Six questions to ask any dictation vendor — including us

Last updated 11 September 2026

1. Where does transcription happen?

The only question whose answer changes everything else. There are exactly two answers and a lot of language designed to avoid giving either.

What a good answer looks like: "Recognition runs on your device." Or "Transcription always happens in the cloud" — which is Wispr Flow's own wording and is admirably direct.

What an evasive answer looks like: "Your data is processed securely." "We never store your audio." "Encrypted end to end." Each of those describes what happens after a transfer, and none of them answers the question.

2. Does it work with the network off?

You do not need to ask anyone this. Install it, complete the first run, turn Wi-Fi off, dictate. Words appearing means local recognition. Nothing happening means it was going somewhere.

This test is worth more than every other item on this page combined, because no marketing language survives it. Full method at does dictation upload your audio.

3. What is kept on my own disk, and for how long?

The question people forget, because "on-device" sounds like "nothing is kept". Most dictation apps keep a local history so a lost dictation can be recovered, and many keep the audio with it.

That is better than a server and it is not nothing. On a shared machine, a family computer or a laptop that travels, a year of dictated correspondence sitting in Application Support is a real exposure.

• Where does the history live? (Usually under ~/Library/Application Support/.)
• Is the audio kept too, or only the text?
• What is the default retention, and can I change it?
• How do I delete it?
• Is it included in my backups? (It is. Know where those go.)

4. Does the rewriting step also run locally?

The single most common leak in a privacy-first setup, and almost nobody checks it.

Many apps recognise speech locally and then send the resulting text to a cloud language model to tidy it up. The audio never left; the content of what you said did. For confidential work that distinction is academic — the words are the sensitive part.

Test it the same way: turn the network off and use the tidy-up. If it fails or silently does nothing, it is a cloud call. Ask specifically what the default is, because it is frequently on.

5. What does it send for licensing, updates and analytics?

An honest local app still uses the network for things unrelated to your words. Claiming otherwise is the sort of overstatement that discredits the real claim.

A vendor who can answer this precisely is telling you they have thought about it. A vendor who says "we don't collect anything" while their app makes requests is telling you something else.

6. What certifications do you actually hold?

Asked last because it is the one most likely to be answered misleadingly. "GDPR compliant" is a claim anyone can make about themselves. ISO 27001 and SOC 2 are audits with certificates and dates, and a vendor who holds one will name the auditor and the scope without hesitating.

Our answer: we hold none. Not ISO 27001, not SOC 2, not HIPAA-attested. Our security page says so in a section headed "What we are not". If your procurement requires a certification, an on-device architecture will not substitute for one and you should buy from a certified vendor.

The two questions people ask that do not help

• "Do you sell my data?" Everyone says no, and it has been true and meaningless for a decade. The question is whether they receive it.
• "Is it secure?" Unfalsifiable. Ask the specific version: what is transmitted, what is stored, where, and for how long.