Aqua Voice and HIPAA: what Aqua states, what to confirm, and where your speech goes
By Ryleigh Newman · Published
Aqua Voice's FAQ answers the question directly: yes, it says it is HIPAA compliant, and that its program builds on the controls behind its SOC 2 Type II report and ISO 27001 certification. The same answer adds a condition. Before using Aqua with protected health information, it says to contact support to confirm which products and plans are covered, go through any required settings, and discuss the terms of a Business Associate Agreement.
I built YapToText, a dictation app for the Mac, so read what I say about Aqua Voice with that in mind. Every fact about Aqua Voice here comes from its own FAQ and user guide at aquavoice.com, read on October 11, 2026.
I make no compliance claims about any app, mine included. This page reports what Aqua says. Whether that satisfies your obligations is for your organization and its counsel.
This app is completely free. You don't have to make an account. There are no subscriptions, no difficult downloads, and nothing is locked. Made for Apple silicon Macs. Source on GitHub.
What Aqua states
From Aqua Voice's FAQ, read October 11, 2026.
| Claim | Aqua's wording, in short |
|---|---|
| HIPAA | Yes, with a program built on its SOC 2 Type II and ISO 27001 controls |
| SOC 2 | It has a SOC 2 Type II report. It notes that SOC 2 is an audit report, not a certification |
| ISO 27001 | Certified |
| GDPR | Yes, with a data inventory, privacy risk assessments, vendor agreements and procedures for data requests |
| Where to verify | Its Trust Center, to request the SOC 2 report or ISO certificate and review subprocessors |
What to confirm before patient information goes in
- Which products and plans are covered. Aqua's answer says to confirm this with support.
- The settings that have to be on. The FAQ mentions Privacy Mode enforcement on Team plans.
- The Business Associate Agreement. Aqua says to discuss BAA terms. A vendor's statement of compliance does not replace a signed agreement.
- Your own side: who can dictate, on which devices, into which systems.
A yes on a FAQ is the start of the question, not the end of it. The FAQ itself routes you to support before any protected information is used.
Where your speech goes
Aqua is a cloud service. Its FAQ says cloud dictation needs an internet connection, and when I read its site on October 5, 2026, every plan processed speech in Aqua's cloud. On a managed network it uses HTTPS and secure WebSockets on port 443 to Aqua's own hosts. Its Business plan lists Zero Data Retention among its features. The Aqua Voice privacy page covers what its policy says about audio and text.
How other dictation apps answer
Each vendor puts the line somewhere different. Wispr Flow and superwhisper have their own pages here, each from that maker's statements. Medical dictation on a Mac sets the options side by side without making claims for any of them.
The on-device route, and its limits
YapToText, the free app I built, does speech recognition and cleanup on the Mac. There is no account, no analytics, and the only network use is a model download you start yourself. That describes how the software behaves. It is not a compliance statement: I offer no BAA, no audit report and no team controls, because it is one person's free project. If your organization requires a signed agreement from a vendor, an app without one does not meet that requirement, however it handles audio.
This app is completely free. You don't have to make an account. There are no subscriptions, no difficult downloads, and nothing is locked. Made for Apple silicon Macs. Source on GitHub.
The short version
- Aqua's answer. Yes, it says it is HIPAA compliant.
- Its condition. Confirm covered plans, settings and a BAA with support first.
- Evidence. SOC 2 Type II report and ISO 27001, through its Trust Center.
- Architecture. Cloud.
- Your call. Your organization decides.
If Aqua changes its statements, open an issue on GitHub and I will update this page. Every one gets read.
This app is completely free. You don't have to make an account. There are no subscriptions, no difficult downloads, and nothing is locked. Made for Apple silicon Macs. Source on GitHub.
Related
Sources
- https://aquavoice.com/info/faq (checked 2026-10-11)
- https://aquavoice.com/pricing (checked 2026-10-11)
- https://github.com/ryleighnewman/YapToText (checked 2026-10-11)
- https://apps.apple.com/us/app/yaptotext/id6786382289 (checked 2026-10-11)
Questions
Is Aqua Voice HIPAA compliant?
Aqua's FAQ says yes, and tells you to contact support first to confirm covered products and plans, required settings and Business Associate Agreement terms.
Does Aqua Voice sign a BAA?
Its FAQ says to contact support to discuss Business Associate Agreement terms before using Aqua with protected health information.
Is Aqua Voice SOC 2 certified?
Aqua says it has a SOC 2 Type II report, and notes that SOC 2 is an audit report, not a certification. It also says it is ISO 27001 certified.
Does Aqua Voice process speech on the device?
It is a cloud service. Its FAQ says cloud dictation needs an internet connection.