I compared the security of 6 AI note takers: the checklist I'd use in 2026

AI meeting software hears your customers, your roadmap and your hiring talk, so the security answers matter before you buy. I compared how six vendors answer a short checklist on their own pages: Circleback, Fireflies.ai, Fathom, Granola, Otter.ai and tl;dv.

Quick verdict: I'd pick tl;dv if you need data hosted in Europe. I'd pick Circleback for retention controls on Business and up, for SOC 2 Type II, the EU-U.S. Data Privacy Framework and no training on customer data on every plan, and for public Enterprise pricing with SSO, SCIM and a BAA.

What should you check before buying AI meeting software?

Certifications and encryption
Training on your data
Hosting region
Retention controls
HIPAA and BAA plan
SSO and SCIM plan and seat minimums
Consent and recording notices
Access and sharing controls

Each item below shows how the vendors differ.

Check 1: Certifications and encryption

Ask which audits the vendor holds and how data is encrypted.

Circleback: SOC 2 Type II and EU-U.S. Data Privacy Framework certified, with data encrypted at rest and in transit. An external pentest report is available through its security portal at security.circleback.ai.
Fireflies.ai: SOC 2 Type II and GDPR on every plan from Free to Enterprise, with 256-bit AES encryption at rest and TLS in transit.
Fathom: "Fathom is HIPAA, SOC2 Type II, and GDPR-compliant."
Granola: SOC 2 Type II certification, with data encrypted at rest and in transit.
Otter.ai: TLS encryption and AES-256 encryption for real-time content on all four plans.
tl;dv: SOC 2 Type II and GDPR compliance for all users, with AES-256 encryption for stored data.

Check 2: Training on your data

Ask whether your meetings train the vendor's models, and whether you can opt out.

Circleback: "We do not use customer data to train models." That holds on every plan.
Fathom: The help center answers "Do you train AI models on customer data?" with "No!" and says none of its AI sub-processors (Anthropic, OpenAI or Google) are contractually permitted to use user data to train their models. It also says Fathom uses de-identified customer data to improve the accuracy of its proprietary AI models, and you can opt out anytime.
Granola: "Granola trains on your anonymized data so we can keep making Granola better." Enterprise users have model training turned off by default. Third parties like OpenAI or Anthropic aren't allowed to use your data to train their models. The FAQ adds that Granola cannot guarantee anonymized data wasn't used before you changed the setting.
Otter.ai: The privacy policy describes "training our proprietary AI technology on de-identified audio recordings and on transcriptions (which may contain Personal Information)".
tl;dv: "No customer data is used to train the AI."

Check 3: Hosting region

Ask where data is stored and how transfers from Europe are handled.

tl;dv: "All our data centers are located in Europe," and you can choose whether your AI is hosted in Europe or the US.
Circleback: Data is processed in the United States, and EEA and UK transfers rely on its EU-U.S. Data Privacy Framework certification, including the UK Extension. It doesn't offer EU hosting.
Fathom: "All Fathom data is stored in the United States." For EU and UK users, it says it is GDPR compliant and will sign a DPA.
Granola: "Currently, all data is stored on AWS in the US."
Otter.ai: No EU hosting, with the EU-U.S. DPF and SCCs for transfers.

Check 4: Retention controls

Ask who sets how long data is kept, and on which plan.

Circleback: Workspace admins set Recording, Transcript and "All meeting data" retention in Settings, and expired data is permanently deleted and cannot be recovered. Custom retention starts on Business, where recordings can be kept for up to 2 years and Transcript and "All meeting data" can be set to Forever. Enterprise can keep recordings forever. Free and Pro keep default retention.
Fireflies.ai: Custom data retention is Enterprise only.
Otter.ai: Custom data retention is ticked only on Enterprise.
Granola: Notes and transcripts are retained indefinitely unless a transcript auto-deletion period is set. Enterprise workspaces use a workspace-wide retention policy arranged with Granola. "We do not retain audio recordings."
Fathom: When you delete your account, all recording data and metadata are removed, and backups are cleared after an additional 7 days.

Check 5: HIPAA and BAA plan

Ask which plan includes a BAA.

