Are AI Note Takers Safe? A Security and Privacy Checklist

Yes, AI note takers can be safe for most work meetings, but safety depends on the tool, not the category. Check seven things before you approve one: whether a bot joins, where audio and transcripts are stored and for how long, whether your meetings train AI, who can open the notes, admin controls and logs, consent, and certifications.

This guide is for the person who has to say yes: an IT lead, a security reviewer, or the manager who gets asked first. Every vendor fact below comes from that vendor's own pages, read in November 2026. Reline makes an AI note taker, so we answer each check for Reline too, including the ones where it falls short.

Paste this into your vendor review and ask for evidence rather than a yes: a help-center page, a screenshot of the setting or a signed document.

From a data-security standpoint, a note taker that joins as a bot and one that records on your computer differ in where the recording is made, what it can capture and who controls the door. They do not differ in whether your audio reaches a cloud: most tools of both kinds, Reline included, transcribe and store it there.

Microsoft states the bot risk plainly in its Teams admin documentation. External note-taking bots, it says, may:

That is why Teams now detects external bots and, under its default policy, keeps them in the lobby until the organizer explicitly admits them. Microsoft adds that detection misses some bots and now and then flags a human (Microsoft Learn, updated July 2026).

A bot-free app closes that door and leaves another one open. Nothing appears in the participant list, so the host's controls never see it and the duty to tell people moves entirely to you. And because it records what your computer plays, it hears everything that plays while it runs: close the video in the other tab before you start recording.

Our view: for internal calls, and for client calls where people expect you to take notes, an app on your own computer is the smaller exposure, because it captures less and never attends without you. A bot earns its place when you need a record of meetings you cannot join, or when you want every participant to see the recorder by default. Either way, the cloud questions below matter more than the bot.

There is a third option: the assistant built into the meeting platform, such as Copilot in Teams, Gemini in Google Meet or Zoom's AI Companion. Nothing new joins, and the data stays with a vendor you have already approved. Microsoft says prompts, responses and data accessed through Microsoft Graph are not used to train its foundation models, and Google says Workspace does not use customer data to train models without permission. The catch: the host's license and admin settings decide whether it runs, so it rarely helps on someone else's call.

We read each vendor's own privacy policy, security page, pricing page and help center in November 2026. Not stated means we did not find it on those pages, not that the feature is missing. Policies change, so check the date on the page before you sign.

Every AI note taker moves your words through three stages, and each one raises its own storage question:

1. Capture. A bot records on the vendor's servers; a desktop app records on your computer.
2. Transcription. Almost always a cloud speech-to-text service, run by the vendor or by a provider on its sub-processor list.
3. Storage and AI. The transcript, the notes and often the audio sit in the vendor's database and file storage, and summaries or chat answers come from language models, usually a third party's.

Retention is where the tools split. Granola deletes the audio once transcription is done, so only the transcript remains. Otter and Reline keep the recording with the note until you delete it, though Otter's pricing page also lists custom data retention among its admin features. Fathom and Fireflies offer custom retention on Enterprise, and Granola lets each user, or an Enterprise admin for everyone, set an auto-delete period for transcripts.

Neither choice is free. Deleted audio cannot leak, but it cannot settle what was really said either: a misheard number looks exactly like a correct one. Kept audio lets you check the transcript against the recording, and it is one more thing to govern. Ask which one you get, and what delete removes: the audio, the transcript, the summary and every AI output, or only the note you can see.

It is as secure as the service doing it and the contract around it. Most note takers transcribe in the cloud, so check four things: the audio is encrypted in transit and at rest, the speech-to-text provider is on the sub-processor list, it does not train on your audio, and it keeps nothing once the text is back, or says how long it does.

In Reline, audio streams to its speech-to-text provider while you record, and the transcript appears live. Notes, transcripts and recordings stay until you delete them, with no time limit on any plan. A deleted note waits in the trash for 30 days, then it is removed for good with its recording, transcript, chat history and AI outputs. There is no admin-set auto-delete schedule yet, which matters if your policy needs one. Ask Reline where your data is stored and which providers process it; there is no EU data-residency option today.

Ask about two layers. First the vendor's own models: does it train them on your meetings, even de-identified? Then its AI providers: may the company behind the summaries train on what it receives?

On the first layer, answers vary widely as of November 2026. Otter's privacy policy lists training its own AI on de-identified audio and transcripts. Fathom's says de-identified meeting data may train its in-house models unless you opt out in your account settings. Granola uses anonymised data from its Free and Business plans unless each user opts out, and its FAQ says it cannot guarantee that data used before an opt-out was left out. Fireflies, tl;dv and Reline say they do not train on customer data, and Read AI makes training opt-in.

On the second layer, Otter, Fathom and Granola state that their AI providers may not train on customer data, and Fireflies describes zero-day retention with its AI vendors. Get both commitments into the contract, because a promise of no training says nothing about how long a provider keeps what it receives.

Reline's privacy policy says Reline does not use your audio, transcripts or notes to train AI models. Summaries and chat run on third-party language models through Vercel's AI Gateway; ask Reline which providers process your data. Put the same question to every vendor: it is how you check who actually handles your meetings.

The everyday risk is a note that reaches more people than anyone intended: a recap emailed to every attendee, a library the whole company can search, a link that kept working. Check three defaults:

• New notes: private to the person who recorded them, visible to the whole workspace, or shared by link?
• Admins: can an admin open every note? Fireflies has a Super Admin role with access to every meeting in the workspace; Granola says admins cannot view individual private notes.
• Recaps and links: does the tool send notes to attendees on its own, and do links stay off until someone turns them on? Otter's pricing page describes its notetaker joining Zoom, Teams and Meet to write and share notes automatically, so check where they go.

