Security

You speak to Wisper the way you think: unfiltered, in progress, sometimes confidential. Protecting that is a core part of the product, not a feature on top of it. This page explains how we approach security and how to reach us if you find a problem.

Our principles

• Collect less. The safest data is data we never keep. Audio is deleted once your text is produced unless you choose otherwise, and we don't collect your content for anything beyond providing the Service.
• Encrypt everywhere. Data is encrypted in transit and at rest, without exceptions for internal traffic.
• Least privilege. People and systems get only the access they need, for only as long as they need it.
• Secure by default. The safest settings are the default ones. Saving recordings and contributing to AI improvement are both off until you turn them on.
• Be transparent. When something goes wrong, we tell the people affected, quickly and plainly.

Protecting your voice and text

• Encryption in transit. All connections to Wisper use TLS 1.2 or higher. This website enforces HTTPS with HTTP Strict Transport Security (HSTS).
• Encryption at rest. Stored data, including saved recordings, transcripts and backups, is encrypted with AES-256 using keys managed by our cloud provider's key management service.
• Ephemeral audio. By default, recordings exist only for as long as it takes to process them.
• Isolation. Each customer's data is logically separated, and every request is authorised against the account that owns the data.
• No training by default. Your content is never used to train AI models unless you opt in. See our Privacy Policy.

Infrastructure

Wisper runs on established cloud infrastructure providers whose data centres maintain recognised physical and environmental controls. Production systems sit in private networks, and only the services that must be public are exposed. Where AI processing runs with a third-party provider, it is under contracts that prohibit the provider from retaining your content or training on it.

Access control

• Access to production systems requires single sign-on with multi-factor authentication.
• Access is granted on a least-privilege basis, reviewed regularly and removed promptly when no longer needed.
• Access to customer content is restricted to a small number of people, is only permitted for the narrow reasons set out in our Privacy Policy, and is logged.
• Secrets such as API keys are kept in a dedicated secrets manager, never in source code.

Secure development

• Every change to production code is peer-reviewed before it ships.
• Dependencies are tracked and automatically scanned for known vulnerabilities, and critical issues are patched as a priority.
• Security headers, including a strict frame policy, MIME-sniffing protection and a restrictive permissions policy, are set on every response from this site.
• We design new features with a privacy and threat review, so security is part of the plan rather than an afterthought.

Monitoring and incident response

We log and monitor security-relevant events across our systems and alert on suspicious activity. We maintain an incident response process with defined roles, escalation paths and post-incident reviews.

If an incident affects your personal data, we will notify you without undue delay, along with any regulators the law requires, including the Data Protection Board of India. We will explain what happened, what data was involved and what we are doing about it.

Availability and backups

Critical data is backed up automatically and encrypted, and we regularly test that backups restore. Our systems are designed to tolerate the failure of individual components without losing your data.

Keeping your account secure

• Passwords are never stored in plain text. They are hashed with a modern, salted algorithm.
• You can sign in with supported identity providers instead of a password.
• We will never ask for your password by email, phone or chat.
• If you notice activity you don't recognise, contact security@wisper.in immediately.

Compliance

We design Wisper to meet the requirements of India's Digital Personal Data Protection Act, 2023 and the EU and UK GDPR. As Wisper grows, we will publish information about independent security assessments on this page as they are completed. Teams customers can request our security documentation at security@wisper.in.

Reporting a vulnerability

We value the work of security researchers. If you believe you have found a vulnerability in Wisper, please tell us so we can fix it.

How to report. Email security@wisper.in with:

• a description of the issue and its potential impact;
• step-by-step instructions to reproduce it, including any proof-of-concept code;
• the affected URLs, app versions or components;
• how you would like to be credited, if at all.

Our commitments to you. We will:

• acknowledge your report within 2 business days;
• give you an initial assessment within 5 business days;
• keep you updated as we work on a fix;
• credit you once the issue is resolved, if you wish.

Safe harbour. We will not pursue or support legal action against you for research that follows this policy. Please act in good faith:

• avoid privacy violations, data destruction and service disruption;
• only access the minimum data needed to show the issue, and never other users' content;
• give us reasonable time to fix the issue before disclosing it publicly;
• don't use social engineering, phishing or physical attacks, and don't run denial-of-service tests.

Out of scope. Findings without a demonstrated security impact, such as missing best-practice headers on non-sensitive pages, self-XSS, clickjacking on pages with no sensitive actions, rate-limit or spam reports for non-sensitive forms, reports from automated scanners without validation, and vulnerabilities in third-party services that we don't control.

Our machine-readable contact details are published at /.well-known/security.txt, as defined in RFC 9116.

Contact

• Report a vulnerability or security concern: security@wisper.in
• Privacy questions: privacy@wisper.in