Is Descript Safe to Download? What Its Security Page Documents

Yes. Descript is safe to install when it comes from descript.com: its security page, checked 21 September 2026, documents SOC 2 Type II compliance, AES-256 encryption at rest and TLS 1.2 in transit. The real risk is where you download it. Descript supports Mac, Windows and web only, yet on that date the App Store listed an iPhone app called “Descript Ai” from a different developer.

What “safe” means for a Descript download

It’s two separate checks.

The file

Is your installer really Descript’s? That depends on where you got it.

The company and your data

Is Descript, Inc. accountable, and what happens to your uploads? Descript’s own documents answer below.

Where to download the real Descript app

Descript’s help center, checked 21 September 2026, lists three official routes: the Mac app, the Windows app, and web.descript.com.

Mac, Windows and web: the official routes

The desktop app requires macOS 14 (Sonoma) or Windows 11 and newer, per Descript’s download page on 21 September 2026. Both downloads arrive as a .zip file, per Descript’s install guide.

A first-launch “are you sure?” Mac prompt is normal, per Apple’s guide to opening apps safely. If macOS says the developer can’t be verified, delete the file and redownload from descript.com.

Why a Descript iPhone app isn’t Descript’s

Descript’s system requirements page says it isn’t officially supported on mobile browsers or tablets, as of 21 September 2026. The “Descript Ai” listing’s own description calls the product “Mediavo.”

Downloads that are unofficial by definition

Descript offers no 32-bit installer, and the desktop app updates itself, per its help center on 21 September 2026. A “32-bit build” or standalone “Descript update” from another website isn’t Descript’s.

Other Descript-named listings we couldn’t open are excluded. First, check whether your computer meets Descript’s requirements.

What Descript’s security page actually commits to

Descript’s security page, checked 21 September 2026, makes specific commitments.

Encryption at rest and in transit

Stored data uses AES-256 encryption; data in transit uses HTTPS with TLS 1.2. Employees need multi-factor authentication for important systems.

What SOC 2 Type II does and doesn’t prove

Descript says a certified public accounting firm audited it to SOC 2 Type II. We did not review that audit report.

🔍 Why It Works This Way: SOC 2 is an outside audit of security controls, not encryption. AES-256 is the lock; SOC 2 is an independent check that locks like it are in place.

Who Descript shares your files with, and AI training

Descript’s security page, checked 21 September 2026, names the outside companies handling your data.

Named third parties

• Transcription runs through Rev, which deletes data shortly after, or self-hosted Whisper.
• Files are stored on Amazon S3 or Google Cloud.
• Stytch handles logins, Stripe handles billing, and Hedra receives custom avatar images.

Descript says it doesn’t sell project data. That isn’t “doesn’t share”: the list above is sharing.

⚠️ This Costs You: Descript’s privacy policy, last updated 14 April 2025, says ad technology on its website may count as “selling” or “sharing” browsing data under some US state laws. Limiting it takes cookie settings on each browser.

Is your media used to train AI?

Descript’s help center, checked 21 September 2026, says production AI models use no user data, and research models use only data from users who opted into sharing.

The documents disagree on the default: the security page says sharing stays off unless enabled; the privacy policy, the formal legal document, frames it as opt-out.

✅ Do This: After signing in, check Share data with Descript on the Profile tab of App Settings, as Descript’s data privacy article documents.

Who’s behind Descript

Descript, Inc. is based in San Francisco and stores information in the US, per its privacy policy (updated 14 April 2025).

Funding and accountability

Descript says it has raised $100M, mainly from the OpenAI Startup Fund, Andreessen Horowitz, Redpoint Ventures and Spark Capital, per its About page, checked 21 September 2026. It names a Data Protection Officer at dpo@descript.com.

Public security record

Our web searches on 21 September 2026 found no published CVE naming Descript. That wasn’t a direct National Vulnerability Database query: “none found,” not “none exist.”

When to be more careful with Descript

Three situations call for a closer look.

Voice cloning and guests

Custom voices require the speaker to read a Descript consent script, per its security page on 21 September 2026. That audio is also used to improve its service, and voiceprints are kept up to three years after your last account access, per its privacy policy.

Sensitive recordings and startup behavior

For confidential interviews, review the third parties above first. The desktop app opens at login by default; Descript’s install guide documents a switch to turn that off.

What would change this verdict

A published CVE, a breach, a lapsed SOC 2 status, or an official Descript phone app. Leaving? See cancelling Descript and exporting your transcripts.

🧾 Not Tested: We did not install Descript, check its installer’s signature, or read its SOC 2 report. Everything here comes from public pages captured 21 September 2026.

Frequently asked questions

The bottom line on Descript’s safety

Descript’s documented protections are solid; the risk sits at the download. Use descript.com or web.descript.com, ignore phone apps using its name, and check the data-sharing setting after signing in. Next: what Descript actually costs once you’re set up.