Reline is private by default. A new note is private to you until you share it or put it in a shared folder or teamspace. Click Share to add people or a teamspace at Full access, Can edit, Can comment or Can view; a workspace role on its own, Owner and Admin included, opens nothing. The Share to Web switch stays off until you turn it on, and then you choose Anyone with the link or Only people invited. The one wide door is an Open teamspace, where everyone with the Member role can edit its content, so keep sensitive calls in a Closed or Private one. One exception keeps work from being lost: when a note's creator leaves the workspace, the workspace Owner can open the notes they left outside Closed and Private teamspaces.

For IT the questions are concrete: can we force sign-in through our identity provider, remove leavers automatically, lock public links, set retention for everyone, and show afterwards who did what? Here is what vendors publish:

• Fireflies documents Enterprise audit events, queried through its API, that include meeting views, shares, downloads and deletions, role changes, and log-ins.
• Otter lists activity logs on its Business plan, and SSO and SCIM with a 100-user minimum.
• Fathom lists SSO and SCIM provisioning on Enterprise. Granola offers SSO on Enterprise for 50 seats or more, with org-wide sharing limits and retention.
• Jamie, another bot-free note taker, documents an Enterprise audit log across 14 categories, sign-ins included, with a CSV export.

Reline's logs are thinner. On every plan, a folder's Activity tab shows when it was created, renamed, moved, shared or put in the trash. Notes keep a similar history that the app does not show yet, and it is deleted with the note. None of these logs records sign-ins, exports, note views or public-link views. Enterprise workspaces also record invitations and changes to roles, teamspaces, settings and policies in an audit log, but its page is not in the app's settings menu yet. The controls go further: on every plan, admins can use Data controls to stop members copying or moving notes to another workspace, and on Enterprise the workspace Owner can switch off public links for the whole workspace, which also stops existing links from opening, and limit workspace invitations to your email domains. People sign in with Google, Microsoft or email; Reline cannot yet require sign-in through your identity provider, and SAML and SCIM are on the roadmap. If you need SSO, view-level logs or automatic offboarding today, Reline is not there yet.

Recording law applies whether a bot joins or not. US federal law needs one party's consent, but about a dozen states, including California, Florida and Illinois, generally require everyone's. In the EU and the UK, data protection law covers recordings of people. When participants sit in different places, follow the strictest rule.

Courts are testing both kinds of tool. In August 2026 a federal court in California declined to dismiss wiretap and Illinois biometric privacy claims against Otter (In re Otter.AI Privacy Litigation); they are still allegations, not findings. A proposed class action filed in the same court on July 30, 2026, Chamberlain v. Granola, alleges that bot-free capture recorded people without notice; those allegations are untested. Skipping the bot does not skip the consent question.

1. Put a line in the invite: who records, why, and where the notes go.
2. Say it again at the start, before you record, and ask whether anyone objects.
3. If someone says no, stop and take notes by hand.

Some bot-free apps can announce the recording for you: Fireflies' desktop app offers a meeting chat notification on Mac and an audio consent message. Reline has no in-call notice. It never joins the call, so nobody sees a recorder, and telling people is your job. To help, Reline publishes a plain-language notice for meeting participants at reline.so/participants: what may have been collected, who decides what happens to it, and how to object or ask for deletion without an account. Link it in your invite.

• SOC 2 Type II: an independent auditor tested the vendor's security controls over a period, usually 3 to 12 months. The result is a report you request under NDA; check its dates and what is in scope.
• ISO 27001: a certificate for an information security management system, audited against a published standard.
• HIPAA: no certificate exists. If you record health information for a covered entity, you need a signed Business Associate Agreement, usually only on an enterprise plan.
• GDPR: no certificate either. Look for a DPA, a public sub-processor list and a transfer mechanism such as the EU Standard Contractual Clauses.

Reline has no SOC 2 report, no ISO 27001 certificate and no HIPAA BAA today. Do not use it for health records, and if your security review requires a SOC 2 report, Reline does not pass yet. What it has: a public DPA with Standard Contractual Clauses, a public sub-processor list, encryption in transit and at rest, and a status table on its security page that lists SOC 2 Type II as on the roadmap.

• Health information, unless your plan comes with a signed BAA.
• Legal advice you need to keep privileged. Law firms warn that a third party processing the conversation can put privilege at risk, so ask counsel first.
• Disciplinary or investigation meetings where the people involved have not agreed to a recording.
• Any meeting where someone says no.

For everything else, our view is that approving one tool that passes these checks beats a ban. A ban tends to push people toward personal accounts nobody has reviewed; an approved tool comes with settings, a contract and logs.

The same seven checks, answered for Reline as of November 2026, gaps included.

Try it on a low-stakes call first. Install the desktop app, open a note and press Start: the transcript appears as people talk. When you stop, press Generate notes, then click Share and read the access list before you add anyone. The Free plan includes 10 hours of transcription and up to 1 hour of recording per note; Professional is $15 a month, or $12 a month billed yearly.

Sources, read in November 2026 on each vendor's own pages: Otter's privacy policy (effective June 16, 2026), privacy and security page, pricing and desktop pages; Fireflies' security page, its help guide on recording without a bot and its API docs on audit events; Fathom's privacy policy (updated August 16, 2026), overview and pricing pages; Granola's security, privacy and data FAQ; Read AI's privacy page; tl;dv's security commitment and desktop app pages; Jamie's audit log docs; Microsoft Learn on external bots in Teams and on Copilot data privacy; Google's Generative AI in Google Workspace Privacy Hub; Barnes & Thornburg (August 12, 2026) and Baird Holm (August 24, 2026) on the Granola and Otter cases; Polsinelli (February 2026) on privilege; Reline's privacy policy, DPA, sub-processor list and security page.