Interview transcription for source work, with no cloud provider in the chain
Interview transcription after you promise a source confidentiality: map every copy of the recording, keep companies out of the chain, be honest about the rest.
Anyone holding a copy of the recording can generally be asked for it, by a court, by an attacker, or by their own staff. That is the practical problem with interview transcription after you have promised a source confidentiality. A normal workflow scatters the audio across five or six places before you have written a word. You cannot control what a company does with a file it holds. You can control how many companies hold one. Transcribing on your own machine takes one party out of the chain. The rest is counting the copies.
A normal interview makes five or six copies
Walk through the last interview you did on a phone. You hit record, so there is a file in the recorder app. The phone backs itself up overnight, so there is a second copy on whichever account that phone signs into. You send the file to yourself in a chat or an email so you can get it onto the laptop, and now it sits in that thread on a server. You upload it for transcription, which puts it on a vendor’s systems and on whatever infrastructure that vendor rents. You download the transcript into your Documents folder, which your work laptop syncs. You paste the good quotes into a notes app that syncs too.
That is six copies and four companies, and nobody did anything careless. Each step felt like moving the file. None of them was. Copying is the default, and deleting is the thing you have to remember.
The point of the count is not to scare you off recording. It is that “where is the audio” has a list for an answer, and you should be able to write that list down before you promise anything to anyone.
| Where a copy ends up | Who can reach it | What to do about it |
|---|---|---|
| The recorder or phone storage | You, and anyone who can get into the device | Move it off by cable, then delete it from the device once the transcript is done |
| Automatic backup of the phone or the recordings folder | The backup provider, and anyone who gets into that account | Turn backup off for that app or folder before the interview, not after |
| The chat or email you sent yourself | The messaging provider, plus both accounts in the thread | Do not use messaging as transport. Use a cable or a drive you carry |
| A transcription vendor’s servers | The vendor, its staff, its sub-processors, anyone who compels or breaches them | Do not create this copy. Transcribe on your own machine |
| The laptop disk | You, and anyone with the machine and the password | Full-disk encryption on, one account nobody else uses, files in a folder outside any sync |
| Notes, docs or a shared newsroom drive | Everyone with access to that space, which is usually more people than you think | Keep the raw transcript out of shared spaces until you have removed identifying detail |
“Deleted after 30 days” is a policy, not a property of the system
Retention promises are worth reading, and they are worth what a promise is worth. A policy is a statement about how a company intends to behave. It can be revised when the terms are updated. It often does not describe backups, caches and logs in the same detail as the primary store. It can travel with the company if the company is sold. And it says nothing about day three, while the file is still there.
Compare that with a property of the system. If the audio never leaves your machine, there is no third party who can be asked, because there is no third party. That is not a promise anyone made to you. It is a consequence of where the bytes went, and you can check it in a way you cannot check a deletion you were told about by email.
None of this puts you beyond anyone’s reach. You still hold copies, and you can still be asked for what you hold. What changes is that you know the full list, and you can tell your source something true about who else has it. “Only me, on one encrypted laptop, until publication” is a sentence you can stand behind. “A company I use says it deletes things after a month” is not the same sentence.
Local interview transcription keeps a vendor out of the chain
Running the speech model on your own computer removes the upload and everything that follows from it. There is no account, so there is no account to be breached, and no company holding a record that this file was ever processed.
FreeTranscribe does this in a browser tab. The model runs on your graphics card through WebGPU, the file is read from disk, and nothing is sent anywhere. It is free and there is no sign-up.
The limits matter here more than in most uses, so here they are before you rely on it:
- Desktop Chrome or Edge with a working WebGPU adapter. Firefox, Safari and phones are not supported yet.
- English only for now.
- It runs OpenAI’s open-source Whisper model in the base size, about 200 MB downloaded once and then cached by the browser.
- About 1.5x real time on a desktop with a graphics card in our test. A thin laptop takes roughly as long as the recording, so a 90 minute interview is a 90 minute job.
- Names, technical terms, heavy accents and noisy rooms are the weak spots. Read it through against the audio before you quote from it.
- There are no speaker labels. For a two-person interview you separate the voices yourself, which is covered in what speech recognition does and does not do with two speakers.
Local processing does not fix most of the problem
It fixes one link in the chain. The rest is still yours, and it is worth being blunt about which parts.
The device is the big one. A laptop with no disk encryption and a shared login is a filing cabinet with the key in it, and a phone with no passcode in a coat pocket is the same thing with wheels. The GDPR puts the general principle plainly enough to borrow: personal data must be “processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage” (Article 5(1)(f)).
Automatic backup is the quiet one. If your recordings folder or your voice recorder app sits inside something that syncs, a copy left the building while you were busy transcribing the local one. Check where that app writes its files, and check it before the interview rather than after. The same goes for the folder your browser downloads the transcript into.
Your own habits are the slow one. Files pile up because deleting takes a decision and keeping takes nothing at all. The storage limitation principle in the same regulation is a decent rule of thumb even outside its legal scope: data should be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed” (Article 5(1)(e)). For an interview, the audio usually stops being necessary once the quotes are checked and the piece is filed.
And some copies were never yours to begin with. Your source may have recorded the conversation too, or mentioned it to a colleague, or called from a line that logs. That is a conversation to have with them, not a setting to change.
One interview, from recording to filing
A short sequence you can run on autopilot.
- Before the call, turn off automatic backup for the recorder app or the folder it writes to, and check that disk encryption is on.
- Record. Agree with the source what happens to the audio, and give them the list rather than a reassurance.
- Move the file to the laptop by cable or on a drive you carry, into a folder outside any sync. Delete it from the recorder once the copy opens.
- Transcribe it locally. Export the TXT and keep it in the same folder as the audio.
- Edit against the audio. Fix names first, then anything you intend to quote.
- Strip identifying detail before the transcript goes anywhere shared, including a story document your colleagues can open.
- When the piece is filed and the quotes are checked, delete the audio and the raw transcript, and empty the trash. Note what you deleted and when.
If you want to try step four now, open FreeTranscribe and drop a file in. The first run downloads the model, and after that it is cached.
Frequently asked questions
Does the browser send anything while it transcribes? The audio is not uploaded. The one thing that comes over the network is the model itself, about 200 MB, downloaded the first time and cached by the browser after that. The file you drop in is read from your own disk.
Is the transcript safer than the audio? No, and in one way it is worse. A transcript is searchable plain text with your source’s name and their words in it, and text is easy to paste into the wrong window. Treat the TXT the way you treat the recording, and keep both in the same encrypted folder.
Should I use a separate device for sensitive interviews? That is a newsroom decision rather than a transcription one, and it depends on what you are working on. The transcription part does not require it. The device hygiene part is the same either way: encryption on, one account, nothing syncing.
My source wants the recording gone today. What do I actually delete? Work through the list in the table, in order, including the copy on the device and the copy in whatever backed that device up. Deleting the one you can see is the easy half.
This is general information about reducing the number of copies, not legal or security advice. Anything specific to a story, a jurisdiction or a source belongs with your newsroom’s security desk or its lawyer.
Sources, checked 15 September 2026
- https://gdpr-info.eu/art-5-gdpr/ : Article 5, storage limitation at 5(1)(e) and integrity and confidentiality at 5(1)(f)
- No other third-party sources were needed. Everything else here is either our own tool, or a way of counting copies that makes no claim about any named product.