Vendor security assessments, questionnaires, and security calls

Available on: Web (Wispr Trust Center)

Completed vendor security assessments, questionnaires, and security review calls are reserved for Enterprise customers and prospects, and require a signed NDA. On other plans, the Wispr Trust Center answers most assessment questions directly.

Who can request a completed assessment or a security call

Enterprise customers and prospects working with our sales team: Wispr's security team completes assessments and questionnaires once Trust Center access is granted and the NDA is signed; security review calls are arranged through your account manager or Enterprise contact.
Pro, Pro for Teams, and Growth: Use the published Trust Center documentation to answer assessment items. Wispr does not complete assessments or arrange security calls on these plans.

Without a Wispr sales contact, reach the Enterprise team through Talk to Sales.

Get access to the Trust Center

Note: Anyone with a work email can request access, and our security team reviews every request. Access to documentation is separate from eligibility for a completed assessment or a security call.

Go to the Wispr Trust Center.
Click Request Access and enter your work email.
Sign the NDA when prompted. It is built into the access flow, with no separate paperwork.
Review the published security documentation once your request is approved.

Submit a questionnaire (Enterprise)

Sign in to the Wispr Trust Center with your approved account.
Click Submit a Questionnaire in the top-right.
Upload your file, or paste your vendor portal or assessment link.
Wait for our security team to follow up once your completed assessment is ready.

Support cannot complete or return assessment documents.

Request a security review call (Enterprise)

Security review calls, diligence calls, and control walkthroughs with your InfoSec team are arranged by your account manager or Enterprise contact, who coordinates the right people from our side. Support cannot schedule or confirm these calls.

Contact your Wispr account manager or Enterprise contact directly, or start with Talk to Sales if you do not have one.
Tell them what you would like covered and who from your side will attend, so the right people join.
Request Trust Center access in parallel, so your review is not waiting on scheduling.

Note: Most security review questions are already answered in the Trust Center documentation, which often removes the need for a call.

What the Trust Center already answers

Once access is granted, this documentation often covers questionnaire items without a manual response.

Attestations and certifications

SOC 2 Type II report (A-LIGN) covering the Security, Availability, and Confidentiality Trust Services Criteria together with HIPAA and HITECH requirements, with an unqualified opinion and no exceptions noted in the tests of controls.
ISO/IEC 27001:2022 certificate (A-LIGN) for Wispr's information security management system, maintained through annual surveillance audits with recertification on a three-year cycle; the Statement of Applicability is available under NDA.
SOC 2 Type I report (A-LIGN, Security criterion, unqualified opinion), the earlier report, still available.
Penetration test executive summary and remediation report from an independent third party, performed at least annually.

Legal and data protection

Data Processing Addendum (DPA), including the EU Standard Contractual Clauses, the UK Addendum, and Annex III subprocessors.
Business Associate Agreement (BAA) for healthcare customers, and Records of Processing Activities (ROPA).

Policies and architecture

ISMS policy suite, including Information Security, Access Control, Business Continuity and Disaster Recovery, Incident Response, and SDLC.
AI Policy, Data Classification Policy, Data Handling Policy, Data Retention and Disposal Policy, and data flow architecture.

The Privacy Policy, the current subprocessor list, and public security disclosures are published without an access request.

Note: Wispr Flow dictation is the in-scope system for the SOC 2 examinations and the service assessed in the ISO 27001 certification audit. Meeting Notetaker launched after those audit periods and was not assessed in the SOC 2 Type I, the SOC 2 Type II, or the ISO 27001 certification audit.

FAQs

Can I get a Transfer Impact Assessment (TIA)?

Under the Standard Contractual Clauses framework, the data controller, which is your organization, completes the TIA. Wispr provides supporting materials through the Trust Center: the DPA with the EU SCCs and Annex III, the SOC 2 Type II report, and factual detail on our security controls and data minimization.

Still need help?

Email security@wispr.ai with your organization name and the assessment you are working through if:

You cannot create or sign in to your Trust Center account. Include the error message and the step where you are blocked.
Your assessment covers something not addressed in our documentation.