Vendor security assessments, questionnaires, and security calls

Last updated: November 6, 2026

Available on: Web (Wispr Trust Center)

Completed vendor security assessments, questionnaires, and security review calls are reserved for Enterprise customers and prospects, and require a signed NDA.

Who can request a completed assessment or a security call

  • Enterprise customers and prospects working with our sales team: Wispr's security team completes assessments and questionnaires once Trust Center access is granted and the NDA is signed.

  • Free, Pro, Student, and Growth: Use the published Trust Center documentation to answer assessment items. Wispr does not complete assessments or arrange security calls on these plans.

Get access to the Trust Center

Note: Anyone with a work email can request access, and our security team reviews every request. Access to documentation is separate from eligibility for a completed assessment or a security call.

  1. Go to the Wispr Trust Center.

  2. Click Request Access and enter your work email.

  3. Sign the NDA when prompted — it is built into the access flow, with no separate paperwork.

  4. Review the published security documentation once your request is approved.

On Enterprise, two admin portal shortcuts open the Trust Center in a new tab. On other plans they are disabled, so use the steps above.

Admin portal location

Shortcut

On other plans

Settings → Privacy

SOC 2 and HIPAA compliance

Disabled, tooltip “Upgrade to Enterprise plan to access”.

Settings → Organization → Data controls

SOC 2 open-link icon

Disabled, tooltip “Upgrade to Enterprise plan to use this feature”.

Submit a questionnaire (Enterprise)

  1. Sign in to the Wispr Trust Center with your approved account.

  2. Click Submit a Questionnaire in the top-right.

  3. Upload your file, or paste your vendor portal or assessment link.

  4. Wait for our security team to follow up once your completed assessment is ready. Support cannot complete or return assessment documents.

Request a security review call (Enterprise)

Security review calls, diligence calls, and control walkthroughs with your InfoSec team are arranged by your account manager or Enterprise contact, not by support.

  1. Contact your Wispr account manager or Enterprise contact. Without a sales contact, use Talk to Sales, or Help → Contact sales on desktop, which opens your email app to enterprise@wisprflow.ai.

  2. Tell them what you would like covered and who will attend from your side, so the right people join.

  3. Request Trust Center access in parallel, so your review is not waiting on scheduling.

Documentation and scope

  • SOC 2 Type II report (A-LIGN) covering the Security, Availability, and Confidentiality Trust Services Criteria plus HIPAA and HITECH requirements, with an unqualified opinion and no exceptions noted in the tests of controls.

  • ISO/IEC 27001:2022 certificate (A-LIGN) for Wispr's information security management system, maintained through annual surveillance audits with recertification every three years; the Statement of Applicability is available under NDA.

  • Data Processing Addendum (DPA), including the EU Standard Contractual Clauses, the UK Addendum, and Annex III subprocessors.

No access request is needed for the current subprocessor list, public security disclosures, or the Privacy Policy, Terms of Service, Data controls page, and Data Processing Addendum, which are also linked from the admin portal's Privacy page.

Note: Wispr Flow dictation is the in-scope system for the SOC 2 examinations and the ISO 27001 certification audit. Meeting Notetaker launched after those audit periods and was not assessed in the SOC 2 Type I, the SOC 2 Type II, or the ISO 27001 certification audit.

FAQs

Can I get a Transfer Impact Assessment (TIA)?

Under the Standard Contractual Clauses framework, the data controller — your organization — completes the TIA. Wispr provides supporting materials through the Trust Center: the DPA with the EU SCCs and Annex III, the SOC 2 Type II report, and factual detail on our security controls and data minimization.

Is a Business Associate Agreement (BAA) available?

Yes — for healthcare customers on the Growth and Enterprise plans, and Flow is HIPAA-ready with a signed BAA. An organization admin signs it in the admin portal; the org-wide HIPAA row is disabled on other plans and for non-admins, marked “Available on Growth and Enterprise”. If you previously signed a personal BAA, your desktop app still shows “HIPAA enabled”, where you can download or permanently revoke it — you cannot sign a personal BAA again.

Still need help?

Email security@wispr.ai with your organization name and the assessment you are working through if:

  • You cannot create or sign in to your Trust Center account — include the error message and the step where you are blocked.

  • Your assessment covers something not addressed in our documentation.

Important: Vulnerability reports use a different process. Our Vulnerability Disclosure & Bug Bounty Program does not accept submissions emailed to a security@ inbox; all submissions must come through the vulnerability report form. See the public Vulnerability Disclosure & Bug Bounty Policy for scope, safe harbor, and rewards; neither the policy nor the form requires an access request.