Is Wispr Flow safe? A closer look at security and privacy

Yes, Wispr Flow protects your data with encryption, configurable privacy settings, and independent security audits. Our dictation service has completed SOC 2 Type II and ISO 27001 assessments, and you can control whether your dictations are stored in the cloud or used to improve our AI models.

Wispr Flow processes everything from quick messages to confidential work conversations. Here's what happens to that information, what the software can access, and how you can control it.

Does Wispr Flow record everything you say?

No. Wispr Flow's dictation feature only records when you activate it using your designated shortcut. It doesn't continuously record background conversations while you're working.

Wispr Flow Notetaker works differently because it's designed to capture meetings. It can detect when you join a meeting, but you must start Notetaker before recording begins. It captures audio through your computer rather than sending a recording bot into the call.

Wispr Flow Notetaker can automatically post a recording notice in supported meeting chats. You're responsible for obtaining any consent required by law or company policy.

Can Wispr Flow see what's on your screen?

Wispr Flow has a feature called Context Awareness that helps it understand what you're writing. For example, when you're drafting an email, it can use the recipient's name to spell it correctly. When you're writing in Slack, it can adapt the formatting to the conversation.

On Mac and Windows, Context Awareness uses relevant text from the active application rather than taking screenshots of your entire screen. The contextual information captured for a dictation is cleared when that dictation ends.

Context Awareness is enabled by default, but you can disable it under Settings → Data and Privacy. Even with the feature disabled, desktop dictation may use the app name and website domain to determine formatting. On iPhone, the keyboard uses context from the active text field and doesn't offer the same Context Awareness switch.

We recommend reviewing this setting if you regularly work with confidential documents or sensitive information.

How does Wispr Flow protect your voice data?

Wispr Flow uses cloud-based speech recognition. When you dictate, your audio is transmitted to our servers, processed into text, and returned to the application where you're writing.

We've implemented security protections throughout that process:

• Encryption in transit: Audio and other transmitted data are protected using TLS 1.2 or higher.
• Encryption at rest: Stored information is protected using AES-256 encryption.
• Restricted internal access: Production-system access is limited to authorized personnel, with access logging and multifactor authentication.
• Third-party protections: AI providers that process customer content operate under contractual privacy and security requirements.

Cloud processing means Wispr Flow isn't an entirely offline dictation tool. It also means the service isn't end-to-end encrypted in the strict sense, since our systems need to process your audio to generate a transcript.

You can review our security documentation in the Wispr Trust Center.

Does Wispr Flow use your data to train AI?

That depends on your privacy settings.

Wispr Flow has a setting called "Improve the model for everyone," which determines whether your dictation content and eligible Notetaker data can be used to evaluate and improve our AI models.

Here's how it works:

• Free and Pro: Model improvement is enabled by default, with an opt-out choice during onboarding. You can turn it off at any time.
• Growth: Organization administrators have controls for managing model improvement settings.
• Enterprise: Model improvement is disabled and cannot be enabled by users.
• Third-party AI providers: Our agreements prohibit these providers from using your content to train their own models.

You can review your available settings under Settings → Data and Privacy.

Turning model improvement off doesn't prevent Wispr Flow from processing your audio to provide transcription. It also doesn't automatically remove previously stored content. Model training, cloud processing, and cloud storage are separate operations.

Why do we offer optional model improvement?

Speech recognition has to handle accents, unusual names, technical vocabulary, and the corrections people make while speaking naturally.

We've used data from people who opted into sharing to develop and evaluate Canto, our speech recognition model.

You can benefit from Wispr Flow's speech recognition without contributing your own content to that training process.

When you voluntarily report a transcription problem or submit feedback, the associated session content may be retained and used to investigate the issue and improve the product. You can read the details in our Data Controls policy.

Does Wispr Flow store your recordings and transcripts?

You have direct control over persistent cloud storage for dictation. Meeting recordings and summaries follow a different retention process.

Dictation storage

The Dictation Cloud Storage setting determines whether Wispr Flow stores your dictated audio, transcripts, and history on our servers for features such as cross-device access.

When you disable this setting, your dictation audio is discarded after processing rather than persistently stored in the cloud.

On desktop, you can separately configure local dictation history to:

• Keep your dictation history on your device.
• Automatically delete local history after 24 hours.
• Never store dictation history locally.

Account information, usage metadata, and certain separately managed content may still be retained to operate the service.

Wispr Flow Notetaker storage

Notetaker stores meeting transcripts and summaries in the cloud so you can return to previous conversations, review decisions, and search your meeting history.

The audio itself has a shorter retention period. Uploaded meeting recordings are generally deleted seven days after upload, subject to processing delays. Local audio is also normally deleted after seven days, although an unfinished recording may be retained locally for up to 30 days to support recovery.

You can delete a meeting, including its transcript and summary, from Notetaker. Organizations may also enforce their own retention policies.

Before sharing meeting notes, check who can access the transcript. An email invitation may give recipients access to both the summary and transcript, while a public sharing link generally provides summary access. Copying a meeting link before configuring its permissions may enable "Anyone with the link" access, depending on your organization's defaults.

For details, see our Notetaker privacy and security overview.

Is Wispr Flow SOC 2 Type II and ISO 27001 certified?

Wispr Flow's dictation service has completed independent security assessments conducted by A-LIGN.

These include:

SOC 2 Type II: An independent audit of security-related controls over a defined assessment period. Our current report was issued on August 31, 2026, covering April 23 through July 23, 2026.

ISO/IEC 27001:2022: An internationally recognized standard for establishing and maintaining an information security management system. Wispr Flow holds a current certification issued by A-LIGN.

Both assessments cover Wispr Flow Dictation. Wispr Flow Notetaker launched after the applicable audit periods and was not assessed as part of those examinations.

For organizations conducting vendor due diligence, we make the relevant audit reports and supporting materials available through our Trust Center. Some documents require approval or a nondisclosure agreement.

Security audits provide independent evidence about the controls in place during their assessment periods.

Is Wispr Flow HIPAA-ready?

Wispr Flow offers HIPAA-ready dictation with a signed Business Associate Agreement (BAA).

Individual users can sign a BAA through the application, while eligible organizations can manage agreements and enforce privacy settings through their administrators. Notetaker is unavailable on accounts with an active BAA.

SOC 2 and ISO 27001 certifications don't establish HIPAA compliance. For healthcare use, the signed BAA and the features it covers are what matter.

See our HIPAA support documentation for configuration details.

How to make Wispr Flow more private

If you want to reduce how much information Wispr Flow retains or uses, start with Settings → Data and Privacy.

We recommend reviewing these four controls:

1. Improve the model for everyone: Turn this off if you don't want your content used to improve our AI models.
2. Dictation Cloud Storage: Disable persistent cloud storage if you don't need your dictation history available across devices.
3. Context Awareness: Disable it on desktop if you don't want Wispr Flow reading relevant text from your active application to improve recognition.
4. Local Data Storage: Choose whether your computer keeps dictation history, deletes it after 24 hours, or never stores it.

You can also request a download of your stored information or delete eligible content directly from the desktop application's Data and Privacy settings. Organization retention requirements may limit which information you can remove.

For teams, Wispr Flow Enterprise provides additional administrative controls, including enforced privacy settings, single sign-on, user provisioning, and audit logs.

Is Wispr Flow safe for confidential work?

Wispr Flow provides encryption, configurable data storage, and independently audited security controls for Dictation. However, sensitive work may require specific privacy settings or organization-level safeguards.

Review our Trust Center for security reports and check Settings → Data and Privacy to configure how your information is handled.

‍