Security and privacy overview

Last updated: October 16, 2026

Available on: Mac, Windows, iOS, Android

Wispr Flow processes dictated audio in the cloud to turn speech into text. This overview covers the privacy controls you can change, how your data is protected, and the documents available for a security review.

For current audit reports and supporting policies, visit the Wispr Trust Center. For a specific requirement or contract question, contact security@wispr.ai or your account representative.

Control how your data is used and stored

Find these in Settings → Data and Privacy. Model improvement and Dictation Cloud Storage are separate settings; changing one does not change the other.

Control

What it governs

Improve the model for everyone

Whether Notetaker and dictation content may be used to improve Wispr's models.

Dictation Cloud Storage

Whether dictation data is stored on Wispr's servers; dictation only, not Notetaker or Scratchpad.

Download your data

Requests a copy of your dictations, meetings, notes, and settings.

Improve the model for everyone is on by default for Free and Pro, with the choice shown during onboarding, and you can turn it off; it is off for Enterprise and administrators cannot re-enable it. Turning it off stops your content from being used to improve Wispr's models; it does not turn off Dictation Cloud Storage or delete local history. Wispr's third-party AI providers may not use your data to train their models, whatever your model-improvement setting. For current definitions, see Data Controls.

Organization policies or a signed Business Associate Agreement may lock settings, and a member cannot relax an admin-managed setting. If your organization has specific storage or deletion requirements, confirm the enforced settings and covered products with your administrator or account representative. Each choice is saved to your account, so it follows you across devices and restarts and applies only to the account you are signed in to.

Warning: Read deletion confirmations before accepting them. Treat deletion as permanent.

Download a copy of your data

On Mac and Windows, go to Settings → Data and Privacy and use Download your data.

  1. Select Request a copy. Wispr emails a confirmation and starts preparing the export.

  2. Wait for the second email saying the export is ready. While it is being prepared, you can select Cancel request.

  3. Select Download and choose where to save the single ZIP file, up to 2 GB.

The status line under the row shows the request state — preparing, ready until a given date, expired, failed, or cancelled. An export stays available for 30 days; after that Download disappears and you can select Request a new copy.

Note: If a request is refused, the status line explains why — for example your organization has turned export off, a request is already in progress, you requested one too recently, or your account is being deleted. If you are told your account is too large to export, contact support rather than retrying.

What the export contains

  • Dictation history: One entry per dictation, showing its latest version. Dictations you deleted are not included.

  • Meetings: Meeting records, including summaries, language, recording length and speaker details.

  • Notes and settings: Scratchpad notes and your account preferences.

An export covers only what is stored, so it cannot include dictation history that was never retained on Wispr's servers, and local history on one device is not a complete record of activity across all your devices. For contractual retention periods, deletion confirmation, or an export at the end of your agreement, contact your account representative.

What privacy settings do not remove

  • Account data: Account information, preferences, and subscription details are kept to provide the service.

  • Dictionaries and snippets: Content you create is stored and synced separately from dictated content.

  • Diagnostics and usage records: Resetting your account from the hub clears local usage records.

  • Reported transcripts: Submitting a transcript through Report or another feedback action sends that content to Wispr, which retains it and can use it to train and evaluate its models.

  • Notetaker recordings: Transcripts and summaries are stored in Wispr's cloud and Dictation Cloud Storage does not govern them. Meeting audio uploaded to Wispr is kept for 7 days from upload to support troubleshooting and speaker attribution, then deleted; transcripts and summaries remain. Improve the model for everyone does apply to Notetaker as well as dictation. For organization retention requirements, contact your administrator or account representative.

  • Scratchpad notes: On Mac and Windows, notes are stored in Wispr's cloud when cloud sync is on for your account; if cloud sync is off, the Notes page shows that syncing is unavailable. An organization turning Scratchpad off also stops note sync.

Encryption and access protection

Wispr encrypts service data in transit and at rest. It is not end-to-end encrypted in the strict sense, because the service must process audio to produce a transcript. Wispr manages service encryption keys; customer-managed keys are not supported.

Access to production systems is restricted and logged, and support access to account details is separate from access to stored customer content. Passwords are stored as hashes rather than plaintext, and employee access to sensitive systems requires multifactor authentication.

Organizations can use SAML single sign-on on Growth and Enterprise; with SSO, your identity provider controls its MFA policy. Enterprise adds controls such as SCIM user management, audit logs, and managed deployment. See the plan comparison for the controls included in your subscription, and request detailed control documentation through the Trust Center.

Compliance reports and healthcare use

The Trust Center provides Wispr's SOC 2 Type II report, the ISO/IEC 27001:2022 certificate, the earlier SOC 2 Type I report, penetration-test information, policies, and other security-review materials; restricted documents may require approval and an NDA. It also handles vendor security questionnaires and data processing addendum requests.

Note: Wispr Flow dictation is the in-scope system for the SOC 2 examinations and the service assessed in the ISO 27001 certification audit. Meeting Notetaker launched after those audit periods and was not assessed in the SOC 2 Type I, the SOC 2 Type II, or the ISO 27001 certification audit.

HIPAA-ready dictation requires a signed Business Associate Agreement (BAA). Authorized Growth and Enterprise admins manage organization agreements in the admin portal; individual and organization agreements have different management controls.

Important: A signed personal or organization BAA blocks Notetaker recording. Revoking a BAA can change enforced data settings, and an organization policy or another active BAA may still apply. Review the agreement and your settings before changing it.

Data location, subprocessors, and your rights

Wispr Flow is a cloud service, not an on-premise deployment, and it processes and stores customer data in the United States. Review your DPA and its transfer terms if your organization has regional requirements.

Wispr does not sell your data. Subprocessors provide parts of the service under contractual privacy and security obligations; the Trust Center holds the current subprocessor list and supporting documents.

Request account deletion from Settings → Data and Privacy. The Privacy Policy explains how personal information is handled and how to make a rights request.

Still need help?