Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
The vendor publishes five products: Whispli Core ('Manage reports and investigations in one secure workspace'), Whispli Voice AI, Whispli Conflicts of Interest, Whispli Gifts & Hospitality and Whispli Pulse. The AI features page covers four AI features and says each 'can be enabled or disabled to match your organisation's needs'. Read 2026-09-27.
Ask: Which products and which of the four AI features will our subscription include, and which are charged separately?
Deployment model
Public claim only
The trust centre says 'Whispli runs on enterprise-grade cloud infrastructure with regional hosting to meet data residency and regulatory requirements' and lists 'Trusted cloud hosting providers' and 'Flexible hosting options' without naming a provider or a region. The privacy policy says 'all Personal Information is stored in a specific data center as agreed with the Client'. No on-premises option was found.
Ask: Name the cloud provider and the specific data centre that would hold our tenant, and confirm in writing whether an Australian data centre is one of the options.
AI features in scope
Public claim only
The AI features page, read 2026-09-27, publishes four features: AI translation across '70+ languages across every reporting channel' with 'Data deleted immediately after translation, nothing retained'; AI Summarize, which 'combines the original report and all subsequent chat exchanges into one clear overview', 'Updated on demand as the case evolves'; Voice AI, 'a guided, conversational experience that captures every detail of a report, structures it automatically and creates a case in Whispli Core, without a single human operator involved'; and Voice Message, up to 15 minutes per recording, with the voice 'automatically distorted upon submission' and 'AI transcription' producing a searchable text version.
Ask: Demonstrate each of the four AI features on test data, and confirm which are on by default for a new tenant.
Jurisdictions and legal content
Public claim only
Whispli publishes guidance pages on the EU Whistleblowing Directive, the French Waserman and Sapin II laws, Sarbanes-Oxley, DORA, Singapore's Workplace Fairness Act and Australia's whistleblowing laws. Those are marketing and resource pages; the product itself is presented as a reporting and case-management platform and no legal-research or advice output is claimed. The vendor's own pages address 'organisations', 'compliance teams' and 'investigators', not law firms or legal practitioners.
Ask: Does any Whispli output state a legal position, for example on whether a disclosure qualifies for protection under Part 9.4AAA of the Corporations Act, or is it confined to summarising what the reporter said?
Check for vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27. A map of the site returned 197 URLs with no /llms.txt, /ai-info, /ai or /for-ai path, and the AI features, trust centre, Data Processing Addendum (APAC), privacy policy and General Terms of Use page bodies read on the same date contain no block addressed to AI models, assistants, crawlers or language models telling them how to describe the product. No llms.txt file describing products to language models was present, and no crawler allow or disallow directive was examined because no such file appeared in the inventory. The AI features page opens with prose addressed to human readers, 'The compliance industry is full of AI promises. At Whispli, we keep it simple'.
Ask: Do you publish, or plan to publish, any page or embedded block that tells AI assistants or language models how to describe Whispli?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and controller responsibility
Public claim only
The APAC Data Processing Addendum makes the client the Controller and Whispli the Processor, and requires the client to warrant that it is 'duly and effectively authorised' to instruct Whispli on behalf of its organisations, staff members and informants. The General Terms of Use say 'Whispli acts as a mere technical intermediary between the Organisation and you and does not intervene in the processing of your Report by the Organisation'. The privacy policy makes the client responsible for telling its users where data is hosted.
Ask: Confirm in writing what notice we must give reporters about AI translation, summarisation and Voice AI processing, and supply the wording you expect us to publish.
Foundation-model providers
Not confirmed
No model provider is named anywhere on the pages read. The AI features page says 'Choose from a range of leading AI models, switch on demand as the landscape evolves, and standardise on the provider that fits your organisation's policies', and the FAQ says the architecture 'lets you select the AI model behind your features'. No provider, model name or version is published, and the trust centre and Data Processing Addendum name none.
Ask: Name every model and provider available to an Australian tenant for translation, Summarize, Voice AI and transcription, with the contracting entity and inference region for each.
Subprocessors
Public claim only
The APAC Data Processing Addendum gives contractual subprocessor rights: prior written notice of any new subprocessor 'including full details of the Processing to be undertaken', a five-day window to object on reasonable grounds, written flow-down of equivalent obligations, due diligence before processing, and copies of subprocessor agreements on request. No subprocessor list or register was found anywhere on the site; the 197-URL map inventory contains none. The privacy policy refers generically to 'our Web Application Firewall provider, or our Cloud computing platform provider'.
Ask: Provide the current dated subprocessor register, including every AI model provider, hosting provider and telephony provider used for an Australian tenant.
Training on customer content
Public claim only
The APAC Data Processing Addendum says Whispli 'will not process Whispli Personal Data for our own benefit, for the benefit of any Third Party, or for our own purposes or advertising purposes or other purposes, unless required by any Data Protection Laws', and will process only on the client's documented instructions. The AI features page adds a marketing statement, 'None of your data is used to train AI models, now or in the future. We have strict data processing agreements with every provider we work with'. The provider agreements referred to are not published.
