"Audio Is Never Stored" Is Easy to Say. So We Published the Code.

Every ambient AI scribe on the market has a privacy page. The privacy pages all read the same way. There's no way to verify any of it. You just have to take their word for it.

We decided to prove ours. Today we published the code behind palmER's Ambient Scribe as an open-source project on GitHub: github.com/palm-ER/self-hosted-asr.

What we published

Every Ambient Scribe encounter on palmER runs through this code. Anyone can read it, run it, and verify that it never stores audio. The repo includes:

• Speech-to-text that transcribes a complete audio file in one pass
• Speaker identification that labels who said what: you, the patient, the family member in the corner
• Streaming transcription that returns text while the audio is still arriving
• The security configuration and a test suite that exercises the privacy behavior the code claims

If a hospital, a residency program, or a privacy-minded developer wants to run transcription entirely on their own machines, this repo will do it. Apache-2.0 code, CC-BY-4.0 models. No strings.

Why we did this

We've written before about the shadow record most scribes quietly accumulate: audio kept for about 30 days, transcripts, AI drafts, your edits. All retained under a contract you've never read. All discoverable. The industry's answer to "how is my audio handled?" has been a privacy policy. A privacy policy is a promise. Code is a mechanism.

So here is the mechanism. In the published stack:

• Audio exists only in memory, only for the life of the request. Working files live in temporary memory that only exists while the system is running. When transcription finishes, or fails, or the container stops, the audio is discarded. There is no code path that writes it to a disk or database.
• The containers can't write it anywhere else. Every service runs in a locked-down environment that can't save new files. The deployment itself blocks writes to disk.
• The logs leave patient content out. The system keeps tracking numbers, timing, and error codes. It does not log audio, transcript text, query parameters, or anything a patient said.

The system is built so it can't store audio. Any scribe company can meet the same standard. We published the code so "we don't store audio" stops being a marketing line and becomes something verifiable.

What this gets you

If you're evaluating ambient scribes, use this repo as a reference. You can inspect each layer of audio handling instead of relying on a policy page.

Transparency should be the standard

The scribe industry is drifting toward a shadow EHR, one 30-day retention window at a time. Longer privacy policies won't fix that. Patients and clinicians deserve a clear view of how encounter data is handled.

That shouldn't be the exception.

Start your free 30-day trial, read our security page, or go straight to the source.

---

The open-source release is the transcription and speaker-identification stack behind palmER's Ambient Scribe. The code is published under the Apache-2.0 license; the speech models carry their own CC-BY-4.0 license.