Wispr Flow

Name: Wispr Flow business-data verdict
Item: Wispr Flow
Author: Aaron Simmons

Wispr

Careful

Last checked 10 Nov 2026 · Reviewed by Aaron Simmons, security practitioner · How we decide

Wispr says it uses your audio, transcripts, and edits to train models only if you allow "Improve the model for everyone," and that any user can turn that off. On Growth and Enterprise the control is off by default and locked. If dictation cloud storage is off, audio is discarded once it is transcribed. Notetaker audio is kept encrypted for a short period that is not given as a number of days. The pages we read do not describe a voice-cloning product. A personal account is Careful until you confirm that training control.

Data-safety checklist

Trains on your data by default

Unknown

Wispr says training covers dictation and Notetaker audio, transcripts, and edits when "Improve the model for everyone" is allowed. It says that on Growth and Enterprise this is off by default and locked, including in the Enterprise MSA and DPA. It does not say whether other plans start with the control on or off. Third-party model providers are described as not training on that data.

How to opt out

Steps

Turn off "Improve the model for everyone." Wispr says that after it is off, nothing you say is used to train its models. Turn off dictation cloud storage if you do not want transcripts and audio stored on Wispr servers. Local history can be stored, deleted every 24 hours, or never stored.

Data retention

What they keep

With dictation cloud storage off, audio is discarded once it is transcribed. Notetaker audio is retained encrypted for a short period so a meeting can be resumed and transcription quality checked. Wispr does not state that period in days. It says third-party providers generally delete customer content within 30 days. Meeting transcript retention can be set under Settings, Data and Privacy.

BAA / HIPAA

Enterprise only

On Growth and Enterprise, an admin can accept a business associate agreement in the admin portal. Wispr says that covers dictation and Notetaker for the organization, and that accepting it turns off Scratchpad and MCP connectors. Other plans are not described as covered.

Certifications

1 listed

SOC 2 Type II

Enterprise and admin controls

Controls

Growth and Enterprise training is off and locked. Enterprise training is also enforced in the MSA and DPA. Admins can set storage and retention. Wispr says members can choose stricter settings than the organization. The privacy page says SOC 2 Type II, audited by A-LIGN, covers every Wispr product on every plan. ISO 27001 is described as recommended, with the certificate still pending.