Network Filtering - HyperWhisper

Overview

Network filters include corporate firewalls, parental controls, and content filters. If you use HyperWhisper on a network with a filter, you must whitelist some domains. HyperWhisper does not work correctly until you whitelist them.

Important: Whitelist only the domains of the services that you use. If you use HyperWhisper Cloud for transcription, you do not need to whitelist OpenAI, Groq, or other third-party providers.

Required Domains

HyperWhisper always needs these domains. This is true for all transcription providers:

If you do not whitelist these domains, license validation and software updates do not work.

Domain	Purpose
`www.hyperwhisper.com`	Main website, API backend, update feed (appcast), and license validation
`builds.hyperwhisper.com`	Download host for the update installers (`.dmg` on macOS, `.exe` on Windows)
`sentry.io`	Error reporting and crash analytics (optional but recommended)

The update feed and the installer are on two different hosts. If you whitelist www.hyperwhisper.com only, the app finds a new version and shows the release notes, but the download fails.

HyperWhisper Cloud Endpoints

If you use HyperWhisper Cloud (the default transcription service in the app), whitelist these endpoints:

https://transcribe-prod-v2.hyperwhisper.com/transcribe - Transcription endpoint
https://transcribe-prod-v2.hyperwhisper.com/usage - Credit balance queries
https://transcribe-prod-v2.hyperwhisper.com/post-process - Standalone text post-processing (used when a mode’s post-processing provider is HyperWhisper Cloud)
https://transcribe-prod-v2.hyperwhisper.com/warmup - HEAD keepalive that opens the connection before you record. The app sends it at intervals while it is active
wss://transcribe-prod-v2.hyperwhisper.com/ws/streaming-deepgram - Streaming transcription with HyperWhisper Cloud as the streaming provider, and the live engine set to Deepgram Nova 3 (the default)
wss://transcribe-prod-v2.hyperwhisper.com/ws/streaming-gemini-transcribe - streaming transcription with HyperWhisper Cloud as the streaming provider, and the live engine set to Google Gemini 3.5 Transcribe

The streaming endpoints are WebSockets. If your firewall permits HTTPS but stops the WebSocket upgrade, batch transcription operates correctly and streaming transcription does not connect.

HyperWhisper Cloud needs no API key. It is the best option for most users. It uses prepaid credits at a low price. There is no free trial and no anonymous use. For more information, see Cloud Credits.

Model Downloads

If you use local transcription with any on-device model (Whisper, Parakeet, Nemotron 3.5, or Qwen3 ASR), or local Gemma post-processing, whitelist this domain. All on-device models download from the same host:

Domain	Purpose
`huggingface.co`	Download Whisper.cpp and Gemma models

HyperWhisper downloads the models from these URLs:

https://huggingface.co/ggerganov/whisper.cpp/resolve/main/* - Whisper models
https://huggingface.co/unsloth/gemma-4-E2B-it-GGUF/resolve/main/* - Gemma 4 E2B local post-processing models
https://huggingface.co/unsloth/gemma-4-E4B-it-GGUF/resolve/main/* - Gemma 4 E4B local post-processing models
https://huggingface.co/unsloth/gemma-4-12b-it-GGUF/resolve/main/* - Gemma 4 12B local post-processing models
https://huggingface.co/unsloth/gemma-4-26B-A4B-it-GGUF/resolve/main/* - Gemma 4 26B A4B local post-processing models
https://huggingface.co/unsloth/gemma-4-31B-it-GGUF/resolve/main/* - Gemma 4 31B local post-processing models

Optional: Third-Party Transcription Providers

Whitelist only the providers that you use. If you do not use a provider, you do not need to whitelist its domains. For example, when you have no OpenAI API key, you do not need api.openai.com.

OpenAI

If you configured OpenAI in Model Library → API Keys, whitelist these domains:

Domain	Purpose
`api.openai.com`	Whisper transcription API and GPT post-processing
`platform.openai.com`	API key management page (informational)

HyperWhisper uses these endpoints:

https://api.openai.com/v1/audio/transcriptions - Whisper API
https://api.openai.com/v1/chat/completions - GPT post-processing
https://api.openai.com/v1/models - Model availability checks
wss://api.openai.com/v1/realtime - Streaming transcription with OpenAI as the streaming provider

Groq

If you configured Groq in Model Library → API Keys, whitelist these domains:

Domain	Purpose
`api.groq.com`	Fast Whisper inference and language models
`console.groq.com`	API key management page (informational)

