Voice AI privacy: three companies hear you before you finish the sentence
Say a sentence to a voice assistant and count the companies in the room. The audio goes to one service to be transcribed. The transcript goes to a second, the model, to compose the reply. The reply goes to a third to be spoken back. Before you have finished the sentence, it has been handled by three vendors, each under its own terms, and some of them reserve the right to train on what was said.
That is the ordinary shape of cloud voice AI. It is not a scandal; it is the architecture. But it has a consequence worth stating plainly: today, voice AI runs on borrowed trust. The conversation is the sensitive part, and the architecture hands it to a chain of parties no single contract controls.
The chain is the attack surface
The risk is not hypothetical. A security disclosure published in October detailed how a voice assistant’s dictation path could be pointed at a server of the attacker’s choosing, handing over the token that controls the account. Cloud dictation, the design decision that sends speech to a remote service in the first place, was one of the things that made the attack possible.
One bug in one product is not an indictment of cloud dictation. The lesson is structural. Every party in the path is another set of credentials, endpoints and terms to get right. A chain of three companies has three times the surface, and when one link misbehaves you find out from the outside. The more of your conversation that travels, the more of it a single mistake can take with it.
Buyers have already noticed
A survey of 1,009 U.S. adults by Cloaked in April 2026 found that 70% say an app that listens to their conversations feels creepy, and 44% would pay more for a service that never hands their data to AI. Consumers feel this before they can articulate it.
For an organization the arithmetic is sharper, because the audio is usually someone’s by right. Dictated returns, witness interviews, intake in the exam room: the recording is a client’s matter or a patient’s voice, and privilege and regulation attach to it. A transcript is also a poor candidate for anonymization. You can scrub a log line; a voice memo identifies its speakers no matter what you redact.
The options
There are three defensible positions.
- Take the commodity path. The assistants themselves are commoditized; everyone has a bot now. For plenty of workloads, a hosted assistant under a proper data processing agreement is the right answer. Not every conversation needs more machinery than that.
- Split the difference with zero-retention inference. Keep the agent, its memory and your secrets on infrastructure you control, and send only text to a zero data retention endpoint. ZDR tiers are common now and not hard to find. Read the actual terms: what is kept, for how long, and whether training is in scope.
- Go fully local. Run inference on hardware you own. The operating pattern that works: reserve the expensive accelerator for inference alone and host the agents on cheap machines; reuse open source agent frameworks rather than building from scratch, because the ecosystem is the value; keep memory, secrets and connectors as separate components behind one audited path, with keys you can revoke.
None of these is a certification. Prompt injection still convinces agents, physical access is physical, and a cloud API sees transcripts under its terms. Every architecture leaves things for a security review to find. The defensible position is to publish the limits.
Where Teaport fits
This is the argument behind Teaport, the appliance Teaspoon AI builds for it: speech recognition, speech synthesis, the agent and its memory run on the board itself. The microphone never leaves it. The language model is a setting, not the architecture. Point it at a cloud API and the only thing that crosses the wire is the text of your turn, which is the narrowest possible thing to expose and the easiest to send to a zero-retention endpoint. Point it at a model on your own network and nothing leaves the building at all, voice or text.
What the board holds, what a sandbox adds, and what none of it stops are written out on the containment ledger, limits included. Local is not the correct answer in every case. What matters is that where the audio goes is a decision the operator makes: per room, per regulator, per client. A cloud-first product makes that decision for its customers, because the round trip is the business.
The questions to ask
Whatever you buy, four questions settle most of it. Where does the audio get transcribed? Who sees the transcript? What happens to it after? Can you revoke it? If the answer is a chain of three companies, count what each link is worth to you.
Teaport is built to answer those questions with: the appliance, the people in the room, nothing, and one key. Everything else is negotiable, including the model.
Sources. Dictation token disclosure: Ars Technica, October 2026. Consumer attitudes and willingness to pay: Cloaked survey, 1,009 U.S. adults, April 2026.