The documents
What the product does with data
OpenWhispr records audio when a user presses a hotkey, turns it into text, and puts that text at their cursor. Where the audio goes depends entirely on the processing mode, and four of the five keep it away from our servers:
On OpenWhispr Cloud we store the transcript text and technical metadata. We
do not store audio — it’s processed in the request and discarded. Where your
voice and text go has the detail, including
the fact that custom-dictionary terms travel with cloud requests.
Data residency: the United States, for us and our sub-processors. Transfers
out of the EEA, UK and Switzerland run on adequacy where it exists and the
Standard Contractual Clauses otherwise.
AI training: never, on any of it, and our providers are held to the same —
Section 3 of the DPA.
Network
- Outbound only, TLS on 443. Everything else it runs binds to your own machine by design.
- System proxies and PAC scripts are honoured, on all three platforms.
- Allowlist by hostname, not IP — provider addresses change without notice.
- The full host list, split by what’s required and what’s optional, is in network allowlist. That’s the page to hand a firewall administrator.
Endpoint security
- API keys and enterprise credentials are encrypted through the OS keychain — Keychain, DPAPI, libsecret — and never sent to us.
- On Linux with no keyring available, Electron falls back to plaintext. Make sure a keyring is installed and unlocked on managed Linux fleets. How OpenWhispr is secured explains the constraint.
- Local history is an ordinary SQLite file in the user’s application-data folder, protected by the OS account and full-disk encryption rather than by a second layer of our own.
- The app auto-updates from GitHub release artifacts.
Retention
Retention is set per device, and users can reach it under Settings → Privacy & Data under System. Defaults: audio deleted after 30 days, transcripts kept until deleted, history on, cloud backup off. If your policy is “nothing on disk”, the setting to turn off is Data Retention — text is still pasted, nothing is saved. See what OpenWhispr stores, and for how long.Central administration
Business and Enterprise workspaces can have an administrator policy applied, covering which transcription and AI modes are permitted, which providers may be used, external link sharing, retention limits, cloud-backup permission, and a minimum app version. It’s applied to your workspace by us rather than configured on a settings screen today. Email support@openwhispr.com and describe the restrictions you need.Compliance posture
Stated precisely, because reviewers check:- SOC 2 Type 2 — audit complete, observation period passed, final report available under NDA once issued.
- HIPAA and GDPR — attestations held (2026, through our compliance platform). A BAA is required before any PHI goes through the cloud service; see HIPAA and healthcare use.
- ISO 27001:2022 — programme aligned, all 93 Annex A controls implemented, certification audit not yet undertaken.