HyperWhisper uses these endpoints:

https://api.groq.com/openai/v1/audio/transcriptions - Whisper API
https://api.groq.com/openai/v1/chat/completions - Text post-processing
https://api.groq.com/openai/v1/models - Model availability checks

Deepgram

If you configured Deepgram in Model Library → API Keys, whitelist these domains:

Domain	Purpose
`api.deepgram.com`	Advanced speech-to-text API
`deepgram.com`	Website (informational)

HyperWhisper uses these endpoints:

https://api.deepgram.com/v1/listen - Transcription API
wss://api.deepgram.com/v1/listen - Streaming transcription
https://api.deepgram.com/v1/projects - Health check

Soniox

If you configured Soniox in Model Library → API Keys, whitelist these domains:

Domain	Purpose
`api.soniox.com`	Soniox speech-to-text API
`soniox.com`	Website (informational)

HyperWhisper uses these endpoints:

https://api.soniox.com/v1 - Transcription API

AssemblyAI

If you configured AssemblyAI in Model Library → API Keys, whitelist these domains:

Domain	Purpose
`api.assemblyai.com`	Async transcription API with advanced features
`sync.assemblyai.com`	Sync transcription API — the fast path HyperWhisper tries first for clips under 120 seconds
`www.assemblyai.com`	Website (informational)

HyperWhisper uses these endpoints:

https://sync.assemblyai.com/v1/transcribe - Sync transcription (clips under 120 seconds)
https://api.assemblyai.com/v2/upload - Audio upload (async fallback)
https://api.assemblyai.com/v2/transcript - Transcription creation/polling (async fallback)

ElevenLabs Scribe

If you configured ElevenLabs in Model Library → API Keys, whitelist these domains:

Domain	Purpose
`api.elevenlabs.io`	ElevenLabs Scribe speech-to-text API
`elevenlabs.io`	Website and API key management (informational)

HyperWhisper uses these endpoints:

https://api.elevenlabs.io/v1/speech-to-text - Scribe API
https://api.elevenlabs.io/v1/models - Model availability checks
wss://api.elevenlabs.io/v1/speech-to-text/realtime - Streaming transcription with ElevenLabs as the streaming provider

xAI Grok

If you configured Grok in Model Library → API Keys, whitelist these domains:

Domain	Purpose
`api.x.ai`	Grok speech-to-text and model availability checks
`console.x.ai`	API key management page (informational)

HyperWhisper uses these endpoints:

https://api.x.ai/v1/stt - Grok STT batch transcription
wss://api.x.ai/v1/stt - Grok STT streaming transcription
https://api.x.ai/v1/models - Model availability checks
https://api.x.ai/v1/chat/completions - Grok post-processing

Google Gemini

If you configured Google Gemini in Model Library → API Keys for transcription, whitelist these domains:

Domain	Purpose
`generativelanguage.googleapis.com`	Gemini Files API upload/poll/delete, plus the `generateContent` call that produces the transcript
`aistudio.google.com`	API key management page (informational)

HyperWhisper uses these endpoints:

https://generativelanguage.googleapis.com/upload/v1beta/files - starts a resumable upload of the audio file
https://generativelanguage.googleapis.com/v1beta/{file.name} - polls until the uploaded file is active, then deletes it afterward
https://generativelanguage.googleapis.com/v1beta/models/{model}:generateContent - produces the transcript from the uploaded file
https://generativelanguage.googleapis.com/v1beta/models - model availability checks

Google Gemini 3.5 Transcribe

Gemini 3.5 Transcribe is a different Google product from Google Gemini, on a different endpoint. It has its own key slot in Model Library → API Keys. If you configured it, whitelist these domains:

Domain	Purpose
`generativelanguage.googleapis.com`	The dedicated speech endpoint, the live WebSocket, and model availability checks
`aistudio.google.com`	API key management page (informational)

HyperWhisper uses these endpoints:

https://generativelanguage.googleapis.com/v1beta/interactions - produces the transcript from inline audio. HyperWhisper sends no file upload for this engine
wss://generativelanguage.googleapis.com/ws/google.ai.generativelanguage.v1beta.GenerativeService.BidiGenerateContent - streaming transcription with Gemini 3.5 Transcribe as the streaming provider
https://generativelanguage.googleapis.com/v1beta/models - model availability checks

Mistral Voxtral

If you configured Mistral in Model Library → API Keys, whitelist these domains:

Domain	Purpose
`api.mistral.ai`	Voxtral transcription API and model availability checks
`console.mistral.ai`	API key management page (informational)

HyperWhisper uses these endpoints:

https://api.mistral.ai/v1/audio/transcriptions - Voxtral Mini transcription API
https://api.mistral.ai/v1/models - Health check and model availability

Optional: AI Post-Processing Providers

AI post-processing improves transcriptions. It corrects typos, adds punctuation, and formats the text. If you enabled it, whitelist the domains of your provider.