Ask: Will you warrant in our agreement that no report content, chat message, audio recording, transcript or embedding is used to train or improve any model, including by your model providers, and provide the relevant provider terms?
Feedback and quality monitoring
Not confirmed
No in-product rating, correction or feedback mechanism for AI output is described on the pages read, and nothing states whether corrections to a translation, summary or transcript are retained or reused. The AI features page claims 'full auditability of every action taken', but does not say whether AI quality telemetry is collected.
Ask: Is any telemetry about AI output quality collected from our tenant, and can it be disabled?
Retention of reports, transcripts and AI requests
Public claim only
The APAC Data Processing Addendum clause 8 says Whispli 'will not retain Whispli Personal Data made available to us any longer than is necessary' for performance of the agreement or its legal obligations, and the privacy policy clause 6.3 says retention is 'for the period necessary to fulfil the purposes outlined in this Privacy Policy unless a longer retention period is required or permitted by law'. Neither states a period or a configurable setting. The trust centre says voice reports and transcripts have 'defined retention policies' without stating them. The AI features page claims zero retention on API calls.
Ask: State the default and configurable retention periods for cases, chat threads, audio recordings, transcripts, translations and summaries, and how zero retention on model API calls is evidenced.
Deletion and certified erasure
Public claim only
The APAC Data Processing Addendum clause 15.2 says that on termination Whispli will assist, at the client's cost, to ensure personal data 'is either destroyed, returned to you or the Data Subjects, or made available to another service provider, as required by you'. No period and no certificate is specified. The General Terms of Use tell reporters that once a report is submitted 'you can no longer delete the content of your Report or ask us to delete it' and that removal requests go to the client organisation.
Ask: On exit, what is deleted, within what period, does it include backups, audio recordings and transcripts, and will you certify deletion in writing at no cost?
Vendor and partner access to content
Public claim only
The privacy policy clause 7.1(a) permits disclosure 'to a Managed Service Partner to ensure its authorised personnel can access a Client account to perform the tasks agreed between the Client and the Managed Service Partner', and clause 8.3 describes three anonymity tiers, including anonymous 'to the Managed Service Partner, the Client and Whispli'. Clause 7.2 says personal information will not be disclosed to an entity in a jurisdiction without a comparable regime until it has agreed in writing to safeguard it. No staff-access log is offered to clients and no support country is named.
Ask: Who at Whispli, and at any managed service partner, can read our case content, from which countries, and can we receive an access log?
Access control, authentication and audit
Public claim only
The trust centre says access is governed by 'granular, role-based and case-level permissions', that Whispli 'enforces secure authentication through SSO and two-factor authentication', and that 'full audit logs provide traceability'. It also says 'Metadata is automatically removed from all files and attachments' and that anonymous reporting collects no IP address or caller ID. The General Terms of Use set reporter password complexity at 10 to 40 characters with at least one lowercase, one capital and one symbol.
Ask: Is SSO with our identity provider included on our plan, is multi-factor authentication enforceable for all case managers, and can we export the audit log including every AI action?
Encryption in transit and at rest
Public claim only
The privacy policy clause 9.2 says 'Whispli uses SSL encryption to store and transfer Personal Information' and adds that security 'cannot be guaranteed'. The trust centre says voice reports and transcripts 'are encrypted' and that calls, audio files and transcripts are 'protected end to end'. The AI features page refers to 'customer-managed encryption keys'. No algorithm, key length, TLS version or at-rest standard is named on any page read.
Ask: State the encryption algorithms and TLS versions in use, whether audio recordings are encrypted at rest, and the terms on which customer-managed keys are available.
Independent security assurance
Public claim only
The privacy policy clause 9.3 says 'Whispli is certified ISO 27001:2013 (Information Security Management System)'. The trust centre says Whispli is 'ISO 27001 certified', 'SOC 2 Type II certified', 'GDPR compliant', 'Aligned with ISO 37002', and undergoes 'ongoing third-party audits and penetration testing'. No certificate number, certification body, scope statement, report date or penetration-test summary is published. The Data Processing Addendum clause 9 gives the client an audit right, once per calendar year, at the client's cost.
Ask: Provide the ISO 27001 certificate with scope and body, the current SOC 2 Type II report, and confirm whether the AI features and the Voice AI telephony path are inside both scopes. Note that ISO 27001:2013 was superseded; which version are you certified to now?
Contract, entity and governing documents
Public claim only
The APAC Data Processing Addendum names the parties as 'Fraudsec Pty Ltd ACN 605 003 825 trading as Whispli' and the client, and says that by using Whispli the client accepts the DPA, the General Terms of Use and the privacy policy together as 'this Agreement'. The General Terms of Use read on 2026-09-27 govern the reporter's use, are stated to be 'governed by French law', and were last updated 1 March 2023. The client-facing Terms & Conditions were not read within the source budget. The website footer reads 'Copyright 2026 (c) Whispli Inc', which is not reconciled with Fraudsec Pty Ltd on any page read.
