Creative AI Tools Don't Have to Know Everything About You

AI tools are getting better at remembering us.

That sounds convenient until you stop and ask what “remembering” actually means. A transcript can contain far more than a question and an answer. It might include a private interview, customer information, an unreleased product idea, health details, or the rough first draft of something that has not been shared anywhere else.

AI systems have long turned conversations into a source of memory. They are trusting the system to decide what should be retained, how it should be used, and which future interactions should be influenced by it.

Sequence’s architecture is different.

We do not treat private transcripts as a general-purpose cloud memory layer. Transcript data is stored in an encrypted local database, and access is controlled by the same app-gated security model used by the Sequence app itself.

This distinction matters: there is a difference between an AI remembering your private conversations and an authorized tool reading encrypted local data because you explicitly asked it to.

Why does this matter?

This is not only a technical concern. It changes which kinds of work people can safely bring into an AI-assisted workflow.

A journalist may use Sequence to transcribe an interview with a source who expects confidentiality. A documentary producer may be working with hours of conversations before the story, identities, or allegations are ready to be published. A researcher may be organizing sensitive field interviews. An editor may be searching a private archive for a moment that should never become part of a broader user profile.

In each case, the transcript is valuable because it is private.

If you’re using Sequence for editing, organizing, and searching, you don’t necessarily want the transcript becoming part of the memory system that can influence other interactions later.

A production company may need to process interviews for one project without making those conversations part of a shared or reusable AI history. A consultant may need to find a quote in a recording without exposing the entire archive to a third-party service. A small newsroom may want the benefits of automation without asking every source to accept an unclear data trail.

Security enables those workflows, it gives people a way to use and editor with AI assistance, while keeping a clearer boundary around the material they are responsible for.

The database is encrypted, not hidden

Sequence uses SQLCipher for its application database. The database layer requires a 32-byte key (256 bits), matching SQLCipher’s AES-256 encryption strength. and has separate code paths for encrypted read-only access and encrypted read-write access.

The protected write path deliberately omits SQLite’s create flag. If a path is wrong, the command cannot silently create a new database. Both read and write paths verify that the supplied key unlocks a compatible schema before returning a usable connection.

Sequence also enables SQLCipher memory security for database operations.

This is not a claim that encryption makes every security problem disappear but a boundary: the transcript database is not stored as ordinary plaintext SQLite data waiting for any process with a file path to open it.

Encrypted private iCloud database

The local database is not the only copy Sequence can protect. Sequence’s opt-in backup service creates a fresh compact encrypted database before uploading it to the user’s private iCloud storage. Disclaimer: Apple does not provide developers access to individual users’ data in private CloudKit databases.

The backup flow exports the compact encrypted database, not a plaintext SQLite file. It then validates that staged database with the current key, records a manifest containing the database hash and build metadata, and uploads the encrypted database as a CloudKit asset. Restore verifies the backup metadata and hash before replacing the local database, while Sequence keeps a temporary local encrypted safety copy for the restore workflow.

This security model covers both the working database and its backup path: encrypted local storage, encrypted compact backups, private iCloud storage, and verification before restore.

The key follows the app’s authorization

The SQLCipher key is not an isolated password passed around by the CLI. Protected commands reuse the app’s persisted macOS Keychain session, activation state, app-lock policy, offline lease, and database key. The SQLCipher key is protected by macOS Keychain, which itself is gated by the user’s login password, biometric authentication, and system integrity protections.

Authorization is designed to fail closed. Missing, invalid, expired, reboot-invalidated, locked, or incompatible state does not become an open-ended fallback path. The CLI also avoids triggering Keychain UI and uses a bounded authorization deadline, which matters for automation and agent workflows.

What the CLI can and cannot do

The sq CLI exposes useful transcript operations, including transcript search and transcript-range reads. Those commands operate against the protected Sequence database rather than creating a second transcript store.

The CLI also has explicit safety boundaries:

• Destructive operations require --confirm.
• Database writes do not use a create-on-demand path.
• Invalid authorization fails closed.
• Foreground transcription defaults to no persistence.
• Foreground transcription does not create a Sequence project, database row, or persisted job.

That last point is important. A user can ask Sequence to transcribe a specific audio file without implicitly creating durable application history around the request.

MCP does not mean “send the transcript to a cloud system”

Sequence supports MCP using the stdio transport, the most secure local-first option that keeps all communication process-isolated to the sq CLI contract without network overhead.

It requires Sequence to be open and unlocked, and its instructions tell clients to use the same command arguments and authorization rules as the CLI. Mutating actions retain their normal confirmation requirements.

When the app is running, protected actions can use the owner-only app broker. The integration matrix describes this as a same-user path: the broker handshake is restricted, protected commands prefer the broker without another Keychain query, and the existing policy gates remain active.

In other words, MCP gives an authorized local tool a controlled way to ask Sequence to perform an operation. It does not turn the transcript database into an unaudited memory source for unrelated conversations.

The distinction

There are two very different ideas that are often described with the same word: “AI memory.”

One is a system building a persistent profile from your historical conversations so future interactions can use it. The other is a local application keeping your project data encrypted and allowing an authorized tool to query that data when you ask it to.

Sequence is built around the second model.

The assistant can help search a transcript, inspect sentences, analyze a project, or prepare an edit because the user has authorized Sequence to perform that operation. The transcript remains inside the application’s data boundary.

We believe this is a better fit for creative work. Transcripts often contain material that is very valuable, so we let you decide when or if to share.

What this means for you

• Transcripts stay encrypted on your device unless you explicitly export them
• No persistent AI profile is built from your conversations
• Backups go to your private iCloud storage, not Sequence’s servers
• MCP integrations inherit the same local-first, encrypted boundaries