AI post-processing is optional. If you do not use it, you do not need to whitelist these domains.

Anthropic Claude

If you configured Anthropic Claude for post-processing, whitelist these domains:

Domain	Purpose
`api.anthropic.com`	Claude AI models for text enhancement
`console.anthropic.com`	API key management page (informational)

HyperWhisper uses these endpoints:

https://api.anthropic.com/v1/messages - Text post-processing
https://api.anthropic.com/v1/models - Model availability checks

Google Gemini

If you configured Google Gemini for post-processing, whitelist these domains:

Domain	Purpose
`generativelanguage.googleapis.com`	Gemini AI models for text enhancement
`aistudio.google.com`	API key management page (informational)
`ai.google.dev`	Gemma documentation (informational)

HyperWhisper uses these endpoints:

https://generativelanguage.googleapis.com/v1beta/openai/chat/completions - Text post-processing
https://generativelanguage.googleapis.com/v1beta/models - Model availability checks

Cerebras

If you configured Cerebras for post-processing, whitelist these domains:

Domain	Purpose
`api.cerebras.ai`	Ultra-fast Llama inference for text enhancement
`cloud.cerebras.ai`	API key management page (informational)

HyperWhisper uses these endpoints:

https://api.cerebras.ai/v1/chat/completions - Text post-processing
https://api.cerebras.ai/v1/models - Model availability checks

Mistral

If you configured Mistral for post-processing, whitelist these domains:

Domain	Purpose
`api.mistral.ai`	Mistral’s models for fast, multilingual text enhancement
`console.mistral.ai`	API key management page (informational)

HyperWhisper uses this endpoint:

https://api.mistral.ai/v1/chat/completions - Text post-processing

xAI Grok

If you configured Grok for post-processing, use the xAI domains from the previous section.

Local Gemma (Offline)

If you use local Gemma models for post-processing, you need network access only for the model download. HyperWhisper loads the GGUF model inside the app. It does not call a localhost server.

Local Gemma runs fully on your device. It needs no internet connection for inference.

Offline Mode

HyperWhisper can work fully offline with these three conditions:

Local transcription (libwhisper.cpp or Parakeet TDT v3):
- You download the Whisper models one time from huggingface.co
- HyperWhisper stores the models in ~/Library/Application Support/hyperwhisper/models/
- After the download, HyperWhisper needs no internet connection
No post-processing or local Gemma post-processing:
- Local Gemma runs fully on your device
- HyperWhisper makes no external API calls
7-day offline grace period for license validation:
- HyperWhisper stores the result of the license validation for 24 hours
- You can use the app offline for a maximum of 7 days
- After 7 days, you must connect to the internet for a new validation

License validation needs internet access to hyperwhisper.com at regular intervals. When the grace period ends, the app tells you to connect.

Troubleshooting

Common Error Messages

These error messages from HyperWhisper show a problem with a network filter:

Error Message	Likely Cause	Solution
”Network connection error”	A general connection error, or a blocked domain	Make sure that the internet connection works and that you whitelisted the necessary domains
”No internet connection”	No connection to the internet, or all domains are blocked	Connect to the internet. Whitelist the necessary domains
”Cloud transcription requires an internet connection”	You use a cloud provider while you are offline	Connect to the internet, or change to local transcription
”Network error: [details]“	A specific network error, for example a timeout or a DNS error	Make sure that the domains are whitelisted. Examine the network settings
”Cannot find host” / “Cannot connect to host”	DNS is blocked, or the domain is not whitelisted	Whitelist the specific domain, for example `transcribe-prod-v2.hyperwhisper.com` or `api.openai.com`
”Unauthorized: invalid [Provider] API key”	The provider rejected the API key. The network can also block the validation	Make sure that the API key is correct and that the API domain is whitelisted
”Request timed out”	A slow connection, or a partial block	Make sure that the connection is fast enough and that SSL inspection does not interfere
”[Provider] is unreachable”	The provider domain is blocked, or the provider is offline	Whitelist the API domain of the provider
”Server error (5xx)“	The provider has an error, or SSL inspection breaks the requests	Examine the status page of the provider. Make sure that SSL inspection bypasses the provider domains

Even when you whitelist the domains, SSL inspection can cause many of these errors. If “Network error” or “Unauthorized” messages continue with correct API keys and correct whitelisting, read the next section.

