SOC 2 certified AI meeting assistant: 2026 buyer’s guide

Strictly speaking, no AI meeting assistant is “SOC 2 certified”: SOC 2 is an audit report issued by an independent CPA firm, not a certification. Fireflies, Otter, Granola, Fathom, Noota, Modjo, MeetGeek and tl;dv state a SOC 2 Type II report. Ask for the report, then check its type, period and scope.

We make Reline, so read this as a vendor’s guide. Reline has no SOC 2 report today; we explain below what it has instead. Every fact about another tool comes from that vendor’s own page, checked on 22 October 2026, and may change.

SOC 2 is a framework from the AICPA, the American Institute of Certified Public Accountants. An independent CPA firm examines a service provider’s controls against the Trust Services Criteria, which have five categories: security, availability, processing integrity, confidentiality and privacy. Security is mandatory; the provider picks any of the other four. The auditor then gives an opinion in a report, usually shared with customers under an NDA.

That line is from Microsoft’s documentation. Microsoft has Office 365 audited over a rolling 12-month window, 1 October to 30 September, and issues “bridge letters” between reports to cover the gap: statements from Microsoft itself, not auditor reports.

ISO 27001 is a certification: a body certifies a security management system and issues a certificate valid for three years. SOC 2 is an attestation: a report that describes a system and gives an opinion. Vendors say “SOC 2 certified” all the time, but the right question is still: “Can you send me your latest SOC 2 Type II report?” European buyers also often ask for ISO 27001, and some sectors add their own schemes, such as HDS for health data in France.

1. Type and period: Type II, with a period that ended less than 12 months ago. If not, ask for the bridge letter that covers the gap.
2. Scope (the system description): are the meeting assistant and its AI features in it? A report can cover the core platform and leave out a newer product. Zoom, for example, explicitly lists AI Companion in the scope of its report.
3. Criteria covered: security only, or also confidentiality and privacy? For meeting recordings, those two matter.
4. The auditor’s opinion: an unqualified opinion is the expected norm; a qualified one needs a written explanation.
5. Exceptions and management responses: a few exceptions are normal; what matters is what they were and how they were fixed.
6. Subservice organizations: hosting, transcription and AI providers. If they are carved out of scope, ask for their own reports.
7. Your side of the controls (complementary user entity controls, or CUECs, listed in the report): SSO, access reviews, offboarding. The report assumes you do them.

The table below reports what each vendor says on its own page, checked on 22 October 2026. It is the vendor’s statement, not our audit: only the report itself is proof.

How to read this: if SOC 2 Type II is a procurement requirement, Fireflies, Otter, Granola, Fathom, Noota, Modjo, MeetGeek and tl;dv state it; ask them for the report. Jamie states a Type II still pending. If you want both SOC 2 Type II and European hosting, Noota, Modjo and tl;dv state both; Noota also states ISO 27001. If your company’s video platform is enough, Zoom’s and Teams’ AI features inherit their platform’s reports, subject to scope.

• GDPR. A SOC 2 report does not replace the Article 28 data processing agreement, your lawful basis or notice to the people recorded.
• Where data lives and how it moves. SOC 2 does not say where data is hosted. For a US vendor, an EU company needs a transfer mechanism: the Data Privacy Framework or Standard Contractual Clauses.
• Model training. A vendor can hold an excellent SOC 2 report and still train models on de-identified data: Otter’s privacy policy says so, for example. Read the DPA and the privacy policy.
• Retention. How long do audio, transcripts and meeting notes stay stored, and is deletion complete?
• Participant consent. Visible bot or bot-free capture, the duty to inform everyone in the meeting stays yours.
• The future. A report describes a past period. What changed since (a new AI feature, a new subprocessor) is not in it.

For the GDPR side in depth (DPA, transfers, retention, works councils), see our guide to GDPR-compliant AI notetakers. For the full checklist an IT team runs, see our approval checklist.

1. Can you send your latest SOC 2 Type II report and the current bridge letter?
2. Are the meeting assistant, transcription and AI features in scope?
3. Which criteria are covered besides security?
4. Which exceptions did the auditor note, and how did you fix them?
5. Which subprocessors handle audio and transcripts, in which country, and do they have their own reports?
6. Where is data stored and processed, and under which transfer mechanism?
7. Do you train models on our meetings, and are your AI providers allowed to?
8. Does the DPA cover the plan we buy, or only Enterprise?

Reline has no SOC 2 report today. SOC 2 Type II is on its roadmap; Reline also has no ISO 27001 and no HIPAA BAA. If a SOC 2 Type II report is a hard requirement for your procurement team, Reline is not the right pick today.

Here is what Reline does have, as published on its security page: TLS 1.2 or higher on every request, encryption at rest for the database and recordings, notes private by default with five-level permissions, an append-only activity log on every note (all plans) plus a workspace audit log on Enterprise, and SSO with Google and Microsoft on request for Enterprise. The DPA is pre-signed at reline.so/dpa, the subprocessor list is public, and Reline does not train models on your data. Data is hosted in the USA under the EU Standard Contractual Clauses. Security documentation is shared under NDA.

On the product side, Reline captures your microphone and system audio locally, with no bot in the call; transcription, AI and storage run in the cloud. If the visible bot is your real problem, our French-language round-up of bot-free AI notetakers covers the options.