AI Meeting Summary Privacy:
What These Tools Do With Your Data

Most AI meeting tools store your audio on cloud servers. Some train models on it. Here is a tool-by-tool breakdown and a checklist for picking one that handles your data on your terms.

Last updated: April 2026

Most AI meeting tools store your audio or transcripts on cloud servers -- and some use that data to improve their models. Before you let an AI notetaker into your next sales call, board meeting, or HR review, it is worth knowing exactly what happens to your meeting content once the call ends.

Julia manages HR at a fintech startup in Amsterdam. She used Otter.ai for performance review notes for six months -- clean, searchable, easy to reference later. Then an employee filed a GDPR data subject access request, asking for every piece of data the company held about them. Julia discovered that OtterPilot, the bot Otter sends to record meetings, had uploaded audio from every review to Otter's cloud servers. The transcripts were there too. She had no data retention policy for her meeting notetaker. She didn't know she needed one.

She wasn't being careless. She just hadn't thought about where the data lived. This article explains the five privacy risks embedded in most AI meeting tools, how the four leading platforms compare, and what to look for in a tool that actually protects your meeting content.

Key Takeaways

Why "GDPR Compliant" Is Not Enough

Every major AI meeting tool carries a compliance badge. Otter.ai is SOC 2 Type 2 certified and offers a GDPR Data Processing Agreement. So does Fireflies.ai. Zoom has ISO 27001. Microsoft has all of the above and more.

A compliance badge tells you the vendor has audited data-handling processes. It does not tell you whether your audio is stored server-side, how long your transcripts are kept by default, whether your meeting content contributes to model training, or how a US government subpoena would affect your data under the CLOUD Act.

Architecture matters more than policy. A tool can be GDPR-compliant and still store your audio indefinitely on a US server. "Compliant" means they handle the data responsibly -- not that they don't hold it.

The Five Privacy Risks in AI Meeting Tools

1. Cloud Audio Storage

Most AI meeting tools send your audio to their servers for processing. That audio may be retained for transcription quality review, dispute resolution, or as a default. Retention periods vary widely: some tools delete after 30 days, others keep audio until you manually request deletion. The practical risk is a data breach at the vendor that exposes actual recordings. For HR discussions, M&A calls, or legal consultations, that is a significant exposure.

2. Transcript and Summary Retention

Even when audio isn't kept long-term, transcripts and AI summaries almost always are. They live on the vendor's servers until you delete them. On the free tiers of some tools, they are kept indefinitely. Every meeting summary becomes a persistent record held by a third party.

3. Your Meetings May Train Their Models

Some tools use meeting data -- anonymized or otherwise -- to improve their AI. This is often disclosed in privacy policies as "we may use aggregated, de-identified data to improve our services." Whether your specific meeting content is included depends on your plan tier, the settings you've opted into, and the vendor's current policy, which changes. Check for an explicit opt-out. Enterprise plans typically offer one; free-tier users should read the current policy before recording sensitive calls.

4. The Bot Consent Problem

Tools like Otter.ai and Fireflies.ai work by sending a bot attendee to your meeting. That bot is visible to everyone in the room. In the EU, UK, and many US states, recording a conversation without informed consent from all parties can violate privacy law. If an attendee didn't notice the bot and later objects, the host -- not the vendor -- bears the legal exposure.

5. Jurisdiction and Legal Access

Otter, Fireflies, Zoom, and Microsoft are all US-headquartered or store data on US infrastructure. Under the US CLOUD Act (2018), US law enforcement can compel US cloud providers to produce data stored anywhere in the world -- including EU or Asian data centers. For European businesses handling commercially sensitive or personally identifiable information, this creates a jurisdictional gap that no GDPR DPA fully closes.

What Each Tool Actually Does With Your Data

Tool Audio stored? Transcript stored? Visible bot? Model training?
Otter.ai Cloud (US, AWS) Until deleted Yes (OtterPilot) Opt-out (paid tiers)
Fireflies.ai Cloud (US) Free: indefinitely Yes (fred@fireflies.ai) Not specified
Zoom AI Companion In-call only Zoom cloud No bot (native) No customer content training
Teams Premium If recording is enabled Microsoft 365 storage + Exchange No bot (native) No customer content training
MirrorCaption Never Browser only Never No

Otter.ai

Otter stores audio on cloud infrastructure (AWS, US-based). Transcripts are kept until you delete them. OtterPilot joins meetings as a visible bot. SOC 2 Type 2 certification and a GDPR DPA are available for enterprise accounts.

