Bring your own key (BYOK)

Bring your own key (BYOK) is an arrangement in which an app uses an API key that you created with an AI provider, instead of a key the app's maker holds. An API key is a secret string that identifies an account to a provider's service. With BYOK, the app sends your audio or text to the provider through your account.

The key moves the data under your provider agreement

Superwhisper, a dictation app for Mac and Windows ¹, says that with your own keys the app acts as a client of your provider account. Data handling then follows your agreement with that provider, not the app maker's terms ². In practice, the provider's policy is the one that applies to your audio, so read it before you connect a key.

Two routes: a key or a local model

BYOK is one of two privacy choices in many dictation apps. The other is a local model, which does not send speech to a cloud service. On Superwhisper's Free plan, dictation uses local Whisper models without AI processing, and the company says nothing dictated leaves the device ³. Cloud models and AI processing come with the Pro plan ⁴. So a local setup needs no key, while a key connects you to a cloud provider.

An example: a clinic with an existing agreement

Suppose a clinic already has a business associate agreement (BAA) with an AI provider. A BAA is a contract that US health privacy rules require between a covered organization and a vendor that handles protected health information. Superwhisper's documentation calls BYOK the recommended path for organizations with existing HIPAA BAAs or financial data compliance agreements ⁵. The clinic can then keep dictated notes under the agreement it already has. That is the reason BYOK matters to regulated buyers: the data follows a contract the organization already signed.

The vendor's recommendation does not make a setup compliant on its own. The clinic still has to confirm the provider's terms and its own policies.

Why it matters for dictation

Dictation sends speech, which can be sensitive, to a server whenever it uses a cloud model. BYOK changes whose account and whose terms apply. It does not make the audio private by itself, so check where the audio goes, whether the provider keeps it and whether your agreement covers the use. Our guides on whether voice to text is safe and on HIPAA compliant dictation cover those checks in more detail. For the difference between processing on the device and in the cloud, see on-device speech recognition and cloud dictation.

What to check before you connect a key

1. Your provider is supported. Apps support different providers, so confirm yours is on the list.
2. The provider's data policy. Once you connect a key, that policy applies to your audio, not the app's.
3. The plan. Some apps reserve custom keys for paid tiers, so check which plan includes them before you pay.
4. Your own agreements. If you work under a BAA or a similar contract, check that the provider agreement covers your use.

For a wider comparison of AI-based dictation apps and how they handle keys and cloud processing, read our guide to AI dictation apps. For the cost side of cloud AI dictation, read how much AI dictation costs. Related terms include AI dictation and perpetual license, which covers how you pay for an app, a question that is separate from who holds the AI account.