Are AI meeting notetakers private?
Mostly, no — not in the sense people assume. Cloud notetakers (Otter, Fireflies, Fathom, tl;dv) upload, process, and store your meetings on their servers under their retention and security policies. A notetaker is only truly private when recording, transcription, and storage happen on infrastructure you control — which is what privately hosted tools like Donna do.
What happens to my meeting data on a cloud notetaker?
Your audio (often video) is uploaded to the vendor, transcribed on their compute, summarized by their AI stack — frequently involving further third-party AI providers — and stored under their retention policy. You hold an account; they hold the data. Vendors publish compliance pages (SOC 2, GDPR) that attest to how they protect that copy, but the copy exists, and it is subject to their breach surface, their subpoenas, and their policy changes.
How does private hosting change the privacy answer?
It removes the vendor copy entirely. With Donna, recording happens on your own server, files stay on your disk, the transcript and report live in your own database, and the dashboard sits behind authentication you configure. The only external calls are the ones you make with your own API keys — audio to Flocci Speech Recognition for transcription, text to Flocci Intelligence for analysis — under agreements you hold directly. There is no notetaker vendor in your data path at all.
What should I check before trusting any notetaker?
Ask four questions. Where is the recording stored, and can I point to the machine? Who holds the AI provider relationships — me or a middleman? What is the retention policy, and who enforces it? And can a third party change these answers without my consent? A cloud notetaker answers all four with “the vendor.” A privately hosted one answers all four with “you.”
Related questions
Are meeting recordings used to train AI models?
Policies vary by vendor and plan tier, and they change — that is precisely the problem with holding your meetings in someone else’s cloud. With a privately hosted pipeline, no vendor holds a corpus of your meetings to make training decisions about.
Is a SOC 2 badge enough to call a notetaker private?
SOC 2 attests that the vendor protects the copy of your data it keeps. It does not remove the copy. Whether that is “private enough” depends on what is being discussed in your meetings — for boards, HR, negotiations, and client work, many teams conclude it is not.
Does privately hosted mean fully offline?
Not in Donna’s case: transcription and analysis are API calls made with your own keys. Fully offline pipelines exist (fully local speech models), trading convenience and quality for airgap. The decisive privacy step is removing the vendor’s stored copy — private hosting does that.
Put Donna in your next meeting
Access is open — sign in with your Google account and she’s in your dashboard in minutes. Rolling out to a whole team, or want a hand with the server setup? We’re glad to help.