Wispr Flow is an established commercial product with detailed published security documentation: a SOC 2 report, ISO 27001 certification (its own pages differ on how far along these are; see the audits row below), encryption in transit and at rest, a model-training opt-out on every plan, and a HIPAA Business Associate Agreement you can sign. The one fact to weigh is architectural, and Wispr states it plainly: your audio is sent to the cloud to be transcribed. So the useful question is not whether Wispr Flow is safe in general, but whether your information is allowed to be processed by a cloud service in the United States.
Publisher note: SuprFlow publishes this guide and is one of the products discussed. Competitor details come from each company's own pages, checked on 1 October 2026. Prices and features change; confirm before you buy.
This page reports what Wispr's own pages say. It is not a security audit, and we have not tested Wispr's controls.
What do Wispr's own pages say about your data?
Wispr Flow security and privacy statements, as of 1 October 2026. Sources: Wispr's security and privacy overview, Enterprise Privacy page, Data Controls page and pricing page.
| Question | What Wispr states |
|---|---|
| Where is speech turned into text? | In the cloud. The security overview says Flow "processes dictated audio in the cloud to turn speech into text", and the Data Controls page says "Transcription always occurs on the cloud." Wispr does not offer on-premise, private-tenant or offline deployment. |
| Where is data processed and stored? | In the United States, on AWS (Northern Virginia, with failover in Northern California). No data residency outside the US. |
| Who else processes it? | Third-party AI and language-model providers, "solely to provide the service". Wispr says content with those providers is "generally deleted within 30 days", that it keeps zero-data-retention agreements with the AI providers used for dictation (its Data Controls page says some features, such as Notetaker briefs, are not covered), and that none of them may train on your data. The subprocessor list is in the Trust Center. |
| Is it encrypted? | TLS 1.2 or higher in transit and AES-256 at rest. Wispr says it is not end-to-end encrypted "in the strict sense, because the service must process audio to produce a transcript", and that customer-managed keys are not supported. |
| Is dictation stored on Wispr's servers? | Only if Dictation Cloud Storage is on. With it off, "audio is discarded once it's transcribed". |
| Is history kept on your computer? | Your choice on desktop: keep it, auto-delete every 24 hours, or never store it. |
| What audits exist? | A SOC 2 Type II report and an ISO/IEC 27001:2022 certificate, available through the Trust Center. Dictation is the audited system; the Notetaker launched later and was not assessed. |
| Do Wispr's pages agree on that? | Not entirely. The help centre and the privacy page say a SOC 2 Type II report and an ISO 27001 certificate exist. The Enterprise Privacy FAQ says the Type II report was "expected in September" and the ISO certificate was "pending issue". The privacy page also says these reports are available to Enterprise plans only. When we opened the Trust Center on 3 October 2026, it listed ISO/IEC 27001, SOC 2 Type 1 and SOC 2 Type 2 under Compliance, named A-LIGN as auditor for ISO/IEC 27001 and SOC 2 Type 2, and showed no report dates; the documents sit behind a "Get access" request. Ask Wispr for the current report before relying on it. |
| Does Wispr sell data? | "We never sell your data." |
| What plan do the team controls need? | SAML SSO on Growth and Enterprise; SCIM, audit logs, MDM deployment and enforced policies on Enterprise. |
Does Wispr Flow train on your data?
Only if the setting is on, and for Free and Pro accounts it starts on. Wispr's security overview says "Improve the model for everyone" is on by default for Free and Pro, with the choice shown during onboarding, and that you can turn it off. On Enterprise it is off and administrators cannot re-enable it. On Growth, an admin can turn it off for the whole organisation.
When it is on, the Data Controls page says your audio, transcript and edits "may be used to evaluate, train, or improve AI models, by Wispr". Whichever way you set it, Wispr says its third-party AI providers cannot train on your data.
One exception to know: the same page says that when you rate a dictation or send feedback, the related session data, which may include audio and transcript, is collected and can be used to develop and train models. Sending feedback is optional.
Is Wispr Flow HIPAA compliant?
Wispr calls its dictation "HIPAA-ready" and says that requires a signed Business Associate Agreement. According to its HIPAA article and Enterprise Privacy page:
- Any user can accept the BAA under Settings → Data and Privacy, on any plan. Organisation admins on Growth and Enterprise can accept it for everyone in the admin portal.
- A signed BAA locks both "Improve the model for everyone" and Dictation Cloud Storage off.
