ADR 006 — Voice DLP Strategy: 4-Phase Tiered Rollout with Whisper.cpp

Status

Proposed — to be ratified after V1 sprint planning + post-Tardy go/no-go decision.

Context

Voice prompts to AI tools bypass Noxys' text-only detection entirely. The surface is large and expanding (browser voice modes, desktop apps, OS-level dictation, meeting bots, phone agents). See prd-voice-dlp for the full landscape.

Several technical paths are possible — browser hook, network proxy, OS audio API hook, meeting bot integration — and several STT engines could power them. We need a single decision that:

Picks a phasing order tied to the tier matrix (Starter / Business / Enterprise / Air-gap)
Picks a primary STT engine that works portable across browser + desktop + OS-hook
Picks an audio-redaction default
Decides whether to ship a quick win first or wait for the full enterprise stack

The competitive picture is empty for AI-app-specific voice DLP — first-mover window favors shipping V1 fast. The Detection Tiering stack (prd-detection-tiering) is already shipped and reusable for transcribed text classification (~80% reuse).

Decision

4-phase tiered rollout in this order:

V1 — Browser MediaRecorder hook (Starter, 8-10j) — ships first
V2 — Network proxy STT interception (Business, 12-15j)
V3 — OS audio API hook (Enterprise, 20-25j per OS)
V4 — Meeting bot integration (Enterprise, 8-10j)

Whisper.cpp as primary STT engine across all phases (tiny INT8 in browser, base in V2, small in V3+). MIT license, multilang FR/DE/ES/IT/NL/EN, portable C++ → WASM/native, mature.

Audio redaction default = silence (PCM zeros). Beep / TTS / block as opt-in alternatives via PlanGate per-tenant policy.

V1 ships first as a quick win — captures the Starter mass-adoption lane (ChatGPT.com, Claude.ai, Gemini web voice) and provides a killer demo ("I say my SSN aloud, Noxys blocks it"). V2/V3/V4 stay in backlog until V1 ships and Tardy is decided.

Consequences

Positive

Reuses Detection Tiering stack (T1 regex + T2 NER + T3 sidecar) ~80% — no parallel classifier to maintain
Demo factor is exceptional — live "voice → block" in 30s is sales gold
First-mover in voice DLP for AI apps (text-only competitors: Nightfall, Harmonic, Prompt Security)
Tier-aligned pricing upgrade path: Starter+ V1 FR → Business+ V1 multilang + V2 → Enterprise V3+V4
Whisper.cpp portability gives us a single STT codebase across browser + desktop + OS-hook
MIT license clean for air-gap / Enterprise on-prem distribution

Negative

Whisper inference adds CPU load on user device (acceptable on modern dev laptops, marginal on low-end / mobile)
Model bundle size (30MB tiny → 244MB small) impacts extension install — mitigated by lazy CDN load + IndexedDB cache
GDPR biometric edge case (if anyone extracts voiceprint) needs legal review per jurisdiction — solved by an explicit "no voiceprint" architectural rule
Three new platforms to maintain in V3 (macOS HAL, Windows WASAPI, Linux PipeWire) — Enterprise-only, MDM-deployed, scope acceptable
Voice consent recording laws differ by jurisdiction (EU explicit consent vs US single/two-party variation) — per-region UX matrix needed before V2 GA

Alternatives Considered

Alternative A — Cloud STT (OpenAI Whisper API, Azure Speech, Deepgram)

Rejected. Sending audio to a cloud STT before redaction means PII leaks to a third party — defeats the entire purpose of Noxys. Even if the cloud STT is "EU-only", we'd be sending raw user speech to a vendor before classification. Non-starter for sovereign-EU positioning.

Alternative B — Audio-side detection only (acoustic features, no STT)

Rejected. Detecting PII from raw audio features (without transcription) is research-grade — accuracy is poor on accents, noise, code-switching, and structured PII (CC#, IBAN, phone) requires the spoken digits to be recognized as digits. Latency would be worse, not better. STT-then-text-classify is the only viable path with current tech.

Alternative C — OS hook first (V3 before V1)

Rejected. Kernel / HAL work is too expensive pre-Series A. MDM-deployed Enterprise customers are far on the timeline (post-Y1). V1 browser hook captures 70% of the dev voice surface for ~10x less effort. Ship V1 first to validate the demand and build the demo.

Alternative D — Apple Speech API only on macOS

Rejected. Locks out Windows + Linux + ChromeOS. Whisper.cpp is portable and gives us a single STT codebase. Apple Speech remains an optional fallback for V3 macOS if Whisper proves too heavy on Apple Silicon — keep it on the table, don't make it the primary.

Alternative E — Vosk over Whisper

Considered but rejected. Vosk (Apache 2) is lighter (50-200MB) and faster on CPU, but accuracy on EU multilang (especially DE/IT/NL) is materially worse than Whisper. License (Apache 2 vs MIT) is a wash. Whisper.cpp tiny INT8 is small enough (30MB) that the size argument doesn't justify the accuracy hit.

Alternative F — Build our own EU-trained STT model

Rejected for v1. Training a sovereign EU STT model is a 6-12 month research project. Whisper is multilang, MIT-licensed, EU-deployable in air-gap — sufficient. Revisit post-Series A with brainstorm-bleeding-edge-detection sovereign-stack agenda.

Status​

Context​

Decision​

Consequences​

Positive​

Negative​

Alternatives Considered​

Alternative A — Cloud STT (OpenAI Whisper API, Azure Speech, Deepgram)​

Alternative B — Audio-side detection only (acoustic features, no STT)​

Alternative C — OS hook first (V3 before V1)​

Alternative D — Apple Speech API only on macOS​

Alternative E — Vosk over Whisper​

Alternative F — Build our own EU-trained STT model​

Links​