Skip to main content
Enterprise mode sends AI cleanup and agent requests directly from the OpenWhispr desktop app to your organization’s cloud account. OpenWhispr does not proxy the prompt or response.

​
Managed company access

Managed access is available to active Enterprise workspaces. IT connects company SSO and SCIM, establishes workload trust in AWS or Microsoft Entra, validates it in the admin portal, and chooses the permitted models once. Business and Pro workspaces continue using their ordinary sign-in and manual provider flows; stale Enterprise SSO settings are not enforced after a downgrade. For an employee, the flow is:
  1. Open OpenWhispr and choose company SSO.
  2. Finish sign-in in the browser.
  3. The workspace and team assignments appear automatically.
  4. Bedrock or Azure OpenAI is already selected for every feature the administrator configured.
There is no AWS CLI login, cloud API key, role ARN, tenant ID, or model name for the employee to enter. The desktop exchanges a short-lived OpenWhispr assertion for temporary access and keeps cloud credentials in memory only. See managed Amazon Bedrock and Azure OpenAI for the complete administrator setup.

​
Existing manual setup

The original enterprise flow remains available for individual testing and gradual migrations. An employee can use an AWS SSO profile, the standard AWS credential chain, AWS access keys, or an Azure API key when the workspace administrator allows manual setup. Open Settings > AI Models > Language Models, choose a feature tab, then select Enterprise and the provider.
Enter an AWS profile or access keys, region, and model ID. If the profile uses AWS IAM Identity Center, run aws sso login --profile <name> before testing the connection.OpenWhispr resolves the profile through the standard AWS SDK credential chain.Model IDs are region-aware: the suggested list uses the cross-region inference profile prefix (us., eu., or apac.) that matches your selected region, and changing the region rewrites an already-picked model to the new geography. Select Browse all models to load your account’s full Bedrock catalog live — resolved against your own credentials and region, so a picked model is always invocable — or enter a custom model ID for anything not in the list.

​
Suggested Bedrock models

Enable model access for these in the AWS Bedrock console before selecting them. Managed workspaces get their allowlist from the administrator instead.
Managed by default keeps existing manual users on their chosen setup while giving unconfigured employees the company provider. Managed required disables the manual path for the workspace.

​
Features and defaults

Enterprise models are chosen per capability. A managed administrator supplies a default for all five so a new employee does not see an incomplete setup. In manual mode, changing one capability does not change the others.

​
Credential handling

Managed AWS credentials last up to 15 minutes. Azure tokens use the expiry returned by Microsoft. They are held in the desktop main process, are never exposed to the page interface, and are cleared when the account, workspace, provider configuration generation, or authorization changes. Manual keys entered in OpenWhispr are encrypted through Electron safeStorage, backed by Keychain on macOS, DPAPI on Windows, and libsecret on Linux. They are never sent to OpenWhispr’s servers.
On Linux without an installed and unlocked keyring, Electron can fall back to plaintext secret storage. Use managed access or configure a system keyring on managed Linux devices.

​
Troubleshooting

The connection test surfaces these with copy-paste remediation commands where applicable.