> ## Documentation Index
> Fetch the complete documentation index at: https://superwhisper.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Sensitive Data Best Practices

> Configure Superwhisper for healthcare, financial, and other regulated data. See where data goes with local models, cloud models, and enterprise controls.

Superwhisper can run with no audio or text leaving your device. Pair a local voice model with a local language model, and every stage of a dictation stays on your machine. This page shows where your data goes in each configuration, and how to lock it down for regulated work.

**Jump to:**

* [Maximum privacy: fully local configuration](#maximum-privacy-fully-local-configuration)
* [Cloud models: privacy commitments](#cloud-models-privacy-commitments)
* [Enterprise controls for regulated environments](#enterprise-controls-for-regulated-environments)
* [Recommended configurations for healthcare and sensitive data](#recommended-configurations-for-healthcare-and-sensitive-data)

***

## How your data flows

Every dictation in Superwhisper passes through two independent stages. Understanding this is the key to knowing exactly where your data goes, and where it doesn't.

**1. Stage 1: Voice to Text (Voice Model)**

Your recorded audio is transcribed into raw text. This can happen **entirely on your device** using a local voice model, or via a cloud voice service if you choose one.

**2. Stage 2: Text Post-Processing (Language Model)**

The raw transcript is refined, formatted, or transformed by a language model based on your mode's instructions. This stage is **optional**; modes without AI post-processing skip it entirely. When enabled, this can also run locally or via a cloud provider.

> [!NOTE]
>
> Each stage is independently configurable. You can mix and match, for example using a local voice model with a cloud language model, or keeping both fully local. You are in control at every step.

***

## Maximum privacy: fully local configuration

For the highest level of data protection, such as handling PHI (Protected Health Information) under HIPAA or confidential financial records, configure Superwhisper to run entirely on your device. In this setup, **no audio or text ever leaves your machine**.

### Local voice models

Select a local voice model to ensure audio is transcribed on-device. The following options are available:

| Model | Speed | Accuracy | Best for |
| - | - | - | - |
| Cohere Transcribe (Local) | Fast | Highest | The most accurate local model; first pick for sensitive work |
| Parakeet Multilanguage (Local) | Very fast | High | All-around workflows and dictation; the only local option on Windows ARM |
| Whisper Large v3 Turbo (Local) | Fast | High | A balance of speed and quality |

To change your voice model, open your mode settings and select from the local models listed under **Voice Model**.

> [!TIP]
>
> For sensitive environments, **Cohere Transcribe** is the recommended starting point. It's the most accurate local model and fast enough for clinical or professional workflows.

### Local language models

Superwhisper supports local language models on macOS and Windows, letting AI post-processing run entirely on your device. Local language model options are available directly in your mode's **Language Model** settings.

> [!NOTE]
>
> On Windows, local language models run on your GPU through Vulkan. Windows ARM (Snapdragon) devices don't support Vulkan yet, so they're limited to cloud language models or modes without AI post-processing.

### Transcription only (no AI post-processing)

If your workflow only requires accurate transcription, with no AI formatting or transformation, you can use the **Voice to Text** mode, which outputs raw transcribed text with no language model involved. This is the simplest fully-local configuration.

> [card] [Voice Models](https://superwhisper.com/docs/models/voice.md)
>
> Browse all local and cloud voice model options

> [card] [Voice to Text Mode](https://superwhisper.com/docs/modes/built-in.md#voice-to-text)
>
> Use transcription-only mode with no language model

***

## Cloud models: privacy commitments

When you use Superwhisper's cloud models, or cloud models from providers like Anthropic, OpenAI, Deepgram, or Groq, your data is processed via API calls. Here is what that means for your privacy:

### Superwhisper does not train on your data

Superwhisper accesses all third-party AI providers exclusively through API agreements that include **zero-data-retention** terms. This means:

* Your audio and transcribed text are **not used to train any AI models**
* Data is processed to return your result and is not retained by providers under these agreements
* This applies to all models available through your Superwhisper license, including S1-Voice, S1-Language, Claude, GPT, Groq, and Deepgram

> [!WARNING]
>
> **Zero Data Retention applies to API usage only.** These commitments apply when data flows through Superwhisper's API-based integrations, not when you use a provider's consumer product directly. For example, if you use Superwhisper to dictate text into the ChatGPT website or app, that content is governed by OpenAI's consumer terms, not their API data usage policy.

You can review each provider's data usage policy directly:

| Provider | Policy |
| - | - |
| Anthropic (Claude) | [Business Associate Agreements (BAA) for commercial customers](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers) |
| OpenAI (GPT) | [API data usage policy](https://openai.com/policies/api-data-usage-policies) |
| Deepgram | [API data usage policy](https://deepgram.com/privacy) |
| Groq | [API data usage policy](https://groq.com/privacy-policy) |

### Use your own API keys (BYOK)

If your organization has its own agreements, data processing addendums (DPAs), or BAAs (Business Associate Agreements) with AI providers, you can bring your own API keys. This routes your data through **your own account** with that provider, under your terms.

Bring Your Own Key (BYOK) is available to:

* **Individual Pro users:** configure custom API keys in your mode settings
* **Enterprise teams:** admins can configure organization-wide custom models with shared API credentials

> [!NOTE]
>
> When using your own API keys, Superwhisper acts as a client to your provider account. Data handling is governed by your agreement with that provider, not Superwhisper's. This is the recommended path for organizations with existing HIPAA BAAs or financial data compliance agreements.

