Fireflies.ai safety profile

What it does with your data

Fireflies.ai records your meetings and turns them into transcripts and summaries. The short answer on training: the vendor says meeting content is never used to train any AI model, its own or anyone else’s. That covers audio, video, transcripts and summaries. The pages checked state no tier exception.

The promise also reaches the vendor’s own suppliers. Fireflies.ai says it contractually bars transcription providers and AI services such as OpenAI and Anthropic from training on your meetings.

On storage, the vendor describes a Zero Data Retention policy with those suppliers. They do not keep meeting content after processing and lose access once the job is done. Backups cover system settings and metadata, not sensitive meeting content. Users can delete their data at any time.

Personal information tied to an account is kept while the account is active and deleted within 30 days after it closes. For business customers, meeting content falls under the contract instead. The pages checked do not mention human review of recordings.

Settings to change first

Because the vendor says it never trains on meeting content, there is no training setting to switch off. The vendor pages checked do not describe a training opt-out or give any menu paths.

Before staff connect their calendars, work through these steps:

1. Decide who in your organization may use the notetaker, and for which kinds of meetings.
2. Ask your admin to set up Groups so that workspace access and user permissions match those decisions.
3. Agree on a retention rule, for example deleting recordings once notes are filed. Admins can manage data retention, and users can delete their own data.
4. Turn on single sign-on if your plan offers it, so leavers lose access when their main account is closed.

Free and paid tiers

The vendor pages checked do not compare free and paid individual plans. You cannot tell from them whether a free account handles data any differently from a paid one.

What the pages do make clear is that several protections sit only on Enterprise:

• Private Storage, which keeps meeting data at a location the customer chooses
• The Rules Engine, which sets organization-wide rules for recording, transcription and retention
• The Business Associate Agreement for healthcare and the Data Sharing Agreement for education, both tied to Enterprise with Private Storage

There is one more difference for business customers. Their meeting content is governed by the Terms of Service and the Data Processing Agreement, not by the privacy policy. Read those documents for your plan before you rely on the privacy policy alone.

Admin controls

Admins can manage data retention, control workspace access and set user permissions through Groups. The vendor also offers single sign-on for team access. The pages checked do not say which plans include these features.

The Enterprise security list adds three tools: the Rules Engine, Custom Data Retention and a Super Admin role. Super Admin gives full meeting access across the workspace, so give it to as few people as possible.

For certifications, Fireflies.ai lists SOC 2 Type II, audited every year, and ISO/IEC 42001 for AI governance. It claims GDPR, HIPAA and FERPA compliance. It has also certified adherence to the EU-U.S. and Swiss-U.S. Data Privacy Frameworks and the UK Extension.

Using it with donor and client data

The no-training promise is a good start. Recording a call still creates a lasting copy of everything said in it, so plan which conversations get recorded.

Never record or upload meetings where people discuss:

• Donor names alongside gift amounts or giving history
• Client case notes or anything that identifies a person you serve
• Health information or payment card and bank details

If your work touches health or student records, the BAA and DSA are only on Enterprise with Private Storage. A free or lower plan is the wrong place for that data.

The vendor pages checked do not describe a training opt-out, and they do not compare plans. Get these answers in writing before staff use the tool with donor data:

• How long your plan keeps transcripts and recordings on the vendor’s side
• Where your meeting data is stored if you are not on Enterprise
• Whether the no-training promise appears in your contract

Questions people ask

Will Fireflies.ai use our donor meetings to train AI?

The vendor says no. Meeting content is never used to train internal or external AI models, and its suppliers are contractually barred from training on it.

Can we keep our data in a particular country?

Only on Enterprise, through Private Storage, which stores meeting data at your preferred location. Otherwise data is processed and stored in the United States and other countries.

What happens to our recordings when someone leaves?

Users can delete their data at any time. Account-linked personal information is deleted within 30 days after an account closes. For business customers, meeting content follows your contract, so check those terms.