Ask: Confirm the contracting entity and ACN for our agreement, provide the client-facing Terms & Conditions with their governing law and liability cap, and explain the relationship between Fraudsec Pty Ltd and Whispli Inc.
Cross-border transfers and where AI inference runs
Not confirmed
Three vendor statements do not line up. The APAC Data Processing Addendum clause 10, headed 'Local Processing', says all processing 'will take place within the European Union (EU) or in countries that guarantee an appropriate level of protection in accordance with the Data Protection Laws'. The privacy policy clause 8.2 says the hosting location is 'agreed with the Client', that 'no information is transferred between geographical regions', and then that 'Whispli Clients may not choose that location however'. The AI features page says 'AI processing runs on models hosted in the same region as your hosting location' and its FAQ says only 'For EU-based customers, all AI processing takes place on models hosted within the European Union', saying nothing about Australia. No page read states that an Australian hosting region exists or that inference can run in Australia.
Ask: In writing: is an Australian hosting region available, would AI inference for translation, Summarize, Voice AI and transcription run in Australia, and how does that sit with clause 10 of the APAC Data Processing Addendum, which names the EU?
Incident notification
Public claim only
The APAC Data Processing Addendum clause 5.1 says Whispli will notify the client 'without undue delay upon us or any Subprocessor becoming aware of a Personal Data Breach', with sufficient information for the client to meet its own reporting obligations, and clause 5.2 requires cooperation in investigation and remediation. No hour count is given, there is no reference to the Notifiable Data Breaches scheme or the OAIC, and no incident history was found.
Ask: State the notification period in hours from discovery, confirm cooperation with our Notifiable Data Breaches assessment, and disclose any material incident in the last 24 months affecting the AI features.
Change notice for subprocessors, models and terms
Public claim only
The APAC Data Processing Addendum clause 3.3 requires prior written notice of a new subprocessor with full details of the processing, and gives the client five days to object on reasonable grounds, after which Whispli will not appoint that subprocessor until reasonable steps have been taken to address the objection. Clause 2.2(e) says Whispli 'will immediately inform you regarding any changes to Whispli or the performance of our services'. The General Terms of Use say Whispli may modify them and reserves the right to 'improve, modify, add or delete functionalities and features of the Platform'.
Ask: Does a change of AI model or model provider trigger the clause 3.3 subprocessor notice and the five-day objection right, and what happens if we object?
Export and exit
Public claim only
The APAC Data Processing Addendum clause 15.2 requires Whispli, at the client's cost, to destroy, return or transfer personal data to another service provider as the client directs. No export format, completeness statement or timeframe is specified, and no self-serve export is described on the pages read. Clause 15.1 says the DPA terminates automatically with the General Terms of Use.
Ask: What export formats cover cases, chat threads, audio recordings, transcripts, translations, summaries and audit logs, in what timeframe, and at what cost?
Connectors and third-party tools
Not confirmed
The trust centre refers to 'Native integrations with BI and HR tools' and an API without naming any connector, and no integration catalogue was found in the 197-URL inventory. The privacy policy clause 7.1 lists categories of third-party recipients, including a payment processor, a web application firewall provider and a cloud computing platform provider, none named.
Ask: List every connector available to us, whether each is off by default, and what case content it can read or write.
Open-web retrieval
Not confirmed
Nothing on the AI features page, trust centre, Data Processing Addendum (APAC), privacy policy or General Terms of Use read on 2026-09-27 says whether any AI feature retrieves content from the open web. The four published AI features are described as operating on the report, the chat thread and the audio a reporter submits.
Ask: Does any AI feature query the internet or an external data source while handling a report, and can that be disabled?
Automated actions and confirmation
Public claim only
The vendor says Voice AI 'captures every detail of a report, structures it automatically and creates a case in Whispli Core, without a single human operator involved', and elsewhere on the same page that 'Tasks, deadlines and SLA reminders can be automated'. It also says every AI feature 'can be enabled or disabled independently'. The pages read do not say whether an AI-created case can trigger routing, assignment or notification to named staff before a person has seen it.
Ask: When Voice AI creates a case, what is assigned, notified or actioned automatically before a case manager reads it, and can each of those steps be held for confirmation?
Human review before reliance
Public claim only
The AI features page states 'Every AI output is a suggestion. Case managers retain full authority at every stage of the investigation, because in compliance work, the final call always belongs to a person', and claims the architecture is 'designed in alignment with EU AI Act principles: transparency about AI use, human oversight at every decision point, and full auditability of every action taken'. These are marketing statements; no product control that forces review, and no equivalent clause in the Data Processing Addendum or General Terms of Use, was found.
Ask: Which in-product control forces a case manager to accept or reject an AI summary or a Voice AI case record before it is used, and is that oversight statement warranted in our agreement?
