOS Keychain.

Audio
Sealed about once a second as it records, so it's never on disk unencrypted. Deleted once the notes are saved.
Transcripts and notes
Sealed with XChaCha20-Poly1305. A changed byte or the wrong key won't open.
Stays local
Search, calendar lookups, backups you export, and the server agents use to read meetings. Automatic backups go to iCloud Drive, encrypted, only if you turn them on.
The limit
This stops other apps, backup and sync tools from reading your meetings. It doesn't protect a Mac account someone else has taken over.

What we can't prove

Every Verify page lists these under the checks.

  • That the transcript is accurate: Whisper can mishear names and numbers.
  • That this transcription came from the attested Whisper TEE: NEAR AI signs chat responses, not transcriptions.
  • That everyone on the call agreed to be recorded: Aftercall asks you to confirm it, and can't check it.
  • Who said what: “You” is your microphone and the rest is the call's audio; a name on the call's side comes from your calendar or, marked “likely”, from the model reading what was said (an introduction, someone addressed by name), never from the voice, and isn't checked like quotes.
  • When your notes were typed: the proof shows they haven't changed since the notes were made, not that you typed them during the call.
  • What NEAR AI keeps or trains on: that is set by NEAR AI's own policy, not shown by these checks.
  • That every older meeting's transcript was end-to-end encrypted: earlier versions of the app could send it over TLS when encryption wasn't available, and such a meeting's proof says so.

Check it yourself

Every claim on this page points to code you can read and run.

Verify a proofopen a proof link from the app to re-run its checksHow a call is handledeach step, and the recap footer“What is proven” in the repoeach claim and its test
packages/core/src/tee/checks.ts
CPU checks, signature
docs/privacy.md
Where every byte goes
pnpm sample:notes
Every check, on a sample call