IT administrators can deploy the DeepL Voice Desktop App for Windows across an organization using an MSI package, so people don’t have to install it themselves.
Your users need the app to hear translated speech with Voice to voice. Reading translated captions with Live subtitles doesn’t require the app.
Choose the right installer
There are two Windows installers, and they aren’t interchangeable. Use the MSI for any managed deployment.
| Installer | Use it for | Scope | Updates |
|---|---|---|---|
DeepL-Voice-Setup.exe | Someone installing on their own machine | Per user, no administrator rights | Updates itself |
DeepL-Voice.msi | Managed deployment | Per machine, administrator rights | You redeploy |
What the app installs
- The DeepL Voice Desktop App, plus a small audio helper (
AudioMute.exe) that silences the meeting app while a translation is playing. The helper is packaged inside the app’s own resources folder, it isn’t a separate product to deploy. - No kernel drivers, no system services, and no scheduled tasks.
- The MSI installs per machine, so the deployment needs administrator rights. Running the app afterwards does not.
System requirements
- Windows 10 or later, 64-bit. The MSI is x64-only.
- About 1 GB of free disk space.
Get the MSI package
Both Windows installers are published artifacts of every release. Download the MSI directly from the DeepL website (look out for the Download our MSI for enterprise button).
The filename isn’t versioned. Each release promotes its build to this address, so the URL always serves the current version. Check the version of the file you downloaded before you deploy it.
Verify the signature
We sign every release and check the signature before publishing it. Verify the signature yourself before you deploy:
| Field | Value |
|---|---|
| Subject | DeepL SE |
| Issuer | GlobalSign GCC R45 EV CodeSigning CA 2020 |
| Root | GlobalSign Code Signing Root R45 |
| Countersignature | Microsoft Public RSA Timestamping CA 2020 |
Deploy the package
The package is a standard MSI with no custom properties or transforms, so it works with any tool that deploys MSIs—Microsoft Intune (as a line-of-business app), Configuration Manager, or Group Policy software installation.
Silent install:
msiexec /i DeepL-Voice.msi /qn
Silent install with a verbose log, if you need to diagnose a failure:
msiexec /i DeepL-Voice.msi /qn /l*v install.log
Silent uninstall:
msiexec /x DeepL-Voice.msi /qn
The package includes downgrade protection: installing an older version over a newer one is refused.
Configuration
Settings are per user and are stored in each user’s own profile.
- Sign-in. Each person signs in to their own DeepL account on first launch.
- Diagnostics. A per-user Send anonymous diagnostics setting controls product analytics and crash reporting. Users can change it at any time in Settings. In the current release, this setting is on by default.
- Voice settings. Each user chooses speaker match and the preset voice.
Deploying the MSI installs a working app, and users complete first-launch setup themselves.
Network requirements
The app makes outbound TLS connections only. No inbound access is required, and you don’t need any inbound firewall exceptions.
The Voice service accepts TLS 1.3 and TLS 1.2, so TLS 1.2 is the effective minimum. If your policy requires TLS 1.3 only, you can enforce that on your egress firewall.
Allow domains, not IP addresses. DeepL’s public IP addresses can change at any time, so a configuration built on IP addresses will stop working. Allow the pattern *.deepl.com, which covers deepl.com and all subdomains. This covers every host below except crash reporting.
Allow outbound HTTPS and WebSocket traffic on port 443 to:
| Host | Purpose |
|---|---|
voice-pro-con.deepl.com | The translation session itself, over HTTPS and WebSocket |
auth.deepl.com | Sign-in |
w.deepl.com, www.deepl.com | Account and subscription data |
termbase-service-eu.deepl.com | Glossaries and Spoken Terms |
feature-flagging.deepl.com | Feature configuration |
appdownload.deepl.com | Update checks and downloads. MSI deployments don’t use this host, but you need it on the machine you download the package to. |
s.deepl.com | Product analytics, only when diagnostics are on |
*.ingest.de.sentry.io | Crash reports, only when diagnostics are on. Not covered by *.deepl.com |
WebSocket traffic must be allowed. A proxy that terminates or blocks WebSocket connections stops translation from working, even when everything else about the app looks healthy.
If you haven’t already done so, consider adding deepl.com to your trusted domains. This keeps the DeepL meeting bot from being blocked from meetings, and makes sure its name and profile picture display correctly.
Data handling on the endpoint
Each user’s data lives in their own profile at %APPDATA%\DeepL Voice.
- Meeting audio. Held in memory only. The app never writes it to disk.
- Meeting transcripts. Saved when a meeting ends, subject to an organization-level retention policy. Transcripts are kept under the long-retention policy and aren’t written to disk under the shorter ones. Saved transcripts live in
%APPDATA%\DeepL Voice\meeting-transcripts. Transcript download is a separate feature that is off by default, and a DeepL admin can turn it on. - Diagnostic logs. Kept for 14 days and rotated by size, in the same profile folder. Audio and transcript content are excluded, and tokens are redacted.
- Telemetry. Sent only while the per-user diagnostics setting is on.
On DeepL’s side, meeting transcription and translation data isn’t stored permanently. Audio is processed temporarily in memory and deleted when the call ends, data is encrypted in transit, transcriptions persist only on participants’ local devices, and we never use customer data to train our language models.
Participant consent
Under the DeepL Terms & Conditions, transcription and translation of meeting audio may be considered a recording under the laws that apply to your use of the service. You are responsible for obtaining the necessary consents, and for making sure that everyone invited to a meeting is aware that DeepL will transcribe, translate, and output their audio.
Sub-processors
The DeepL Voice Data Processing Agreements cover all of the following.
- Recall.ai (Hyperdoc Inc.) provides the meeting bot service. Its data centers are EU-based and it is contractually bound to zero data retention.
- Speechmatics handles speech processing.
- Microsoft (Microsoft Ireland Operations Limited) and Amazon Web Services EMEA host the bot application and forward audio to DeepL infrastructure. No transcription or translation happens on their servers, and no data is stored there.
Updates
MSI deployments don’t update themselves. The in-app updater is turned off in these builds, so users are never prompted and the version stays exactly where you put it. To move to a new version, deploy the newer MSI.
New releases are published frequently, so choose a redeployment interval that suits your change-management process. The per-user .exe build updates itself from appdownload.deepl.com.
Uninstall
Remove the app with msiexec /x DeepL-Voice.msi /qn, or through your deployment tool.
Uninstalling removes the application and leaves each user’s profile in place, including preferences, diagnostic logs, saved sign-in data, and any saved transcripts. To leave the endpoint clean, delete %APPDATA%\DeepL Voice as a separate step. Installations that predate the current naming may also leave %APPDATA%\DeepL Voice Companion behind.
Licensing
Deploying the app doesn’t grant users access to Voice to voice. The Voice for Meetings license is a single-user license, and the two output modes differ in who needs one.
- Translated voice (Voice to voice). Every participant who wants to hear translated speech needs their own Voice license and the app installed.
- Translated captions (Live subtitles). Only the translation manager who starts translation needs a license. Other participants read captions on the DeepL website, without a license and without installing anything.