Is Fireflies.ai safe? A sourced security and privacy review

Fireflies.ai is reasonably safe for most business meetings. Its security page lists SOC 2 Type II, GDPR and HIPAA compliance plus AES-256 encryption, it publishes a DPA, and it says it does not train AI on your meetings. The risks are the defaults: a bot that joins every calendar meeting, recaps open to anyone with the link, and US processing.

Here is every area a security review usually covers, what Fireflies publicly states, and the one thing worth checking yourself.

Fireflies' security page lists SOC 2 Type II, GDPR and HIPAA under compliance, and describes AES-256 encryption for notes and transcripts at rest and TLS for data in transit. That is the baseline you want from any cloud notetaker, and on paper Fireflies meets it.

Read the badges precisely. SOC 2 is an independent auditor's report on a company's controls over a period of time, not a permanent certificate, so the useful step is to request the latest Type II report through the Fireflies trust center and check its dates and exceptions. GDPR is a law, not a certification: what matters is the DPA, the legal basis for moving data to the US, and the sub-processor list. HIPAA depends on a contract: Fireflies' Enterprise plan guide says HIPAA support is available on request and requires a signed Business Associate Agreement (BAA). The same guide lists Enterprise at $39 per seat per month, billed annually.

Fireflies' answer is no, with one wording difference worth noticing. Its privacy policy states that it does not use personal information for AI model training. Its policy update notes add that meeting content is not used to train internal or external models, that vendors are contractually barred from training on it, and that third-party vendors keep no meeting audio, video or transcripts after processing.

The phrase “by default” is softer than the privacy policy, and the DPA lets Fireflies create deidentified data and use service data such as usage and account data to improve its products. Neither contradicts the no-training statement. If training is a hard line for your company, ask Fireflies to confirm in writing that no plan or setting changes it.

In the United States by default. Fireflies' storage guide says data is stored and processed in its cloud infrastructure in the US, on AWS and GCP. Its privacy policy adds that personal information may be processed and stored on servers in the United States and other countries.

Enterprise customers can use Private Storage to choose where recordings, transcripts and files live, including their own AWS S3 or Google Cloud Storage bucket. For EU storage, the guide is explicit about the limit:

For transfers out of Europe, the DPA relies on Fireflies' self-certification under the EU-US Data Privacy Framework, with the EU Standard Contractual Clauses as the fallback, adapted for transfers from the UK and Switzerland. That is a common, lawful setup for a US vendor, but a team with a strict EU-only processing rule should treat Fireflies as a US processor.

On retention, Fireflies says it deletes personal information tied to an account within 30 days of account deletion, and its Enterprise plan adds custom retention that deletes meetings and files automatically after a set period. On other plans, plan on deleting old meetings yourself.

Fireflies publishes its Data Processing Addendum at fireflies.ai/data-processing-agreement. The current version was last updated on March 6, 2026, is incorporated into the Terms of Service and applies to organizations that use the service, so there is no separate document to sign for the standard terms. Fireflies can update it with notice, and continued use counts as acceptance.

Five points deserve a read before procurement signs off:

• Sub-processors: the list lives at trust.fireflies.ai/subprocessors, and the policy update notes say Business and Enterprise customers can object to new ones.
• Breach notice: Fireflies commits to notify you “without undue delay”, with no fixed number of hours.
• Transfers: the EU-US Data Privacy Framework first, Standard Contractual Clauses as the fallback.
• Exit: on termination, Fireflies deletes or returns customer personal data on your instruction, unless the law requires keeping it.
• Audits: the policy update notes give Business and Enterprise customers audit rights up to once a year, at their own cost.

In practice, most Fireflies privacy problems come from defaults rather than breaches. Fireflies' own help guide states the auto-join default plainly:

Once someone connects a calendar, the Fireflies Notetaker (fred@fireflies.ai) joins every meeting with a conference link, including calls with clients and candidates who never signed up for Fireflies. You can switch this to “Only when I invite fred@fireflies.ai” in the auto-join settings.

Sharing has a similar default. Fireflies' recap privacy guide lists “Teammates & anyone with link” as the default, which means everyone in your Fireflies workspace can find the meeting and anyone holding the link can open it. Stricter options exist: “Only participants & teammates”, “Only participants”, “Only teammates” and “Only me”. On top of that, the security page describes a Super Admin role with full meeting access across the workspace.

Fireflies also offers a desktop mode on Mac and Windows that records system audio without a bot. Its guide is clear about the trade-offs: this mode saves no audio or video file, shows speakers as Speaker 1 and Speaker 2 instead of names, and if you turn off its consent notice, you are responsible for telling participants they are being captured.

Fireflies has faced proposed class actions under the Illinois Biometric Information Privacy Act (BIPA). According to court records and legal reporting, both complaints below allege that the notetaker collected and stored voiceprints of meeting participants, including people with no Fireflies account, without the notice and written consent BIPA requires. The Cruz complaint also alleges that Fireflies published no retention and destruction policy. These are allegations; no court has ruled on them.