- A signed BAA turns off the Notetaker and Scratchpad, because Wispr says the Notetaker's subprocessors are not yet covered by BAAs.
- The downloaded PDF is a reference record, not a countersigned copy. For a countersigned agreement you contact support.
- Typed in-app feedback is not stripped of health information, so do not put PHI in support messages.
A BAA is one part of compliance, not the whole of it. Whether your practice's use is compliant depends on your own policies, devices and the apps you dictate into. Ask your compliance officer before dictating patient information into any tool.
Which settings should you change before dictating sensitive work?
These steps use the setting names in Wispr's help centre. If your screen differs, look for the Data and Privacy section of Settings.
- Open Settings → Data and Privacy.
- Turn off Improve the model for everyone.
- Turn off Dictation Cloud Storage if you do not want transcripts and audio kept on Wispr's servers. Wispr notes this does not delete history already stored.
- Set local dictation history to auto-delete every 24 hours or never store, if a shared or unencrypted computer is a concern.
- Turn off Context Awareness if the app you dictate into shows information Wispr should not read. Wispr says this feature reads "limited, relevant text from the app you're dictating into" while you dictate. Turning it off limits this but does not stop Wispr from using the app name and nearby text for capitalization and Command Mode, according to its Data Controls page.
- If you handle health information, review and accept the HIPAA BAA.
- Ask whoever owns data policy at your firm whether cloud processing in the US is permitted for the material you plan to dictate.
Even with every setting off, the audio still travels to Wispr's cloud for transcription. These settings govern training, storage and context, not where recognition happens.
What do Wispr's public pages not answer?
- How long stored dictations are kept when Dictation Cloud Storage is on. Wispr's public pages do not say; ask their sales team. The security overview directs contractual retention questions to your account representative.
- Which named AI providers process dictation. Wispr says the current subprocessor list is held in the Trust Center, and that restricted documents there may need approval and an NDA.
Who should choose something else?
Wispr Flow is a reasonable choice when your employer or client permits a vetted cloud vendor, and its audit reports and admin controls will help a security review. It is the wrong fit when a rule says audio or transcripts must not leave the device, must stay in a region other than the US, or must work on a network with no internet access.
In those cases look at apps that run the speech model on the Mac: Apple Dictation where your Mac's Keyboard settings show on-device processing, open-source apps such as Handy, or a paid app such as SuprFlow. SuprFlow's speech recognition runs on the Mac with a downloaded model. It is not a like-for-like replacement: SuprFlow has no SOC 2 report or HIPAA BAA to offer, no team admin console, and it still makes network requests for licence checks, model downloads, updates and usage telemetry. If your review needs vendor audit reports, Wispr has them and SuprFlow does not. Where does my dictation go? traces SuprFlow's data path.
Questions people ask
Is Wispr Flow legit?
Yes. It is a real, actively maintained product. Wispr publishes a privacy policy, says its audit reports are available through its Trust Center, and describes a bug bounty programme on its privacy and security page.
Is Wispr Flow always listening?
Wispr says no. On desktop and Android, dictation records only while you press the shortcut. On iPhone, Wispr says its "background Flow" keeps the microphone session open to avoid switching apps but only transcribes when you start a dictation.
Does Wispr Flow log my keystrokes?
Wispr says it runs a background process to detect your dictation shortcut and "doesn't record, log, or transmit anything you type outside an active dictation session".
Is Wispr Flow end-to-end encrypted?
No. Wispr says data is encrypted in transit and at rest, but not end-to-end, because its servers must process the audio to produce text.
Can I delete my Wispr Flow data?
Wispr says you can request a copy of your data or account deletion from Settings → Data and Privacy, and that deleted records cannot be restored.
Related guides
- Does Wispr Flow work offline?
- SuprFlow vs Wispr Flow
- What a SOC 2 report proves for a dictation buyer
- What a no-training agreement should cover
- Where does my dictation go?
- Is Wispr Flow worth it?
Sources
- Wispr Flow Help Center — Security and privacy overview
- Wispr Flow — Enterprise Privacy
- Wispr Flow — Data Controls
- Wispr Flow Help Center — HIPAA Compliance and Healthcare Use
- Wispr Flow — Privacy Policy
- Wispr Flow — Pricing and plan comparison
- Wispr Flow — Privacy and security
- Apple — Dictate messages and documents on Mac
- Handy — GitHub repository