superwhisper and HIPAA: what its docs say about BAAs, local models and SOC 2
By Ryleigh Newman · Published
superwhisper's docs describe three paths for work under HIPAA, and which one applies depends on the models you choose. With local models only, no audio or transcript leaves the device, and superwhisper says no BAA with it is required for those models. With its cloud models, you sign superwhisper's BAA. With your own provider keys, you sign a BAA with that provider. No app makes a practice compliant by itself, so read this as a map of the paperwork, not a verdict.
I built YapToText, a dictation app for the Mac, so read what I say about superwhisper with that in mind. Every fact about superwhisper here comes from its own docs, read on October 11, 2026.
This app is completely free. You don't have to make an account. There are no subscriptions, no difficult downloads, and nothing is locked. Made for Apple silicon Macs. Source on GitHub.
The three paths
From superwhisper's docs, Compliance and Trust, read October 11, 2026.
| Setup | What the docs say | Agreement |
|---|---|---|
| Local only | No audio or transcripts leave the device | No BAA required with superwhisper for those models |
| superwhisper's cloud models | Its API integrations with upstream providers include zero data retention terms | Sign superwhisper's BAA |
| Your own provider keys | superwhisper acts as a client to your provider account | Sign a BAA directly with that provider |
A fully local configuration
The docs describe every dictation as two stages, each set per mode: a voice model that turns audio into text, and an optional language model that rewrites it. For the highest protection they say to run both on the device.
- Voice model. Pick a local one in the mode's settings. The docs list Cohere Transcribe, which they call the most accurate local model and the first pick for sensitive work, Parakeet Multilanguage and Whisper Large v3 Turbo.
- Language model. Local language models are available on macOS and Windows in the mode's Language Model settings.
- Or no language model at all. The Voice to Text mode outputs the raw transcript with no language model, which the docs call the simplest fully local configuration.
The superwhisper offline page covers local use in general.
What the cloud commitments cover
superwhisper says it reaches third-party AI providers only through API agreements with zero data retention terms, and that audio and text sent that way are not used to train AI models. It adds a warning worth repeating: that applies to its API integrations, not to a provider's consumer product. If you dictate into a chat website, what you type there falls under that website's own terms.
SOC 2, DPA and GDPR
- SOC 2. The latest report is available through superwhisper's Trust Center under NDA, with penetration test reports and other gated documents.
- DPA. Most enterprise customers sign a Data Processing Addendum, which lists its sub-processors. It can be signed online.
- GDPR. superwhisper says it processes personal data on behalf of customers under the DPA.
- Questions. Security reviews and custom agreements go to [email protected].
Dictation with no vendor in the middle
There is another way to look at the first path. If speech never leaves your computer, there is no outside company in the dictation step to sign with. YapToText works only that way: its speech model and its cleanup model run on the Mac, there is no account, and I receive nothing you say. That does not make a setup compliant by itself, and I will not claim it does. Your Mac, the record system you type into, the history any app keeps on disk and your organization's policies all still count. The medical dictation guide goes through the settings I would look at first, and the superwhisper privacy page covers its data handling in general.
This app is completely free. You don't have to make an account. There are no subscriptions, no difficult downloads, and nothing is locked. Made for Apple silicon Macs. Source on GitHub.
The short version
- Local models only. Nothing leaves the device. No BAA with superwhisper for those models.
- Its cloud models. Sign its BAA.
- Your own keys. A BAA with the provider.
- SOC 2. In its Trust Center, under NDA.
- Remember. An app is one part of compliance, not all of it.
If superwhisper changes its compliance terms, open an issue on GitHub and I will update this page. Every one gets read.
This app is completely free. You don't have to make an account. There are no subscriptions, no difficult downloads, and nothing is locked. Made for Apple silicon Macs. Source on GitHub.
Related
Sources
- https://superwhisper.com/docs/security/compliance (checked 2026-10-11)
- https://superwhisper.com/docs/security/sensitive-data (checked 2026-10-11)
- https://github.com/ryleighnewman/YapToText (checked 2026-10-11)
- https://apps.apple.com/us/app/yaptotext/id6786382289 (checked 2026-10-11)
Questions
Is superwhisper HIPAA compliant?
Its docs describe HIPAA-aligned setups: local-only models with nothing leaving the device, or cloud models with a signed BAA. Compliance also depends on the rest of your practice.
Does superwhisper sign a BAA?
Yes. Its docs say healthcare customers handling PHI can sign superwhisper's BAA online.
Do I need a BAA to use superwhisper locally?
Its docs say a local-only setup, where no audio or transcripts leave the device, requires no BAA with superwhisper for those models.
Is superwhisper SOC 2 compliant?
Its docs say the latest SOC 2 report is available through its Trust Center under NDA.
Does superwhisper train on my dictation?
It says data sent through its API integrations is covered by zero data retention terms and is not used to train AI models.