Análise do Wispr Flow: O melhor software de ditado por IA para Mac, Windows e dispositivos móveis?

A newer setting, Local data storage, controls how your dictation transcripts are kept on your own devices, and applies across all of them. Notetaker transcripts are managed separately.

Watch the defaults. On the Free and Pro plans, “Improve the model for everyone” is on until you switch it off, so your dictation data can be used to improve Wispr’s models. On Enterprise, it’s off and locked.

Mais alguns fatos sobre segurança que vale a pena conhecer:

• HIPAA-ready dictation requires a signed Business Associate Agreement (BAA). Individuals can sign one in the desktop app, and Growth and Enterprise admins can sign one for the whole organization. Signing permanently switches off model training and dictation cloud storage for the account. According to Wispr’s docs, it also blocks Notetaker from recording.
• A Wispr nunca vende seus dados. O modelo de negócios da empresa baseia-se em assinaturas de software.
• A situação da certificação sofreu uma mudança significativa em março de 2026. Consulte a seção abaixo.

O status da certificação da Wispr mudou em março de 2026

Em março de 2026, uma investigação iniciada por um denunciante alegou que a Delve, uma startup de automação de conformidade apoiada pela Y Combinator, havia produzido relatórios SOC 2 padronizados em grande escala. Uma planilha vazada teria mostrado que 493 dos 494 relatórios de auditoria eram praticamente idênticos, contendo os mesmos parágrafos e os mesmos erros gramaticais, com apenas o nome da empresa alterado. A Y Combinator removeu a Delve de seu diretório no início de abril de 2026.

A Wispr foi atingida pelo impacto. Para seu crédito, a resposta foi a correta. De acordo com o próprio FAQ de segurança da Wispr, a empresa invalidou proativamente suas certificações SOC 2 Tipo II (Accorp Partners) e ISO 27001 (Gradient) em março de 2026 “devido a preocupações com a integridade da plataforma por parte do auditor original” e, em seguida, reconstruiu tudo do zero com a A-LIGN como auditora e a Drata como sua plataforma de conformidade.

Where things stand as of October 2026:

• SOC 2 Tipo I: concluído em abril de 2026 pela A-LIGN, parecer favorável sem ressalvas
• SOC 2 Type II and ISO 27001:2022: Wispr’s security FAQ now says both are available through its Trust Center. It doesn’t publish the issue dates or audit periods, so ask for them
• Scope: the audits cover Flow dictation. Wispr says Meeting Notetaker was not assessed
• HIPAA: BAA available for individuals and organizations. Signing it permanently switches off model training and dictation cloud storage, and blocks Notetaker from recording
• Testes de penetração: realizados pela última vez em novembro de 2025 pela BSK Security LLC, com base na metodologia da OWASP

Throwing out a certification you already hold because you don’t trust the auditor is the expensive, correct call, and most companies wouldn’t make it. One loose end: Wispr’s separate compliance help page still lists the old ACCORP Type II report and a Gradient ISO 27001 certificate that expired on September 7, 2026. If your procurement process needs a current SOC 2 Type II, request the new reports from Wispr’s Trust Center rather than relying on the help pages, and check whether Notetaker is in scope if you plan to use it.

O Wispr Flow captura imagens da sua tela?

This claim circulates widely, usually in the form “Wispr screenshots your active window every few seconds.” Wispr’s current documentation says otherwise.

Per Wispr’s Context Awareness help page (checked October 2026), the feature “works from text and does not take screenshots.” When it’s on, which it is by default, Flow reads text from the app you’re dictating in to improve formatting and proper-noun accuracy: the text around your cursor, on-screen text, file and variable names in coding apps, and conversation history. On a Mac it needs accessibility permissions.

Password field contents are never read, though Wispr notes that custom or web-based password fields may be treated as normal text. With model training and dictation cloud storage both switched off, any captured context is stripped server-side and not persisted.

So the accurate version: Wispr reads on-screen text by default and doesn’t take screenshots. That is still a meaningful amount of context leaving your machine, and if you work under NDA or handle privileged material you should turn Context Awareness off entirely in Settings under Data and Privacy. But “it silently screenshots you every few seconds” is not what the documentation describes, and several sites repeating that claim sell competing dictation tools.

One legitimate concern that third-party reviewers like Letterly have raised is that Wispr Flow’s early privacy policy was vague and created distrust, particularly around what “context collection” meant and which third-party providers were handling audio. Wispr has since made this much clearer, but if you’re in a regulated industry, it’s still worth reading the Privacy and Security docs before committing to a paid plan.

Quem garante a arquitetura de segurança?

Vale a pena destacar também o outro lado da moeda: a ex-CISO Rinki Sethi, que já trabalhou na Bill.com, no Twitter e na Rubrik, endossou publicamente a arquitetura da Wispr e afirma ter implantado o Flow em toda a organização na Upwind Security. O motivo que ela apresentou foi que “onde os dados estão armazenados, como se movimentam e quem pode acessá-los” eram questões que podiam ser respondidas com clareza, o que não é comum entre as ferramentas de IA. Esse é um apoio significativo vindo de alguém cujo trabalho consistia em dizer “não” aos fornecedores.

The honest summary for professionals: if you work in healthcare, law, or finance, switch off “Improve the model for everyone” and dictation cloud storage, sign the BAA (knowing it disables Notetaker), and turn off Context Awareness. If you’re a writer, marketer, or knowledge worker handling non-sensitive content, switching off model training on any plan is more than adequate.