To sign a DPA or BAA with Superwhisper:

> [card] [Sign your DPA or BAA](https://docuseal.com/d/ehxSh1xq5RTGHh)
>
> Sign a Data Processing Addendum (DPA) or Business Associate Agreement (BAA) with Superwhisper

> [card] [Enterprise Model Management](https://superwhisper.com/docs/enterprise/configuration.md)
>
> Configure custom models and API keys for your team

> [card] [Language Models](https://superwhisper.com/docs/models/language.md)
>
> View all available cloud language model options

***

## Enterprise controls for regulated environments

Enterprise administrators have additional controls to enforce data handling policies across their entire team.

### Restrict to approved models only

From the **Configuration** tab in your enterprise dashboard, you can disable Superwhisper's hosted cloud models entirely. When disabled:

* Members can only use local models or custom models you have explicitly configured
* No data flows through Superwhisper's cloud infrastructure
* You retain full control over which providers your organization uses

### Configure approved custom models

Set up specific models from your approved vendors, including private cloud deployments (e.g., Azure OpenAI, AWS Bedrock, or your own self-hosted endpoint), and make them available to all members automatically.

This is the recommended configuration for healthcare organizations, financial institutions, and any team operating under strict data residency or vendor approval requirements.

### Identity & access governance

Pair model controls with SSO and SCIM to ensure only authorized personnel access Superwhisper, with automatic provisioning and deprovisioning tied to your identity provider.

> [card] [Model Management](https://superwhisper.com/docs/enterprise/configuration.md)
>
> Restrict cloud models and add approved custom models

> [card] [SAML SSO](https://superwhisper.com/docs/enterprise/saml-sso.md)
>
> Set up single sign-on for your organization

> [card] [SCIM Provisioning](https://superwhisper.com/docs/enterprise/scim.md)
>
> Automate user provisioning and deprovisioning

> [card] [Enterprise Getting Started](https://superwhisper.com/docs/enterprise/getting-started.md)
>
> Overview of all enterprise features

***

## Recommended configurations for healthcare and sensitive data

| Use case | Voice model | Language model | Notes |
| - | - | - | - |
| Device only (air-gapped) | Cohere Transcribe (Local) or Parakeet Multilanguage (Local) | S1-mini (Local) | No data leaves the device |
| Healthcare | Nova Medical (Cloud), sign Superwhisper [BAA](https://docuseal.com/d/ehxSh1xq5RTGHh) | Sonnet 5 (Anthropic, Cloud), sign Superwhisper [BAA](https://docuseal.com/d/ehxSh1xq5RTGHh) or Bring Your Own Keys | Covered by Superwhisper's zero-data-retention API terms or external provider agreement |
| Enterprise-managed environment | Local or enterprise-approved | Enterprise-configured custom model | Admin controls which providers are permitted |
| Standard professional use | Local or cloud | Any cloud model | Covered by Superwhisper's zero-data-retention API terms |

***

## Does Superwhisper store my audio?

All transcription history is stored **locally on your device**, and FileSync syncs configuration data only, not transcription content or audio. See [Account and data deletion](https://superwhisper.com/docs/security/account-deletion.md) for what Superwhisper holds, or visit the [Trust Center](https://trust.superwhisper.com).

***

## Additional considerations

### Transcription history

All transcription history is stored **locally on your device**.

When FileSync is enabled, Superwhisper syncs your **configuration data** (such as modes and settings) across your devices via Superwhisper's infrastructure, but this does not include any transcription content or audio.

For sensitive environments, review your retention practices and [delete recordings](https://superwhisper.com/docs/get-started/history.md#delete-recordings) you no longer need.

### Meetings

[Meetings](https://superwhisper.com/docs/meetings/overview.md) use the same two stages: a voice model for the transcript and a language model for the summary. With local models for both, nothing leaves your Mac. Speaker separation always runs on your device. A [share link](https://superwhisper.com/docs/meetings/share.md#share-a-link) uploads only the summary text, title, and date, for 30 days. See [Private and offline meetings](https://superwhisper.com/docs/meetings/offline.md).

### Custom vocabulary

Text replacements are stored locally and applied on your device after transcription. Vocabulary words work differently: they're sent alongside your audio as recognition hints, so with a cloud voice model they reach that provider under the same zero-data-retention API terms. With a local voice model, vocabulary never leaves your device.

### Regulatory compliance disclaimer

This guide is intended to help you understand Superwhisper's technical capabilities and make informed configuration choices. It is not legal advice. Whether a given configuration satisfies HIPAA, GDPR, SOC 2, or other regulatory requirements depends on your specific implementation, agreements with providers, and organizational policies. Consult your compliance or legal team to validate your setup.

If your organization requires a signed DPA or BAA with Superwhisper, you can [sign them here](https://docuseal.com/d/ehxSh1xq5RTGHh). See [Compliance](https://superwhisper.com/docs/security/compliance.md) for the Trust Center and SOC 2 report.

***

## Support

To get help configuring Superwhisper for your compliance environment:

* **Enterprise inquiries:** [enterprise@superwhisper.com](mailto:enterprise@superwhisper.com)
* **General support:** [support@superwhisper.com](mailto:support@superwhisper.com)
* **Enterprise customers:** Request a dedicated Slack channel or schedule a call for personalized configuration guidance


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.