How Whispor keeps your team in control.
Nothing starts until you approve. Whispor works inside the limits you set, joins calls only with consent, keeps sourcing responses sealed, and holds compliance rules in the engine as configuration.
- 01Nothing starts until approvedOn
- 02Level of autonomySend inside my limits
- 03Strategic suppliersPerson-led
- 04CallsConsent first
- 05Audio and videoNever kept
- 06LearningYour tenant only
- 07Changes to how it negotiatesYou approve
Your team decides what Whispor is allowed to do.
- Nothing starts until you approveEvery goal begins as a plan your team can change or turn down.
- A target and a limit on every termWhispor negotiates between them. Anything outside a limit stops and comes back to you.
- Three levels of autonomyAsk me every time, send inside my limits, or run it to the close, chosen goal by goal.
- Take over at any timeAny negotiation can move from Whispor to a person, mid-round, with the history attached.
- People lead strategic suppliersWhispor is on the call. Your buyer decides.
- Changes need approvalReviews propose changes. Nothing changes until you approve, and only for new negotiations.
Five things it does not do at all.
Sign a contract.
Your team signs.
Award business.
Whispor recommends. Your team awards.
Tell one supplier another supplier's price.
Bids are never shared between suppliers.
Go outside a limit you set.
It stops and asks you instead.
Describe how a person feels.
It reports what was said and done.
What happens when Whispor joins a call.
Assisted Negotiation joins Zoom, Microsoft Teams and Google Meet calls that belong to a goal, or that a person launches it into, and only once consent is captured.
Assisted Negotiation- Consent firstNo call is analyzed without consent captured before Whispor joins.
- Only your side sees itThe supplier sees your buyer, not Whispor.
- No recording keptWhispor does not record or keep audio or video.
- Observations, not feelingsSignals report what was said and done, with the evidence behind them.
Sourcing responses and practice sessions.
Sealed until the deadline
Responses cannot be opened before the deadline closes.
Never shared across suppliers
No supplier is told what another supplier bid, during the event or after it.
Practice stays inside
Whispor plays the supplier. Nothing in a practice session reaches a real supplier.
Compliance rules are configuration, so changes apply without a product release.
Whispor expresses key compliance requirements as guardrails, retention rules, approval gates and oversight controls within the platform. Many changes can therefore be applied through configuration rather than waiting for a product release.
A rule is written down
The obligation lives in a document. Enforcement depends on whoever reads it, remembers it and applies it under time pressure. Evidence is assembled after the fact.
A rule is a constraint the engine holds
Nothing that violates it can be executed, because the path is not available. Every action carries the rule that permitted it, the data it saw and the person who approved it.
Where Whispor stands.
What Whispor is aligned to, and where no certification exists yet for anyone to hold.
SOC 2
Aligned controls
GDPR
Aligned controls
EU AI Act
Architected against
TRAIGA
Aligned controls
BIPA
Aligned controls
CUBI
Aligned controls
CCPA / CPRA
Aligned controls
SOC 2
Controls are mapped to the SOC 2 Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. Access control, change management, monitoring and incident response follow those criteria.
GDPR
Lawful basis for processing, data-subject access, correction and erasure, purpose limitation and data minimization are built into the data model. Processing records and retention schedules are maintained per tenant.
EU AI Act
No certification body exists for the Act yet, so nobody can hold a conformity mark today. Whispor is built against its requirements: transparency about AI involvement, human oversight, logging and risk management.
US state laws that apply to negotiation AI.
Federal AI rules remain unsettled, so the binding obligations for a US buyer are at state level. These four drive the requirements a negotiation platform has to meet.
TRAIGA
Regulates intentional harmful use of AI, enforced by the Attorney General with a 60-day notice and cure period. Substantial compliance with the NIST AI Risk Management Framework is an affirmative defense. Whispor's guardrails, adversarial testing and preserved audit trails map to Govern, Map, Measure and Manage, which is what that defense asks you to evidence.
BIPA
Carries a private right of action and requires no proof of harm, which is why it produces the largest settlements in US privacy. Whispor collects and infers no biometric identifiers. No voiceprint, no faceprint, no emotion inference, so that category of exposure does not arise. Consent is captured before Whispor joins a call, and no audio or video is recorded or kept.
CUBI
Requires informed consent before a biometric identifier is captured for a commercial purpose, and sets destruction deadlines. Enforcement sits with the Attorney General. The same architectural answer applies: Whispor's signals report observable conduct and documentary evidence, not biometric identifiers.
CCPA / CPRA
Consumers hold rights to know, delete, correct and opt out of sale or sharing, with obligations flowing to service providers. Whispor processes customer data as a service provider under contract, does not sell or share personal information, and supports deletion and correction through the same tenant-scoped controls that serve GDPR.
The controls a security questionnaire asks about.
- Tenant separationRow-level security in the data layer, so a code defect cannot cross tenants.
- In transit and at restTLS from browser to database. Encrypted at rest, including backups.
- Least privilege by roleAccess scoped to tenant and function. Admin paths are separate and logged.
- Append-only action logEntries cannot be edited afterwards. Each records the actor, the evidence and the outcome.
- No cross-tenant trainingThe engine learns inside your boundary. Your data never trains another customer's model.
- Consent before analysisNo call is analyzed without consent captured first.
- Bounded and configurable retentionRetention windows are set per tenant. Deletion propagates through derived records.
- Human approval gatesAssisted Negotiation suggests and a person decides. Autonomous Negotiation stops and asks rather than going past a limit.
- Tested backupsEncrypted, scheduled and stored separately. Restores are tested rather than assumed.
We report what was said and done.
Whispor observes conduct and cites the evidence for every signal it raises. It does not claim to read minds, detect emotions or judge truthfulness, and it does not profile people. Your counterparties are treated as fairly as your own team.
What commercial outcome are you trying to achieve?
Name one goal. We'll show you the plan Whispor would build for it, then scope a pilot around it.
Give Whispor a goal- One goal, bounded scope
- Baseline agreed before launch
- Pay nothing if we don't beat it