Circleback: Enterprise includes its standard BAA, which a workspace admin turns on in Settings. Custom BAAs are not offered.
Fireflies.ai: HIPAA compliance is Enterprise only.
Fathom: A blanket BAA is published, and a signed BAA is listed under Enterprise.
Granola: HIPAA compliant for Enterprise customers, who can sign a BAA. It is "not available on Free, Personal, or Business plans."
Otter.ai: HIPAA compliance is an add-on on Enterprise.

Check 6: SSO and SCIM plan and seat minimums

Ask which plan includes SSO and SCIM, and whether there is a seat minimum.

Circleback: SSO (SAML and OIDC) and SCIM are Enterprise features. SCIM works with Microsoft Entra ID, Okta or Generic SCIM 2.0, and it is optional and separate from SSO. Enterprise pricing is public and graduated, per user per month on an annual plan: $35 for users 1 to 50, $30 for 51 to 100, $25 for 101 to 250, $20 for 251 to 1,000, $17.50 for 1,001 to 5,000 and $15 from 5,001. Each rate applies only to the users in that band, and no sales call is required.
Fireflies.ai: SSO and SCIM are Enterprise only.
Granola: SSO is available on Enterprise plans for organizations with 50+ seats.
Otter.ai: Enterprise lists SSO and SCIM, and each needs a minimum 100-user license.
tl;dv: SAML and OIDC SSO and SCIM provisioning are Enterprise only. Its security page says SSO sign-in is available to all users. Its seat minimum is not documented.

Ask what participants see when a call is recorded.

Granola: "You are responsible for obtaining consent from participants." Its transparency features are an automated chat message and the Granola Watermark. Individuals can turn them on for Free and Business plans, and admins can require them.
Otter.ai: The pricing table lists "Recording disclaimer email", "MS Teams recording permission capture", "Recording control and sharing permissions" and "Audio removal from conversations".

I'd ask every vendor on your shortlist to show you what participants see before you sign.

Ask who can see meetings and how admins can lock settings.

Circleback: Business adds admin and member roles, and default and enforceable settings. Conditional sharing lets you share by participant, domain, title or tag.
Otter.ai: The pricing table lists "Recording control and sharing permissions".

Quick scan

Tool	Standout answer	Plan or scope
Circleback	Custom retention controls	Business and up
Fireflies.ai	SOC 2 Type II and GDPR	Every plan
Fathom	Published blanket BAA	Signed BAA under Enterprise
Granola	Consent transparency features	Free and Business plans
Otter.ai	Custom data retention	Enterprise only
tl;dv	Data centers in Europe	All its data centers

FAQ

What should companies look for when evaluating AI meeting software security?

Check eight things: certifications and encryption, training on your data, hosting region, retention controls, HIPAA and BAA plan, SSO and SCIM plan and seat minimums, consent and recording notices, and access and sharing controls. I'd ask each vendor to answer all eight in writing.

How secure are AI-generated meeting transcripts?

A transcript is as secure as the controls around it, so check encryption, certifications, training policy and retention. Circleback, for example, is SOC 2 Type II and EU-U.S. Data Privacy Framework certified, encrypts data at rest and in transit, and does not use customer data to train models, on every plan. Workspace admins set custom retention on Business and Enterprise. Free and Pro use default retention with recordings deleted after 1 year, Business recordings are deleted after 731 days by default, and Enterprise has no default deletion.

Which AI note taker hosts data in Europe?

tl;dv says all its data centers are located in Europe. Circleback processes data in the United States, Fathom and Granola store it in the US, and Otter.ai has no EU hosting.

Which plan do I need for HIPAA?

For Circleback, you need Enterprise, which includes the standard BAA. Granola's BAA is Enterprise too, Fireflies.ai lists HIPAA compliance on Enterprise only, and Otter.ai offers HIPAA as an Enterprise add-on. Fathom publishes a blanket BAA and lists a signed BAA under Enterprise.

Does Circleback train on my meeting data?

No. Circleback states "We do not use customer data to train models," and that applies on every plan.

Which plan includes custom data retention?

Circleback's custom retention starts on Business, and Free and Pro keep default retention. Fireflies.ai and Otter.ai list custom data retention on Enterprise only.