Is Wispr Flow safe to use?

Wispr Flow is reasonably safe, with two caveats you control. The company encrypts audio on the way to its servers, deletes it once it is transcribed unless you ask it to keep it, and has been audited against SOC 2 and ISO 27001. The caveats: your voice always leaves your device, and on Free and Pro the settings that let Wispr train on your data and store your dictations start switched on. Switch them off in Settings > Data and Privacy and the main risks shrink considerably. Facts below come from Wispr's own pages, read on October 27, 2026.

The wider picture is in our guide to Wispr Flow: price, privacy and what users say.

Every dictation is processed in the cloud, so safety means trusting Wispr's servers

Wispr says transcription always happens in the cloud ¹. Audio is captured on your device after you press the shortcut and sent to Wispr over an encrypted connection, TLS 1.2 or later ². That is how a cloud dictation app works, and it is the root of every privacy question about the app. An on-device app has no equivalent exposure because the audio never travels.

Wispr also passes content to third-party AI providers. Its privacy policy says those providers may process customer content to provide the service ³, that they are not allowed to use it to train their models ⁴, and that it is generally deleted within 30 days ⁵.

Audio is deleted after transcription unless you turn on cloud storage

By default Wispr deletes your audio as soon as it is transcribed, unless you have turned on Dictation cloud storage ⁶. The catch is that the help center says that switch, along with the training switch, defaults to on unless your plan or organization restricts it ⁷. Anything Wispr does store is protected with AES-256 encryption ⁸.

Does Wispr Flow train on your data? Yes by default on Free and Pro, and you can stop it

The honest answer is that it can. Improve the model for everyone is on by default for Free and Pro, and Wispr uses what it collects to improve its models. Turn it off and the company says nothing you say is used to train it ¹¹. On Growth and Enterprise plans, training is off by default and locked ¹².

Two settings are independent: turning off training does not turn off cloud storage, and the reverse. To keep audio off Wispr's servers, switch both off. Local history on your own computer is separate and you can keep it, delete it after 24 hours, or never save it ¹³.

Context awareness reads limited text from your screen

When context awareness is on, Wispr reads limited text from the app you are dictating into so names and jargon come out right ¹⁴. Turn it off and the app transcribes without reading anything on your screen ¹⁵. Standard password fields are never read ¹⁶ and banking apps are skipped ¹⁷. But Wispr warns that custom or web-based password fields may be read like ordinary text ¹⁸. See how other apps compare in our question on whether AI dictation reads your screen.

Audits exist, but a report is not proof that your use is safe

Wispr's Trust Center provides a SOC 2 Type II report and an ISO/IEC 27001:2022 certificate ¹⁹. Those cover dictation. Its Notetaker meeting product launched after the audit periods and was not assessed ²⁰. Reports are not public, so we have not read them. The company also says it never sells your data and that its business is selling software ²¹. Its App Store label does list identifiers and usage data as data that may be used to track you across other companies' apps ²². That label does not list audio or dictated text as tracking data.

HIPAA: a signed agreement is required, and it is not a compliance guarantee

Wispr Flow is not HIPAA compliant out of the box. Any user can sign a business associate agreement to enable HIPAA support for dictation on any plan, and accepting it turns off Notetaker and Scratchpad ²³. A signed BAA also locks both data-sharing controls off ²⁴. A BAA is a contract. Your practice still needs its own policies, access controls and risk assessment. Read our guide to HIPAA-compliant dictation and the list of dictation apps that are HIPAA compliant. This is not legal advice.

It depends on what you dictate

• Emails, notes, code prompts. The default setup is a normal risk for a cloud app. Turning off training and storage is a sensible five-minute step.
• Client, patient or legal material. Sign the BAA if you are a covered entity, turn both settings off, or choose an app that keeps audio on your machine. Our question on whether on-device dictation is HIPAA compliant explains why that removes a whole category of risk.
• Work you must not send out at all. Use on-device speech recognition. Wispr has no offline mode, as covered in whether Wispr Flow works offline.

What to do today

1. Open Settings > Data and Privacy and turn off Improve the model for everyone and Dictation cloud storage.
2. Turn off context awareness if you dictate near sensitive on-screen text.
3. Set local history to delete after 24 hours or never save.
4. If you handle health data, sign the BAA before dictating anything.

Yap, which we make, runs recognition on your Mac or Windows PC; see our Wispr Flow alternative comparison. For wider context, read whether free AI dictation is private and the guide to voice data retention.