// Trust & Security Report
Whisper
by OpenAI OpCo, LLC (contracting as OpenAI Ireland Ltd. for EEA/Swiss customers)
Whisper is OpenAI's speech-to-text (ASR) technology, distributed in three distinct forms with different security postures: (1) the open-source Whisper model/weights (MIT license, self-hosted, no data sent to OpenAI), (2) the hosted Whisper endpoints on the OpenAI API platform (audio transcription/translation, pay-per-use), and (3) Whisper-family models powering voice features inside ChatGPT (Free/Plus/Team/Enterprise/Edu). The vendor entity behind all three is OpenAI.
Certifications held
12
Maturity
Enterprise
Trains on your data
Unknown
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on trust.openai.com“Our products are covered in our SOC 2 Type 2 report and have been evaluated by an independent third-party auditor to confirm that our controls align with industry standards for security, confidentiality, privacy and availability.”
Verify on trust.openai.com“Party Dependence Yes Hosting Major Cloud Provider Reports Data Flow Diagram SOC 3 Report Network Diagram View more Access Control Access Log Management Bring Your Own Device (BYOD) Data Access View”
Verify on trust.openai.com“This certificate documents OpenAI's operation an Information Security Management System that conforms to the requirements of ISO/IEC 27001:2022 for OpenAI's API, ChatGPT Enterprise, and ChatGPT Edu services.”
Verify on trust.openai.com“Our products are also ISO 27001, 27017, 27018, and 27701 certified.”
Verify on trust.openai.com“Our products are also ISO 27001, 27017, 27018, and 27701 certified.”
Verify on trust.openai.com“Our products are also ISO 27001, 27017, 27018, and 27701 certified.”
Verify on trust.openai.com“IEC 27018:2019 ISO/IEC 27701:2019 SOC 2 SOC 2 Type 2 SOC 3 TX-RAMP FedRAMP 20x ISO/IEC 42001:2023 OpenAI is trusted by Morgan Stanley PwC Robinhood Square Zendesk Amgen Bain & Company Datadog JetBlue Airways”
Verify on trust.openai.com“and visit Bugcrowd to participate. Compliance CCPA PCI DSS v4.0.1 CSA STAR GDPR ISO/IEC 27001:2022 ISO/IEC 27017:2015 ISO/IEC 27018:2019 ISO/IEC 27701:2019 SOC 2 SOC 2 Type 2 SOC 3 TX-RAMP FedRAMP”
Verify on trust.openai.com“the program and visit Bugcrowd to participate. Compliance CCPA PCI DSS v4.0.1 CSA STAR GDPR ISO/IEC 27001:2022 ISO/IEC 27017:2015 ISO/IEC 27018:2019 ISO/IEC 27701:2019 SOC 2 SOC 2 Type 2 SOC 3 TX-RAMP”
Verify on trust.openai.com“FedRAMP 20x (badge listed in the trust portal's compliance section). Scope on the public overview page is not broken out per-product; FedRAMP authorizations at OpenAI have historically applied to government-specific offerings rather than the general-availability API.”
Verify on trust.openai.com“TX-RAMP (badge listed in the trust portal's compliance section; Texas state government risk and authorization management program).”
> Show 1 unconfirmed / not-held certifications
source: trust.openai.comThe vendor's pages state this for a different product or company, not for this product.
// Privacy & AI training
Trains on customer data
Not stated
Data processing agreement
Offered
Data region
Self-hosted open-source Whisper: fully user-controlled, no data leaves user infrastructure. API/ChatGPT: processed on OpenAI's cloud infrastructure; OpenAI Ireland Ltd. is the contracting/processing entity for EEA and Swiss data with Standard Contractual Clauses governing onward transfers; no Whisper-specific regional data-residency option was found in public documentation.
Training posture differs by product tier. For the API platform (which hosts the Whisper transcription/translation endpoints) and ChatGPT Team/Enterprise/Edu, OpenAI processes Customer Data only per customer instructions under the executed DPA, and multiple independent secondary sources report that API and business data is not used to train models unless the customer explicitly opts in. Free and Plus ChatGPT (which also surface Whisper-based voice features) have a different, less protective default and historically may use conversations to improve models unless the user opts out in settings; the 'no training' claim does not extend to that tier. The open-source Whisper model runs entirely on the user's own infrastructure, so no OpenAI training-on-your-data question applies. Third-party reporting (Basil AI, Nov 2025) alleges the Whisper API's 'zero data retention' marketing claim is inconsistent with an actual retention window of about 30 days for abuse monitoring; OpenAI's own current wording on this point is not independently confirmed.