Honest strength: best-in-class English transcript quality and a clear enterprise compliance story for large teams. Honest limitation: bot joins visibly, audio is cloud-stored, and the model-training opt-out is clearest on paid enterprise tiers. Verify the current privacy policy for your plan before using Otter for sensitive calls.

Fireflies.ai

Marcus runs enterprise sales at a Berlin SaaS startup. He set up Fireflies to record every prospect demo. On his third call after enabling it, a Tokyo VP noticed the attendee list: "fred@fireflies.ai has joined the meeting." She asked who that was. He explained it was an AI notetaker. She replied: "We have a strict policy about third-party attendees on sales calls." The call ended. Follow-up emails went unanswered. The deal had been at term-sheet stage. The bot was doing exactly what it was designed to do. The consent wasn't there.

Fireflies stores audio recordings and transcripts on US cloud servers. On the free plan, data is retained indefinitely unless you manually delete it. There is no option to run Fireflies without a bot attendee -- fred@fireflies.ai is the only mechanism. Honest strength: best CRM integration story for sales teams. Honest limitation: bot is unavoidable and is the most visible of any tool on this list.

Zoom AI Companion

Zoom AI Companion is a native feature -- no separate bot attendee. That solves the visible-consent problem. Summaries are generated within Zoom's cloud infrastructure, and Zoom says customer audio, video, chat, screen sharing, attachments, and similar communications content are not used to train Zoom or third-party AI models. Honest strength: frictionless for Zoom-only teams; no extra signup. Honest limitation: platform lock-in; admins still need to review retention and recording policies before enabling it for sensitive calls.

Microsoft Teams Premium

Teams Premium (Intelligent Recap) keeps recap artifacts inside Microsoft 365, but storage is split across services: recordings live in OneDrive or SharePoint, while transcript copies and recap data can also be stored in Exchange Online. Microsoft says customer data from Teams meetings is not used to train its foundation models. Honest strength: strong native governance for organizations already running on Microsoft 365. Honest limitation: Teams-only; additional licensing cost; storage and retention span multiple Microsoft services that admins need to govern explicitly.

Want a meeting tool where the audio never leaves your browser? MirrorCaption processes everything locally -- no server storage, no bot, 60+ languages.

Try Free →

The Architecture Difference: Browser vs. Cloud

The tools above share one design assumption: audio flows to a remote server for processing, and something is stored there. That is not the only way to build a meeting tool.

MirrorCaption captures audio through the browser using the Web Audio API and streams it directly to Soniox's real-time speech-to-text engine. The audio is then discarded -- it never touches MirrorCaption's servers. Transcripts are saved in your browser's IndexedDB, a local storage layer that doesn't synchronize to the cloud unless you explicitly export the file. The only data MirrorCaption's servers see is billing usage: minutes consumed, not content.

API keys for Soniox are issued with a 2-second time-to-live and AES-GCM encryption, so not even the STT credential is exposed at rest. The practical result: a data breach at MirrorCaption would expose billing records, not meeting transcripts or audio files.

Limitation to acknowledge honestly: MirrorCaption does not yet have a SOC 2 certification. If your organization requires a vendor SOC 2 report for procurement, that is a real gap. The privacy story is architectural, not compliance-badge-driven. For regulated industries with formal vendor assessment processes, Teams Premium is currently the stronger compliance answer.

What GDPR and CCPA Actually Require for Meeting Recordings

Do You Need Consent from All Participants?

Under GDPR and most EU member-state laws, you generally need informed consent from all parties before recording a conversation. "Informed" is the operative word. A bot appearing in the attendee list may constitute notice -- but only if participants see it and understand its purpose. For international calls where participants may not read the attendee list in their second language, that is an assumption worth examining before you hit record.

