> ## Documentation Index
> Fetch the complete documentation index at: https://superwhisper.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance & Trust

> Find the Superwhisper Trust Center and sign a DPA or BAA. Review our security and compliance documentation.

Superwhisper supports teams operating under HIPAA, GDPR, SOC 2, and other regulated frameworks. Here's where to find our documentation and how to sign the right agreements.

## Trust Center

Our Trust Center hosts security documentation, certifications, and our sub-processor list.

> [card] [Visit the Superwhisper Trust Center](https://trust.superwhisper.com)
>
> Browse certifications, policies, security questionnaires, and sub-processors.

Request access to SOC 2, penetration test reports, and other gated documents through the Trust Center.

## Sign a DPA or BAA

Most enterprise customers sign a Data Processing Addendum (DPA) at contract time. Healthcare customers handling PHI also sign a Business Associate Agreement (BAA).

> [card] [Sign your DPA or BAA](https://docuseal.com/d/ehxSh1xq5RTGHh)
>
> Self-serve signing for Superwhisper's DPA and BAA.

The DPA contains the full list of sub-processors Superwhisper uses.

## HIPAA

Configure Superwhisper for HIPAA-aligned workflows. The path depends on which models you use:

* **Local-only setup:** No audio or transcripts leave the device. No BAA required with Superwhisper for those models.
* **Superwhisper cloud models:** Sign Superwhisper's BAA. Superwhisper's API integrations with upstream providers include zero-data-retention terms.
* **Bring Your Own Keys (BYOK):** Sign a BAA directly with the upstream provider (Anthropic, OpenAI, etc). Superwhisper acts as a client to your provider account.

See [Sensitive Data Best Practices](https://superwhisper.com/docs/security/sensitive-data.md) for how data flows through each stage and which models fit each path.

## Is Superwhisper SOC 2 compliant?

Our latest SOC 2 report is available through the [Trust Center](https://trust.superwhisper.com) under NDA.

## Does Superwhisper sign a BAA?

Healthcare customers handling PHI can [sign Superwhisper's BAA](https://docuseal.com/d/ehxSh1xq5RTGHh), and the [HIPAA](#hipaa) section shows which setups need one.

## Does Superwhisper offer a DPA?

Most enterprise customers sign a Data Processing Addendum (DPA) at contract time, and you can [sign it here](https://docuseal.com/d/ehxSh1xq5RTGHh).

## GDPR

Superwhisper processes personal data on behalf of customers under the terms of the [DPA](https://docuseal.com/d/ehxSh1xq5RTGHh). For data subject requests or account deletion, see [Account & Data Deletion](https://superwhisper.com/docs/security/account-deletion.md).

## Telemetry & analytics

Enterprise admins can review exactly what metadata Superwhisper collects when usage analytics is enabled. See [Usage Analytics](https://superwhisper.com/docs/enterprise/usage-analytics.md) for the full data inventory and how to disable collection.

## Questions

Email [enterprise@superwhisper.com](mailto:enterprise@superwhisper.com) for security reviews, custom DPAs, or other compliance questions.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.