Otter.ai safety profile

What it does with your data

When staff record or upload a meeting, Otter.ai keeps the audio and the transcript. By default it also uses them to train its own AI models. Otter says it first de-identifies the data with its own method, that training runs automatically, and that no human manually reviews recordings or transcripts. Its privacy policy notes that transcripts may contain personal information, and it gives consent or legitimate interests as the legal basis.

Otter treats 2 kinds of data differently. Documents imported from other services, such as Google Workspace, are not used to train Otter’s models. The outside AI providers Otter works with do not train on customer data and do not store what Otter sends them.

For retention, deleted conversations go to the Trash and are removed automatically after 30 days, or right away if someone empties the Trash. Beyond that, the policy says personal information is kept as long as needed for its stated purposes or as law requires. It gives no fixed period.

Settings to change first

The most important change is not a switch staff can flip themselves. The vendor pages checked do not describe an in-app menu path for turning off training.

1. Ask for the training opt-out. Otter’s Enterprise page lists an “AI model training opt-out” that keeps an organization’s data out of model training. You start the process by contacting your account manager.
2. Turn on two-factor authentication. It is available on all Otter plans, and each person sets it on their own account.
3. Explain deletion to staff. Deleted conversations stay in the Trash for 30 days unless someone empties it.

Individual users can also object to processing or withdraw consent by writing to privacy@otter.ai or using Otter’s online form. The policy does not say that doing so stops model training.

Free and paid tiers

Otter lists 3 plans: Basic (free), Business (paid, with more workspace and admin features) and Enterprise (custom).

The biggest difference is who controls the data. For individual users outside a business agreement, Otter is the data controller. Under an Otter Business or enterprise service agreement, Otter processes personal information on behalf of your organization and on its instructions. Your organization becomes the data controller, and your own privacy policy applies.

On the paid Pro and Business plans, Stripe collects names, billing addresses and payment details. The policy says payment information is not shared with Otter.

The training opt-out, single sign-on, user provisioning and audit logging all appear on the Enterprise page. The free plan’s listing does not include them.

Admin controls

Otter’s Enterprise page lists these controls:

• “SSO & SCIM integration,” which manages access through identity tools such as Okta and Azure AD.
• “Admin controls” for central access policies, workspace permissions, content sharing rules and security settings.
• “Audit logging,” which keeps trails of account activity.
• The organization-wide “AI model training opt-out.”

The Business plan promises more powerful workspace and admin features, but the page does not list them.

For audits, Otter says it has a SOC 2 Type 2 report from an independent auditor and has completed a VPAT for Section 508 accessibility. Its security policies are based on the ISO 27001/2 framework, which is not a claim of ISO certification. It is also certified under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. Data Privacy Framework.

Using it with donor and client data

If staff will discuss donors or clients in recorded meetings, use Enterprise and get the training opt-out confirmed before anyone records. On Basic, recordings and transcripts can go into training, even though Otter de-identifies them first.

Until the opt-out is in place, do not record or upload meetings that include:

• donor names alongside gift amounts or giving history
• client case notes or anything that identifies a person you serve
• health details or payment card details

The vendor pages checked leave several points open, so get answers in writing from Otter before staff use it with donor data:

• the region where your data is stored (the pages name a U.S.-based cloud provider but offer no choice of region)
• a fixed retention period for personal information (the policy gives none)
• whether the Business plan includes the training opt-out
• whether objecting under the privacy policy stops training on an individual account

Questions people ask

Does Otter use our meeting recordings to train its AI?

Yes, by default. Otter says it de-identifies recordings and transcripts before training. Organizations can request the “AI model training opt-out” through their account manager.

Does anyone at Otter listen to our recordings?

Otter says training runs automatically and that recordings and transcripts are not manually reviewed by a human. The vendor pages checked do not cover other kinds of staff access, so ask Otter directly if this matters to you.

Where is our data stored?

Otter stores data encrypted with AES-256 at a cloud provider based in the United States, and it may process data outside your country. The pages checked do not name a specific region or let you choose one.