Configure your network for Wispr Flow

If downloads are blocked, dictation is slow on your corporate network, or you need to limit access to approved networks, configure the controls below. Firewall rules and your organization's IP allowlist are separate: allowing a hostname through your firewall does not add that network to the IP allowlist.

Allow outbound access to websites and downloads

If your organization restricts outbound traffic, allow these domains:

For Windows MDM deployments (Intune, Fleet, and similar), https://dl.wisprflow.ai/windows/msi/latest always points to the current machine-wide MSI, so you do not need to update a versioned link for each release. Wispr must enable this link for your organization first — confirm with your Wispr contact before relying on it.

Fix slow dictation caused by SSL/TLS inspection

Flow respects system proxy settings and organizational root certificates, including TLS inspection, for dictation, uploads, and SSO session management. Dictation requires valid, self-signed root certificates in macOS System Roots or the Windows root store; malformed or intermediate-only corporate certificates can fail even when other connections work.

Networks that do not intercept the connection do not need this bypass.

1. Create an SSL/TLS-inspection bypass on outbound port 443 for the complete wildcard destination list. Use wildcard rules such as *.wisprflow.ai rather than exact hostnames; that wildcard alone is insufficient, so contact support@wisprflow.ai for the full list.

2. Apply the bypass wherever inspection runs.

3. Save a permanent policy covering relevant offices, VPN egress points, and remote-user policies. The policy does not need reapplying per user, device, or session.

4. Test dictation from the affected network once the policy has propagated. If dictation is faster, the change is working; if not, contact support.

Restrict organization access to approved networks

IP allowlist controls require an Enterprise plan, admin permissions, and enablement by Wispr. Include expected office IPs, VPN exit IPs, and remote locations.

• Entries: Up to 64 IPv4/IPv6 CIDRs are accepted; invalid entries, empty lists, 0.0.0.0/0, and ::/0 are rejected.

• Saved ranges: Host addresses are converted to network addresses, and duplicates are removed, keeping first-occurrence order.

• Save requirements: Flow must detect your current IP, and the proposed list must cover it when setting or editing ranges.

1. Open the admin portal → Settings → Organization → Data Controls.

2. Select Configure beside IP allowlist.

3. Enter CIDRs one per line or comma-separated in Edit IP allowlist.

4. Select Save. Changes can take about a minute to affect access.

If “IP allowlist (locked by Wispr)” appears, changes are disabled; contact support to unlock.

If a user sees “Your network isn't allowed”

Flow signs Mac and Windows users out when their network is unapproved or their IP cannot be determined, including accounts added through SCIM. The message names the organization when known and directs users to switch networks or contact their admin.

1. Switch to an approved network.

2. Select Retry to reopen browser sign-in. An allowed network may sign you straight back in, which clears the lockout; a still-disallowed network returns the blocked screen.

Sign Out instead clears the blocked screen and returns to normal sign-in. If the expected network is missing, ask your admin to review IP allowlist in Settings → Organization from an allowed network.

Still need help?

Contact Flow support if:

• You cannot identify the inspection layer, or dictation stays slow after the rule propagates.

• Your security team needs a DLP or data-handling review.

• An admin cannot reach an approved network.

Include your platform, device, security vendor, inspection layers changed, and error details. For data-handling information, review the Trust Center and Security and compliance FAQ.