Cross-Border Calls: Which Jurisdiction Applies?

For a call between a German employee and a Japanese client, recorded via a US-based tool, three jurisdictions potentially apply: GDPR (EU data subject), Japan's APPI (Japanese privacy law), and US data law (where the tool stores data). The safest approach: get explicit verbal or written consent from all participants, document it, and choose a tool that doesn't add a fourth party's data exposure to the equation.

A Privacy Checklist for Any AI Meeting Tool

Before enabling an AI meeting tool for sensitive calls, ask these six questions:

  1. 1Where is the audio stored, and for how long? Ask for a specific retention period, not just "we follow best practices."
  2. 2Who owns the transcript data, and can you export and fully delete all records?
  3. 3Does the tool join as a visible bot? If yes, do all meeting participants consent to its presence?
  4. 4Can you opt out of model training? Look for this in the privacy settings, not just the policy document.
  5. 5Which legal jurisdiction governs your data? If the tool is US-based, understand your CLOUD Act exposure.
  6. 6How do you delete everything if you leave the platform? Test this before the tool handles sensitive calls.

Frequently Asked Questions

Do AI meeting tools need consent from everyone in the meeting?

In most EU jurisdictions and many US states, yes -- you need informed consent from all parties before recording. A bot appearing in the attendee list may constitute notice, but it is not a substitute for explicit consent, especially on cross-border calls where participants may read the attendee list in a second language.

Can I use AI meeting notes without a bot showing up in the meeting?

Yes. Zoom AI Companion and Microsoft Teams Intelligent Recap work natively within their platforms without a separate bot attendee. MirrorCaption captures audio through the browser without joining the meeting at all -- other participants see nothing added to the call.

Is there an AI meeting tool that does not store my audio on its servers?

MirrorCaption processes audio in-browser via Soniox streaming STT. The audio is never stored server-side and is discarded after transcription. Transcripts are saved only in your browser's IndexedDB local storage. You can read more about how it compares to the rest of the field in our meeting translator comparison for 2026 and our Fireflies comparison.

How do I delete my meeting data from Otter.ai or Fireflies.ai?

For Otter.ai: go to Settings, then Data and Privacy, or submit a deletion request through their support channel. For Fireflies.ai: delete individual recordings from the notebook, or submit a full account-deletion request. Note that free-tier data may persist in backups for a period after deletion -- check the current privacy policy for the exact timeline.

Are AI meeting summaries safe for legal or medical calls?

It depends on the tool and jurisdiction. For HIPAA-covered communications in the US, you need a Business Associate Agreement (BAA) with the vendor -- Zoom and Microsoft offer these under certain enterprise plans. For privileged legal communications, the safest approach is a tool that never stores audio or transcripts on third-party servers. Verify your vendor's current BAA availability before using any AI tool on regulated calls.

Does "GDPR compliant" mean an AI meeting tool is actually private?

No. GDPR compliance means the vendor has a Data Processing Agreement, respects data subject rights, and processes data under a lawful basis. It does not prevent them from storing your audio, using it for model improvement (with opt-out), or being subject to the US CLOUD Act if they are US-headquartered. Compliance and privacy are related but distinct. Architecture determines what data exists to be exposed; compliance determines how it is handled.

The Bottom Line

A Frankfurt law firm allowed associates to use Zoom AI Companion on client calls without setting a clear policy for which meetings could be recorded, transcribed, or summarized. Six months later, the managing partner discovered that recap artifacts from sensitive client calls were scattered across the tenant and had to be audited matter by matter. The lesson was mundane but expensive: native AI features still need retention rules, access controls, and a documented rollout before anyone enables them on privileged conversations.

The lesson is not that AI meeting tools are dangerous. It is that default settings, data architecture, and vendor jurisdiction all matter more than the compliance badge on the pricing page.

Here is the short decision guide:

Architecture determines what is recoverable if something goes wrong. Choose a meeting tool the same way you would choose any data processor: based on what it does with your data, not what it says about it.

No server storage. No bot. 60+ languages.

MirrorCaption processes audio in your browser and discards it. Transcripts stay on your device. Start with 2 free hours every month.

Start Free -- No Credit Card