Aqua Voice, from Aqua Voice, Inc., processes your speech in the cloud: its own pages say "Audio is processed in the cloud", on Aqua's Avalon model in Instant mode or through a third-party realtime provider in Realtime mode. It has a SOC 2 Type II report, an ISO/IEC 27001:2022 certificate, and announced GDPR and HIPAA compliance programs in September 2026. One default matters: Privacy Mode is off unless you turn it on, and with it off, Aqua says transcripts "may be stored on our servers to improve the product". Turn Privacy Mode on before dictating anything sensitive.
Publisher note: SuprFlow publishes this guide and is one of the products discussed. Competitor details come from each company's own pages, checked on 1 October 2026. Prices and features change; confirm before you buy.
This page reports what Aqua's own pages say. It is not a security audit, and we have not tested Aqua's controls or network traffic.
What do Aqua's own pages say?
As of 1 October 2026.
| Question | What Aqua states | Source |
|---|---|---|
| Who makes it? | Aqua Voice, Inc. | Privacy policy footer |
| Where is speech turned into text? | "Audio is processed in the cloud." Instant mode runs on Aqua's own Avalon models; Realtime mode "streams audio to a third-party realtime speech provider". | Aqua llms.txt |
| Does it work offline? | "Cloud dictation needs an internet connection. Offline availability varies by platform, app version, and mode." | FAQ |
| What about screen content? | Deep Context reads what is on screen to improve names and technical terms. It is "off until you enable it, and its data is never stored". | Aqua llms.txt |
| What is stored on Aqua's servers? | With Privacy Mode off (the default), transcripts may be stored to improve the product. With it on, transcripts are not stored, though session metadata such as timestamps, device type and performance metrics may still be collected. | Privacy policy, Aqua llms.txt |
| What is stored on your computer? | Local History keeps transcripts and audio on the device. | Aqua llms.txt |
| Training and advertising | Transcripts kept with Privacy Mode off are used "to improve the product". Aqua says it never shares transcripts or audio with an advertising platform, but does share hashed email and conversion events with ad platforms for measurement. | Privacy policy |
| Audits and certifications | SOC 2 Type II, audited by Advantage Partners (announced 25 March 2026). ISO/IEC 27001:2022 certificate (14 July 2026). GDPR and HIPAA compliance programs, with BAA terms discussed through support (23 September 2026). Reports and certificate are in the Trust Center. | SOC 2 post, ISO 27001 post, GDPR and HIPAA post |
| Team controls | Team plans can enforce Privacy Mode; Business adds SSO/SAML, SCIM and Zero Data Retention. | FAQ, Aqua llms.txt |
| Platforms | macOS (Apple Silicon and Intel), Windows 10 and 11, iOS. | Aqua llms.txt |
| Is the source public? | Avalon is described as "Aqua's proprietary speech-recognition model". The pages we read do not describe the app as open source. | Aqua llms.txt |
What do Aqua's audit posts actually say?
Each post is short and specific, and worth reading in Aqua's own words:
- The SOC 2 post says Aqua's auditors "informed us that we meet the criteria needed to be certified as SOC 2 Type II compliant", names Advantage Partners as the audit firm and Vanta for evidence collection, and links to the Trust Center for the report. Aqua's FAQ adds a fair clarification: "SOC 2 is an audit report, not a certification."
- The ISO 27001 post says third-party auditors certified Aqua against ISO/IEC 27001:2022 and that the certificate can be downloaded from the Trust Center.
- The GDPR and HIPAA post describes a GDPR program (data inventory, privacy risk assessments, vendor agreements, request procedures) and a HIPAA program built on the same controls. It asks healthcare users to contact [email protected] before using Aqua with protected health information, and says "we'll confirm which products and plans are covered, walk through any required settings, and discuss BAA terms." Aqua's own summary notes that "GDPR and HIPAA are compliance programs, not certifications."
What do Aqua's pages not say?
- Whether stored transcripts train Avalon. The privacy policy says transcripts kept with Privacy Mode off are used to improve the product. It does not say whether that includes training the speech model.
- Where audio is processed geographically. The pages we read do not state a region. The subprocessor list is in the Trust Center.
- Which provider handles Realtime mode. Aqua says a third-party provider receives the audio and points to the Trust Center for subprocessors.
- Which Mac permissions it needs. The pages we read do not list them; check what it requests during setup.
- Which plans the BAA covers. Aqua asks you to confirm this with support.
- The Trust Center contents. The Vanta-hosted page needs JavaScript and did not render for us, so we have not read the report, certificate scope or subprocessor list. Request them from Aqua.
Which settings should you check before dictating sensitive work?
- Download from aquavoice.com/download. Aqua's FAQ says that if antivirus flags the installer, check it "came from Aqua's download page". How to check a signed Mac release shows how to see who signed it.
- Turn Privacy Mode on. It is off by default.
- Leave Deep Context off unless you want Aqua reading on-screen text.
- Check the transcription mode. Instant uses Aqua's Avalon model; Realtime sends audio to a third-party provider.
- Review permissions under System Settings → Privacy & Security, and Local History in Aqua's settings.
- Run a network test with fictional text. Dictate "Invoice 6610 for Benedikt Sauer, 1,975 dollars, due the 30th" online, then with Wi-Fi off, and note what your version does offline.
- For health information, contact Aqua about a BAA first, and ask your compliance officer.
When is Aqua Voice a reasonable choice, and when does something else fit better?
Aqua is a reasonable choice when cloud processing is acceptable, you turn Privacy Mode on (or your Team plan enforces it), and your reviewer wants a SOC 2 Type II report and an ISO 27001 certificate.
It fits less well when audio must not leave the device or dictation must work without a connection. In those cases, look at apps that run speech recognition on the Mac. SuprFlow is one: it uses a downloaded WhisperKit model on the Mac, and its Default formatting is local cleanup of punctuation, capitalization and numbers. Its optional Cloud API formatting sends transcript text, not audio, to a provider you configure. It still uses the network for licence checks, model downloads, updates and usage telemetry. It is proprietary, Mac-only (Apple Silicon, macOS 14 or later), costs $125 once with no free tier, and has no SOC 2 report, ISO certificate, BAA, Windows or phone app. If your review needs audit reports, Aqua has them and SuprFlow does not. Where does my dictation go? traces SuprFlow's data path.
Questions people ask
Is Aqua Voice free?
Only to start. Aqua's FAQ says the Starter allowance "includes 1,000 free words with no credit card required", after which you need a paid plan. Aqua Voice pricing lists the plans.
Is Aqua Voice legit?
Yes. Aqua Voice, Inc. publishes a privacy policy, terms and a Vanta-hosted Trust Center, and says it has a SOC 2 Type II report and an ISO 27001 certificate available there.
Does Aqua Voice read my screen?
Only if you enable Deep Context, which uses what is on screen to improve accuracy. Aqua says it is off by default and its data is never stored.
Is Aqua Voice HIPAA compliant?
Aqua says it has a HIPAA compliance program and asks you to contact support before using it with protected health information, to confirm covered plans and discuss BAA terms.
Related guides
- Aqua Voice pricing
- Aqua Voice alternatives for Mac
- SuprFlow vs Aqua Voice
- What a SOC 2 report proves for a dictation buyer
- What a no-training agreement should cover
- On-device dictation vs no internet