What “on-device” actually means, and how to check

11 August 2026 · 4 min read · Muteeb Mehraj

"On-device" has become a marketing phrase, which means it has stopped being information. Here is how to check it yourself, from weakest evidence to strongest.

Why the phrase slipped

Every one of these is described as on-device by someone, and they are not the same thing:

• The model runs locally. Nothing is transmitted.
• The model runs locally, but text is sent to a server for cleanup.
• The model runs locally, but usage analytics are transmitted.
• A small model runs locally and a cloud model handles anything hard.
• It runs in a data centre, and "device" refers to your account.

The middle three are the ones to watch. Sending only the transcript instead of the audio sounds like a meaningful privacy improvement, and for some threat models it is. But the transcript is the part with your words in it. Audio is bulky and hard to search; text is neither.

Level 1: read the privacy policy

Weakest evidence, but free. Look for what is not claimed. "We do not store your voice recordings" is compatible with transmitting them, processing them, and discarding them. "We do not sell your data" is compatible with almost anything.

The claim you want is about transmission, not retention or sale.

Level 2: watch the network

Much better, because it observes behaviour rather than intent. Install a per-app outbound firewall such as Little Snitch or LuLu, dictate for a few minutes, and see what the app tries to open.

Two caveats that make this weaker than it looks.

First, you are sampling. Absence of a connection during your test is not absence of the capability. An app could transmit on a schedule, or above a size threshold, or only in a region you were not in.

Second, a first-run model download is legitimate and looks identical to exfiltration at the firewall level. Many local-first apps fetch a model once, then never talk to the network again. Judge what happens after that.

Level 3: turn off the network

Underrated, takes ten seconds, and is very hard to argue with.

Enable Airplane Mode, or unplug Ethernet and turn off Wi-Fi. Then dictate.

If the transcription completes normally, the model ran on your machine. There is no clever way around this: an app cannot reach a server that is unreachable. If it hangs, errors, or silently returns nothing, something in that path needed the network.

Do it after first launch, so any legitimate one-time model download has already happened.

Level 4: check the entitlements

The strongest check available on macOS, and the least known.

macOS apps declare entitlements: capabilities the kernel grants or refuses. They are part of the code signature, so changing them invalidates the signature. An app cannot quietly acquire a capability at runtime that its entitlements do not include.

You can read any app's entitlements yourself:

codesign -d --entitlements - /Applications/SomeApp.app

What you are looking for in a sandboxed app:

• com.apple.security.app-sandbox present and true.
• com.apple.security.network.client absent.
• com.apple.security.network.server absent.

If the sandbox is on and the network entitlements are missing, that app cannot open an outbound connection. Not "does not". Cannot. The refusal happens below the app, in the operating system.

The caveat: an unsandboxed app can have an empty entitlements file and still use the network freely, because the restriction comes from the sandbox, not from the absence of a line. Entitlements only prove a negative inside the sandbox. Outside it, fall back to level 3.

How Bellow answers each level

Level 3 is the one we would rather you use, because you do not have to trust us to run it. Turn off your network and dictate. The speech model is bundled in the app; it never downloads anything. Transcription runs on the Neural Engine on your Mac.

For level 4, Bellow ships a sandboxed entitlements configuration that declares microphone and user-selected file access and omits both network entitlements. The app reads those entitlements back at runtime through the OS and shows them in Settings, so the panel reflects what the system actually granted rather than what we typed into a marketing page.

Optional text cleanup uses Apple's on-device model through Foundation Models, which also runs locally. Your transcript history is stored encrypted with AES-GCM, under a key held in the macOS Keychain, marked device-only and never synced to iCloud.

None of that is a reason to believe us. Airplane Mode is.