SSL/TLS Inspection Issues

Some corporate networks and content filters use SSL/TLS inspection. Other names for it are SSL bumping and HTTPS interception. The filter does these three steps:

The filter intercepts the HTTPS connection
The filter sends its own certificate in place of the real certificate
The filter decrypts your traffic, examines it, then encrypts it again

HyperWhisper validates SSL certificates for security. As a result, SSL inspection can cause connection failures. This is true even when you whitelist all the correct domains.

If you whitelisted all the domains and you continue to see “No network connection” or SSL certificate errors, the probable cause is SSL inspection.

Solution: Ask your IT administrator to add the HyperWhisper domains to the SSL inspection bypass list. The URL allowlist is not sufficient. Traffic to the domains on the bypass list keeps the real certificate. Add these domains to the SSL inspection bypass list:

*.hyperwhisper.com (includes www.hyperwhisper.com and transcribe-prod-v2.hyperwhisper.com)
The third-party API domains that you use, for example api.openai.com and huggingface.co

An SSL inspection bypass is also better for your privacy. Your network filter cannot examine your voice transcriptions.

How to Test the Connection

If you have a network error, do a test of the connection to each domain:

# Test HyperWhisper Cloud
curl -I https://transcribe-prod-v2.hyperwhisper.com/

# Test license server
curl -I https://www.hyperwhisper.com/api/license/validate

# Test the update installer host
curl -I https://builds.hyperwhisper.com

# Test OpenAI (if using)
curl -I https://api.openai.com/v1/models

# Test Hugging Face (for model downloads)
curl -I https://huggingface.co

If the curl commands work but HyperWhisper does not, the probable cause is SSL inspection. curl uses the certificate store of your system. HyperWhisper validates certificates more strictly.

Security & Privacy

Data Handling

API Keys: HyperWhisper stores them in the macOS Keychain. It never sends them to the HyperWhisper servers
License Keys: HyperWhisper sends them only to hyperwhisper.com for validation. HTTPS encrypts the data
Audio Data:
- HyperWhisper Cloud: HyperWhisper sends the audio to transcribe-prod-v2.hyperwhisper.com on the Fly.io edge network. The service processes the audio in memory and writes no audio to disk. For more information, see Data Privacy
- Third-party providers: HyperWhisper sends the audio directly to the API of the provider, for example xAI Grok, OpenAI, Groq, or Deepgram. The privacy policy of the provider applies
- Local models: The audio stays on your device. The transcription is fully offline and private

Network Security

TLS/HTTPS: All network connections use encrypted HTTPS
Certificate Validation: HyperWhisper validates SSL certificates. This prevents man-in-the-middle attacks
No Separate Analytics SDK: HyperWhisper does not run a separate usage-analytics product
Error & Session Reporting: Sentry is on by default, and you can turn it off in General Settings. Sentry collects crash reports, session and release-adoption data, performance data, and your IP address

Privacy with Network Filters

A corporate network filter with SSL inspection has these two effects:

Without SSL bypass: Your network can decrypt and read all the transcription content
With SSL bypass: Your transcriptions stay private and encrypted end-to-end

For maximum privacy, ask your IT administrator to bypass SSL inspection for the HyperWhisper domains.

Related Documentation:

​Overview

​Required Domains

​HyperWhisper Cloud Endpoints

​Model Downloads

​Optional: Third-Party Transcription Providers

​OpenAI

​Groq

​Deepgram

​Soniox

​AssemblyAI

​ElevenLabs Scribe

​xAI Grok

​Google Gemini

​Google Gemini 3.5 Transcribe

​Mistral Voxtral

​Optional: AI Post-Processing Providers

​Anthropic Claude

​Google Gemini

​Cerebras

​Mistral

​xAI Grok

​Local Gemma (Offline)

​Offline Mode

​Troubleshooting

​Common Error Messages

​SSL/TLS Inspection Issues

​How to Test the Connection

​Security & Privacy

​Data Handling

​Network Security

​Privacy with Network Filters

Overview

Required Domains

HyperWhisper Cloud Endpoints

Model Downloads

Optional: Third-Party Transcription Providers

OpenAI

Groq

Deepgram

Soniox

AssemblyAI

ElevenLabs Scribe

xAI Grok

Google Gemini

Google Gemini 3.5 Transcribe

Mistral Voxtral

Optional: AI Post-Processing Providers

Anthropic Claude

Google Gemini

Cerebras

Mistral

xAI Grok

Local Gemma (Offline)

Offline Mode

Troubleshooting

Common Error Messages

SSL/TLS Inspection Issues

How to Test the Connection

Security & Privacy

Data Handling

Network Security

Privacy with Network Filters