Willow Voice, made by Willow Care, Inc., is a cloud dictation service with detailed privacy commitments: Private Mode is on by default, and in that mode Willow says it does not retain your audio, dictated text or screen content, or use them for training. It lists a SOC 2 Type II examination and lets any user sign a HIPAA Business Associate Agreement. The fact to weigh is architectural: in normal use your voice is sent to Willow's cloud in the United States to be transcribed. So the useful question is whether your information may be processed by a US cloud service at all.
Publisher note: SuprFlow publishes this guide and is one of the products discussed. Competitor details come from each company's own pages, checked on 1 October 2026. Prices and features change; confirm before you buy.
This page reports what Willow's own pages say. It is not a security audit, and we have not tested Willow's controls or network traffic.
What do Willow's own pages say?
As of 1 October 2026.
| Question | What Willow states | Source |
|---|---|---|
| Who makes it? | Willow Care, Inc. | Willow site footer |
| Where is speech turned into text? | In the cloud: Willow "uses cloud infrastructure to provide fast and accurate voice dictation". Its site also lists an "Offline mode … powered entirely by your device". | Privacy policy, Homepage |
| Where is it processed? | "Secure cloud infrastructure in the United States." | Security page |
| What about context and formatting? | Context Awareness is optional. When on, Willow "may temporarily process relevant text from the active window"; it is not retained or used for training. | Privacy policy |
| What is stored, and where? | In Private Mode (the default), no dictated audio, text or screen content is retained by Willow or its providers. Transcript history and recordings are stored locally on your device. | Privacy policy, How Willow protects your data |
| Is your data used for training? | Not in Private Mode. "Help Improve Willow" is an opt-in that lets Willow keep anonymized recognized text, not audio, to improve its text-correction models. Service providers are under zero-data-retention and no-training controls. | Privacy policy |
| Audits and agreements | SOC 2 Type II covering the Security criteria, by an independent auditor; report under NDA via the Trust Center. A BAA any user can sign in Settings. GDPR and CCPA listed as standards Willow "aligns with". | Compliance and certifications, Enable HIPAA support |
| Encryption | TLS in transit and encryption at rest, with keys in cloud provider key-management services. | Data security and encryption |
| Platforms | Mac, Windows and iPhone. Android "Coming soon". | Download page |
| Is the source public? | The pages we read do not describe the app as open source or link to its source code. | Willow site |
Willow also collects "limited technical and operational information", including device type, app version, diagnostics, words-per-minute rate and number of words dictated, according to its privacy policy.
Is Willow Voice local?
Not in normal use. Willow's help article How Willow Protects Your Data and Privacy says Willow uses cloud models because "On-device models cannot match this level of performance right now." The homepage and security page do mention an offline mode that runs on your device, and Willow's plans overview lists offline dictation under Individual Pro. None of the pages we read explains which model runs offline, on which plans, or how its results differ. If offline use matters to you, test it on your plan before relying on it.
What do Willow's pages not say?
- What "end-to-end encrypted" covers. The security page uses the heading "End-to-End Encrypted" and describes content protected "while being transmitted and stored"; the encryption article describes TLS in transit and encryption at rest. If your policy uses "end-to-end" in a stricter sense, ask Willow what the term covers.
- Which AI providers process dictation. Willow says its providers are under zero-data-retention and no-training controls, and that subprocessor details are available during an enterprise security review. The names are not on the public pages we read.
- How the offline mode works. See above.
- Retention for meeting notes and Scribe. The privacy policy says "Some features require cloud processing, while others store content only on your device", without listing which is which for every feature.
Which settings should you check before dictating sensitive work?
These follow Willow's help centre. If your screen differs, look in the Privacy section of Settings.
- Download from Willow's site. Willow's install guide says to download from the official website and drag Willow to Applications. How to check a signed Mac release shows how to see who signed it.
- Review permissions. The same guide lists Microphone and Accessibility, under System Settings → Privacy & Security.
- Confirm Private Mode is on and "Help Improve Willow" is off.
- Turn off Context Awareness if the apps you dictate into show information Willow should not read.
- For health information, sign the BAA under Settings → Privacy → Enable HIPAA, and ask your compliance officer whether that is enough for your practice.
- Run a network test with fictional text. Dictate "Refund 2,480 dollars to Priyanka Hale, ticket 7731" once online and once with Wi-Fi off, and note what happens offline on your plan.
When is Willow a reasonable choice, and when does something else fit better?
Willow is a reasonable choice when your employer or client allows a vetted US cloud vendor, and its no-retention default, SOC 2 Type II report and BAA will help a review. Business plans can enforce Private Mode for every user.
It fits less well when a rule says audio must not leave the device, must stay outside the US, or must work with no connection at all and you cannot confirm the offline mode meets that.
In those cases, look at apps that run speech recognition on the Mac. SuprFlow is one: it uses a downloaded WhisperKit model on the Mac, and its Default formatting is local cleanup of punctuation, capitalization and numbers. Its optional Cloud API formatting sends transcript text, not audio, to a provider you configure. It still uses the network for licence checks, model downloads, updates and usage telemetry. It is proprietary, Mac-only (Apple Silicon, macOS 14 or later), costs $125 once with no free tier, and has no SOC 2 report, BAA, team console or phone app. If your review needs audit reports, Willow has them and SuprFlow does not. Where does my dictation go? traces SuprFlow's data path.
Questions people ask
Is Willow Voice legit?
Yes. Willow Care, Inc. publishes a privacy policy updated 5 August 2026, a security page, a help centre and a Trust Center, and lists a SOC 2 Type II examination.
Is Willow Voice secure?
Willow documents TLS in transit, encryption at rest, access controls, monitoring and routine penetration testing, and makes its SOC 2 Type II report available under NDA. We have not audited any of it.
Is Willow Voice local?
No, in normal use it transcribes in the cloud. Willow lists an on-device offline mode without describing it in detail; test it on your plan.
Does Willow Voice store my recordings?
Willow says it does not keep your audio after transcription. Your transcript history and recordings are kept locally on your device.
Related guides
- Willow Voice pricing
- Is Willow Voice worth it?
- Willow Voice alternatives for Mac
- SuprFlow vs Willow Voice
- Wispr Flow vs Willow Voice
- What a SOC 2 report proves for a dictation buyer
Sources
- Willow — Privacy Policy
- Willow — Security
- Willow — official site
- Willow — Download
- Willow — Trust Center
- Willow Help Center — How Willow Protects Your Data and Privacy
- Willow Help Center — Compliance Certifications and Security Standards
- Willow Help Center — Data Security and Encryption
- Willow Help Center — Enable HIPAA Support in Willow
- Willow Help Center — Install and Setup Willow Voice
- Willow Help Center — Willow Pricing Plans Overview