Configure your network for Wispr Flow

If downloads are blocked or dictation is slow on your corporate network, check outbound access and TLS inspection. Enterprise admins can also restrict Flow to approved networks.

Allow outbound access to websites and downloads

If your organization restricts outbound traffic, allow these domains:

Fix slow dictation caused by SSL/TLS inspection

Flow respects system proxy settings and organizational root certificates, including TLS inspection, for dictation, uploads, and SSO session management. Dictation requires valid, self-signed root certificates in macOS System Roots or the Windows root store; malformed or intermediate-only corporate certificates can fail even when other connections work.

TLS inspection can slow dictation without preventing text delivery. Networks that do not intercept the connection do not need this bypass.

Use the complete wildcard destination list, including *.wisprflow.com; *.wisprflow.ai alone is insufficient, and the list must also cover alternate dictation connections and other Flow connections. Destinations can change without an app update and differ between colleagues, so testing one exact hostname is insufficient.

1. Request the full wildcard destination list from support@wisprflow.ai.

2. Create an SSL/TLS-inspection bypass on outbound port 443 for the complete list.

3. Apply the bypass wherever inspection runs.

4. Save a permanent policy covering relevant offices, VPN egress points, and remote-user policies.

5. Test dictation from the affected network once the policy has propagated.

If dictation is faster, the change is working; if not, contact support. The policy does not need reapplying per user, device, or session.

Restrict organization access to approved networks

Firewall rules and your organization's IP allowlist are separate: allowing a hostname through your firewall does not add that network to the IP allowlist.

IP allowlist appears only for Enterprise organizations enabled by Wispr. Changing it requires an active Enterprise plan and enterprise admin permissions. It applies to Wispr's account and management services, and is not enforced on Android or on the speech-processing service.

• Entries: Up to 64 IPv4/IPv6 CIDRs are accepted; invalid entries, empty lists, 0.0.0.0/0, and ::/0 are rejected, and each invalid entry is reported separately while valid entries are kept.

• Addresses: Use your network's actual outgoing (egress) IP, and include expected office IPs, VPN exit IPs, and remote locations. IPv4 and IPv6 ranges match only their own address type, so dual-stack networks need both; IPv4-mapped IPv6 addresses match IPv4 ranges.

• Saved ranges: Host addresses are converted to network addresses, and duplicates are removed, keeping first-occurrence order.

1. Open the admin portal → Settings → Organization → Universal controls.

2. Turn on the IP allowlist switch for initial setup, or select Configure for an enabled, unlocked list.

3. Enter CIDRs in Edit IP allowlist, separated by newlines, commas, or whitespace.

4. Select Save.

For initial setup, the switch stays off until you save a non-empty list; after saving, the label shows the saved CIDR count. Changes can take about a minute to affect access.

Restrictions apply to signed-in access, not anonymous use. If Flow cannot initially load the access rules or validate a saved list, restrictions are not applied. The editor's current-IP lookup keeps working even when other signed-in access is blocked.

If “IP allowlist (locked by Wispr)” appears, changes are disabled; contact support to unlock.

If a user sees “Your network isn't allowed”

Flow signs Mac and Windows users out when their network is unapproved or their IP cannot be determined, including accounts added through SCIM. The message names the organization when known.

1. Switch to an approved network.

2. Select Retry if the blocked screen remains; it reopens browser sign-in.

3. Complete sign-in if prompted.

The block clears automatically the next time a request to Wispr succeeds from an approved network; if you have not manually signed out, an allowed network may sign you straight back in. A still-disallowed network returns the blocked screen.

Sign Out instead clears the blocked screen and returns to normal sign-in. If the expected network is missing, ask your admin to review IP allowlist in Settings → Organization from an allowed network.

Still need help?

Contact Flow support if:

• You cannot identify the inspection layer.

• Your security team needs a DLP or data-handling review.

• An admin cannot reach an approved network.

Include your platform, device, security vendor, inspection layers changed, and error details. For data-handling information, review the Trust Center and Security and compliance FAQ.