// Security controls
Independent audit coverage
SOC 2 Type II and SOC 3 reports cover OpenAI's API platform, ChatGPT Enterprise, and ChatGPT Edu; free/Plus ChatGPT is explicitly excluded per independent secondary reporting (not itemized on the trust portal overview itself).
trust.openai.comISMS certification
ISO/IEC 27001:2022 Information Security Management System certified for OpenAI's API, ChatGPT Enterprise, and ChatGPT Edu services, extended with ISO 27017 (cloud), ISO 27018 (PII in cloud), and ISO 27701 (privacy) control sets.
trust.openai.comSub-processor transparency
A public sub-processor list is maintained and customers are notified of additions with a 30-day objection window under the DPA.
cdn.openai.comBreach notification
DPA commits OpenAI to notify customers "without undue delay after becoming aware of any Personal Data Breach."
cdn.openai.comEncryption specifics
The DPA commits generically to "reasonable and appropriate organizational and technical security measures... as set forth in the Agreement" without stating a specific algorithm. Specific claims seen in secondary write-ups (e.g., AES-256 at rest, TLS 1.2+ in transit) are not confirmed on a vendor-owned page.
cdn.openai.comSelf-hosted model (open-source Whisper)
No OpenAI-side security controls apply because no data is transmitted to OpenAI; the security posture of a self-hosted deployment is entirely the responsibility of the organization running it.
github.com// Products & data scope
Data it handles: None sent to OpenAI; runs entirely on the user's own hardware/infrastructure via local inference.
MIT-licensed code and weights, installable via `pip install openai-whisper` / GitHub. No OpenAI certification applies or is needed since no OpenAI infrastructure is involved; security is fully the deploying organization's responsibility.
Data it handles: Audio input and transcription/translation output are sent to and processed on OpenAI's servers; per secondary reporting, retained for up to approximately 30 days for abuse and misuse monitoring, then deleted; not used for model training by default.
Part of the general-availability OpenAI API platform. Trust-portal certifications (SOC 2 Type II, ISO 27001/27017/27018/27701) describe coverage of 'OpenAI's API' as a whole; Whisper's specific endpoints are not separately named on the public trust-portal page, so coverage is a reasonable inference rather than an explicit vendor statement.
Data it handles: Voice input is processed as part of the broader ChatGPT conversation; data handling and training defaults differ sharply by plan.
ChatGPT Team, Enterprise, and Edu are covered by SOC 2/ISO certifications and are not used for model training by default. Free and Plus ChatGPT are not covered by SOC 2 per independent reporting, and conversation data (including voice) may be used to improve models unless the user opts out in settings.
// What to watch
- Product-scope inference: OpenAI's trust portal lists certifications for 'OpenAI's API, ChatGPT Enterprise, and ChatGPT Edu' but never names 'Whisper', 'audio', or 'transcription' explicitly; treating the Whisper API as covered is a reasonable but unconfirmed inference.
- Free and Plus ChatGPT (which also surface Whisper-based voice input) are explicitly excluded from SOC 2 coverage per independent reporting; SOC 2 does not apply to those tiers.
- Third-party reporting (Basil AI, Nov 2025) alleges the Whisper API is marketed with a 'zero data retention' claim while actually retaining audio for up to approximately 30 days for abuse monitoring. OpenAI's own current wording on this point is not independently confirmed on its policy pages.
- HIPAA is not listed as a certification or badge on OpenAI's own trust portal. Secondary sources describe a case-by-case Business Associate Agreement (BAA) for API and healthcare customers rather than a certification; where noted, it should be labeled 'BAA available on request, case-by-case.'
- Not to be confused with the unrelated product 'WhisperAI' (whisperai.com), a separate company and domain.
- FedRAMP 20x and TX-RAMP badges likely scope to OpenAI's government-specific offerings, not the general-availability Whisper API; the public trust-portal overview does not break out per-product scope for these two.
// At a glance
Pricing model
Open-source model: free (self-hosted compute cost only). API: pay-per-use, priced per minute of audio processed. ChatGPT voice: bundled within Free/Plus/Team/Enterprise/Edu subscription tiers.
Self-hostable
Yes
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on OpenAI OpCo, LLC (contracting as OpenAI Ireland Ltd. for EEA/Swiss customers)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-09. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.openai.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.