Without security, Whisperit wouldn't exist.

Your documents, transcriptions, and case data are stored on Swiss infrastructure in ISO 27001-certified data centres, under Swiss law and outside US CLOUD Act jurisdiction. Where AI processing happens depends on the residency tier your firm is on, which is set out in the next answer and in full in the technical data flow document.

Yes. We operate three residency tiers. Swiss Only routes every AI feature through a Swiss-hosted provider and never falls back to another jurisdiction: if that provider is unavailable, the request fails rather than rerouting. EU routes through an EU-based provider. Global adds a further international fallback. Your tier is configured per tenant and does not change without your request.

No AI provider we use trains on your data; our data processing agreements prohibit it. Retention is provider-specific and documented: the Swiss provider deletes data once processing completes, and the EU provider keeps nothing beyond the duration of the API call. The Swiss Only and EU tiers never reroute assistant traffic to another jurisdiction, while the Global tier adds an international fallback for availability. Deep research, which reaches OpenAI in the US, is opt-in and transmits only your search query, never document contents. The full provider-by-provider picture is in the technical data flow document.

We comply with the EU GDPR and the Swiss nFADP, and we act as data processor for your client data. SOC 2 Type II is currently in audit with an accredited third-party assessor, and ISO 27001 is on our roadmap.

AES-256 for data at rest and TLS 1.3 in transit. Encryption keys are managed per tenant and never shared between customers, and data is isolated between firms. Whisperit staff cannot read your documents.

Processing is governed by Swiss law and the nFADP, with role-based access so each team member sees only the matters they need. Audit logs record every access, edit, and export. Our staff are bound by confidentiality obligations under our terms, and access to client data is limited to authorised personnel.

You alone hold the rights to your data. During your contract you can request a free export at any time in JSON, CSV, PDF, or the original native format, with documentation of the export schema. After termination you have three months to request your data before we are authorised to destroy it. Write to legal@whisperit.ai for any data request.

Our terms oblige us to keep confidential everything we learn in the course of working with you, and not to disclose it to third parties without your express authorisation. Sub-processors are published, contractually bound, and listed with the role each one performs, so you can see exactly who can touch your data.

Model routing is configured per tenant by us rather than exposed in the interface, so it cannot be changed accidentally. You can request a different configuration, and we will honour it provided the provider meets the same data protection guarantees. Letting firms select a compliant model directly is on our roadmap; we would rather say that plainly than imply it already ships.

Swiss law governs the contract, with jurisdiction at our registered office in Prilly, Switzerland. That places your data under one of the strictest privacy regimes in the world and gives you a predictable forum, independent of US disclosure regimes.