> ## Documentation Index > Fetch the complete documentation index at: https://docs.openwhispr.com/llms.txt > Use this file to discover all available pages before exploring further. # Answering a security review > Everything an IT or security team usually asks about OpenWhispr, in one place — with the documents to attach. This is the page to send when someone asks you to justify OpenWhispr to your security team. It collects the answers and the documents in one place, so you're not assembling them from five tabs. If something here doesn't cover what your reviewer asked, email [support@openwhispr.com](mailto:support@openwhispr.com) — we answer security questionnaires. ## The documents | Document | Where | | ----------------------------------------------------------- | ---------------------------------------------------------- | | Data Processing Addendum, including the sub-processor annex | [openwhispr.com/dpa](https://openwhispr.com/dpa) | | Privacy Policy | [openwhispr.com/privacy](https://openwhispr.com/privacy) | | Security overview | [openwhispr.com/security](https://openwhispr.com/security) | | Terms of Service | [openwhispr.com/terms](https://openwhispr.com/terms) | | Trust centre — live controls and sub-processors | [trust.openwhispr.com](https://trust.openwhispr.com) | | SOC 2 Type 2 report | Under NDA, once issued — ask support@ | ## What the product does with data OpenWhispr records audio when a user presses a hotkey, turns it into text, and puts that text at their cursor. Where the audio goes depends entirely on the processing mode, and **four of the five keep it away from our servers**: | Mode | Audio destination | Our cloud involved? | | ------------------ | ------------------------------------ | ------------------- | | Local | The device | No | | Self-Hosted | Your own server | No | | Bring your own key | The provider you contract with | No | | Enterprise | Your own cloud account (AWS Bedrock) | No | | OpenWhispr Cloud | Our API, then a model provider | Yes | On OpenWhispr Cloud we store the **transcript text** and technical metadata. We do not store audio — it's processed in the request and discarded. [Where your voice and text go](/help/privacy/where-your-data-goes) has the detail, including the fact that custom-dictionary terms travel with cloud requests. **Data residency:** the United States, for us and our sub-processors. Transfers out of the EEA, UK and Switzerland run on adequacy where it exists and the Standard Contractual Clauses otherwise. **AI training:** never, on any of it, and our providers are held to the same — [Section 3 of the DPA](https://openwhispr.com/dpa). ## Network * **Outbound only, TLS on 443.** Everything else it runs binds to your own machine by design. * **System proxies and PAC scripts are honoured**, on all three platforms. * **Allowlist by hostname, not IP** — provider addresses change without notice. * The full host list, split by what's required and what's optional, is in [network allowlist](/help/it/network-allowlist). That's the page to hand a firewall administrator. ## Endpoint security * API keys and enterprise credentials are encrypted through the OS keychain — Keychain, DPAPI, libsecret — and never sent to us. * On Linux with no keyring available, Electron falls back to plaintext. Make sure a keyring is installed and unlocked on managed Linux fleets. [How OpenWhispr is secured](/help/privacy/how-openwhispr-is-secured) explains the constraint. * Local history is an ordinary SQLite file in the user's application-data folder, protected by the OS account and full-disk encryption rather than by a second layer of our own. * The app auto-updates from GitHub release artifacts. ## Retention Retention is set per device, and users can reach it under **Settings** → **Privacy & Data** under **System**. Defaults: audio deleted after **30 days**, transcripts kept until deleted, history **on**, cloud backup **off**. If your policy is "nothing on disk", the setting to turn off is **Data Retention** — text is still pasted, nothing is saved. See [what OpenWhispr stores, and for how long](/help/privacy/what-we-store-and-for-how-long). ## Central administration Business and Enterprise workspaces can have an **administrator policy** applied, covering which transcription and AI modes are permitted, which providers may be used, external link sharing, retention limits, cloud-backup permission, and a minimum app version. It's applied to your workspace by us rather than configured on a settings screen today. Email [support@openwhispr.com](mailto:support@openwhispr.com) and describe the restrictions you need. ## Compliance posture Stated precisely, because reviewers check: * **SOC 2 Type 2** — audit complete, observation period passed, final report available under NDA once issued. * **HIPAA** and **GDPR** — attestations held (2026, through our compliance platform). A BAA is required before any PHI goes through the cloud service; see [HIPAA and healthcare use](/help/privacy/hipaa-and-healthcare). * **ISO 27001:2022** — programme aligned, all 93 Annex A controls implemented, certification audit not yet undertaken. ## Reporting a vulnerability [security@openwhispr.com](mailto:security@openwhispr.com), or GitHub's private vulnerability reporting. Not a public issue, please. ## Related * [Network allowlist](/help/it/network-allowlist) * [How OpenWhispr is secured](/help/privacy/how-openwhispr-is-secured) * [GDPR and your data rights](/help/privacy/gdpr-and-your-data-rights) * [HIPAA and healthcare use](/help/privacy/hipaa-and-healthcare) * [Enterprise providers](/guides/enterprise)