Your voice never leaves your device
Whisper security and data handling summary. Source: https://get-whisper.com/security. Vendor details: https://get-whisper.com/imprint. Contact: hello@get-whisper.com.
Whisper transcribes 100% on your own machine — no audio upload, no subprocessors, no cloud to breach. For legal, healthcare, finance, and any team handling confidential information, that's not a feature. It's the whole point.
On-device by design
The speech model runs on your CPU/GPU. Audio and transcripts stay on the machine that recorded them.
No subprocessors
No servers, no third-party AI in the transcription path — so there's no vendor list for your security team to vet.
Works offline
After a one-time setup, Whisper needs no internet. Suitable for restricted and air-gapped environments.
What leaves your device — and what never does
We'd rather show you the exact data flow than ask you to trust a badge.
| Data | Leaves your device? | Detail |
|---|---|---|
| Your audio / recordings | Never | Transcribed on-device; never uploaded, never stored by us |
| Your transcribed text | Never | Stays on your machine (unless you opt into a cloud AI provider) |
| License key | Key check (no content) | Key and device ID at activation, then about once a day when online. No content |
| Model files | One-time download | One-time download of the speech model from our CDN |
| Update checks | Optional | A version check you can ignore or block |
Optional AI post-processing runs on-device by default. If you deliberately connect a cloud AI provider (e.g. OpenAI or Apple Intelligence) to reshape text, that step — and only that step — sends text to the provider you chose. It's off unless you turn it on.
Made for regulated and confidential work
Healthcare
PHI in your notes never leaves the device — removing the biggest exposure in most dictation workflows. Supports HIPAA-minded practices without a cloud BAA to negotiate.
Legal
Privileged and client-confidential dictation stays local. No third party ever sees the brief, the memo, or the matter.
Finance & Enterprise
Meets 'no data to the cloud' policies out of the box. GDPR exposure is minimal because we process none of your personal data server-side.
We're transparent: Whisper doesn't carry a SOC 2 or HIPAA certification badge. Instead it gives you an architecture where the sensitive data never leaves your control — which is what most reviews are really trying to guarantee.
For IT & procurement
- Standard installers — DMG (macOS), MSI (Windows), AppImage / deb / rpm (Linux).
- Activates with a license key — no per-user cloud account, no admin console to run.
- No inbound connections; outbound is limited to model download, license activation, and optional update checks — all blockable.
- Volume licensing for teams, with one invoice and one license key for the team, activated on each device up to your seat count.
Security FAQ
Does my audio or transcribed text ever leave my device?
No. All transcription runs on your own device using a local AI model. Your audio is never uploaded to our servers or any third party, and neither is the transcribed text. The only exception is optional: if you deliberately configure a cloud AI provider for post-processing, that text goes to the provider you chose — it is off by default and clearly labeled.
Are there any subprocessors that touch our data?
For transcription, none. Because the audio never leaves the device, there is no cloud pipeline and no subprocessor list to vet. This is the core difference from cloud dictation tools, which route your voice through their servers and third-party AI providers.
Does Whisper work offline / air-gapped?
Yes. Transcription needs no internet. The only times Whisper contacts the network are: a one-time model download, license activation and a license re-check about once a day when the computer is online (key and device ID only), and optional update checks. Without a connection it keeps working until your license end date, so it suits air-gapped and restricted environments.
Is Whisper HIPAA / GDPR compliant?
Compliance is a property of your workflow, not just a tool — but Whisper is built to support it. Because protected or personal data (the audio and its transcript) never leaves the device, Whisper removes the biggest source of exposure in most dictation workflows: cloud transmission and storage. We are transparent that we hold no certification badge; we give you an architecture where the sensitive data simply stays with you.
What exactly does the license activation send?
Your license key and a device ID: at activation, and again about once a day when the computer is online, so a refunded or revoked key stops working. No audio, no transcripts, no document content. If the check cannot reach us, Whisper keeps working. For teams that cannot allow any outbound calls, contact us about offline activation.
How do we deploy this across a team without a cloud admin console?
Whisper installs like any desktop app (DMG on macOS, MSI on Windows, AppImage/deb/rpm on Linux) and activates with a license key — no per-user cloud account, no admin portal to manage. Volume licenses are available for teams.
Talk to us about your team
Pilot, invoice, purchase order or a security questionnaire. We reply by email, usually within two business days.
Private dictation your security team will actually approve
On-device, offline, no subprocessors. A yearly license with no auto-renewal, and volume pricing for teams.