Fireflies' privacy policy, last updated September 28, 2026, says voice data may count as biometric information in some jurisdictions, that its service providers do not use voice data to identify or authenticate people, and, in its section on the Illinois law, that such data is destroyed once its purpose is met or within three years of a person's last interaction, whichever comes first.

We found no publicly reported data breach at Fireflies when we checked in October 2026. That is not proof none happened, only that none is on the public record we could find. For the wider legal picture, including the Otter.ai class action, see our AI notetaker lawsuit tracker.

Fireflies is a sensible pick when:

• You want a bot that can record meetings you do not attend, with a saved audio and video file afterwards.
• You want named speakers in the transcript and the integrations built around the Fireflies Notetaker.
• Your company is US-based and comfortable with US processing under a DPA.
• You are on Enterprise and need HIPAA with a signed BAA, SSO, Private Storage or custom retention.

Think twice when:

• You meet with people in Illinois or in all-party-consent places and cannot be sure everyone agreed to recording.
• Clients or candidates object to a third-party bot on their calls.
• You need EU-only processing, not just EU storage.
• You would handle health data without a signed BAA.

1. Set auto-join to “Only when I invite fred@fireflies.ai” so the bot never joins a call by surprise.
2. Change the default recap privacy from “Teammates & anyone with link” to “Only participants” or “Only me”.
3. Check who holds Super Admin, since that role has full meeting access across the workspace.
4. Keep the consent notice on, and say out loud that the meeting is being recorded.
5. Download the DPA and the sub-processor list and file them with your vendor records.
6. Ask for the current SOC 2 Type II report; on Enterprise, set a retention period and sign a BAA if you handle health data.

The same questions work for Fireflies, Otter, Read AI or Reline. A vendor that cannot answer them in writing has answered them anyway.

1. Does a bot join the call, and does it auto-join by default?
2. Who can see a meeting by default: only me, the participants, the whole workspace, or anyone with the link?
3. Do you train AI models on my audio, transcripts or notes, under any plan or setting?
4. Where is data stored, where is it processed, and on which cloud providers?
5. Is there a DPA, a public sub-processor list and a breach notice commitment?
6. Which audits can you show me today, as a report rather than a badge?
7. How long do you keep recordings and transcripts, and can I set that period myself?

Reline is a competing notetaker, so weigh this section accordingly. Reline never sends a bot: it captures your microphone and system audio locally on Mac, Windows, Linux (beta) or in the browser, so no extra participant appears in the call. Transcription, AI notes and storage run in the cloud, not on your device.

Notes are private by default: a workspace role alone gives no one access to a note. Reline has no SOC 2 report and no HIPAA BAA today, so if your procurement requires those, Fireflies lists a SOC 2 Type II audit and offers a BAA on Enterprise, and Reline does not. Bot-free capture does not replace consent either: you still tell people you are recording wherever the law requires it.

• Fireflies, Security and compliance page: https://fireflies.ai/security
• Fireflies, Data Processing Addendum (updated March 6, 2026): https://fireflies.ai/data-processing-agreement
• Fireflies, Updates to Privacy Policy, Terms and DPA: https://guide.fireflies.ai/articles/6892479029
• Fireflies, Data storage and transfer guide: https://guide.fireflies.ai/articles/9596505232
• Fireflies, Enterprise plan guide: https://guide.fireflies.ai/articles/4771323041-learn-about-fireflies-enterprise-plan
• Fireflies, Recap privacy settings guide: https://guide.fireflies.ai/articles/5319481450-how-to-configure-privacy-settings-for-your-meeting-recaps
• Fireflies, Auto-join settings guide: https://guide.fireflies.ai/articles/8587670572-how-to-disable-the-fireflies-auto-join-settings
• Fireflies, Recording without a bot on the desktop app: https://guide.fireflies.ai/articles/6666374717-how-to-record-meetings-without-a-bot-on-the-fireflies-desktop-app
• Fireflies, Privacy Policy (updated September 28, 2026): https://fireflies.ai/privacy-policy
• Cruz v. Fireflies.AI Corp docket (PacerMonitor): https://www.pacermonitor.com/public/case/61918314/Cruz_v_FirefliesAI_Corp
• Smith, Gambrell & Russell, AI note-takers and BIPA (March 16, 2026): https://www.sgrlaw.com/newsroom/publications/ai-note-takers-biometric-privacy-and-the-battle-over-bipa-damages-what-businesses-need-to-know-now
• Top Class Actions, Fricker v. Fireflies.AI Corp. (March 19, 2026): https://topclassactions.com/lawsuit-settlements/lawsuit-news/fireflies-ai-sued-over-alleged-unlawful-data-collection-from-meeting-participants/