AI tools and client data

Is Fathom safe for client data?

Short answer: Whether Fathom is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself. On Individual plans, Team Edition and Enterprise Plan, Fathom may use what the meeting recording contains to train its models unless somebody turns that off. Every fact on this page is Fathom's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap. Obsidian Ridge's free 30-day AI security assessment shows which AI tools your staff actually use.

By Kfir Yair, CISSP. Published . Updated .

See which AI tools your staff use

Plan by plan, in Fathom’s own words

A notetaker that joins video calls, records them and writes the summary. In a practice that is a recording of a client or patient conversation, held in whichever account the person who installed it signed into.

What you are askingIndividual plansTeam EditionEnterprise Plan
Trains the vendor's models by defaultYes, on de-identified data, for Fathom's own models — and there is a switch. Its model providers are barred from training separately.“Fathom uses de-identified customer data to improve the accuracy of our proprietary AI models in order to improve our service for all users.” source, read Yes, on de-identified data, for Fathom's own models — and there is a switch. Its model providers are barred from training separately.“Fathom uses de-identified customer data to improve the accuracy of our proprietary AI models in order to improve our service for all users.” source, read Yes, on de-identified data, for Fathom's own models — and there is a switch. Its model providers are barred from training separately.“Fathom uses de-identified customer data to improve the accuracy of our proprietary AI models in order to improve our service for all users.” source, read
How to turn training offA per-user switch in settings, which means it is off for nobody until somebody goes and looks.“You can opt out of this anytime in your My Settings…” source, read A per-user switch in settings, which means it is off for nobody until somebody goes and looks.“You can opt out of this anytime in your My Settings…” source, read A per-user switch in settings, which means it is off for nobody until somebody goes and looks.“You can opt out of this anytime in your My Settings…” source, read
How long data is keptDeleting the account is the published deletion event, and Fathom gives the backup window too.“When you delete your account, all recording data and metadata are removed. After an additional 7 days, all data is also removed from our backups.” source, read Deleting the account is the published deletion event, and Fathom gives the backup window too.“When you delete your account, all recording data and metadata are removed. After an additional 7 days, all data is also removed from our backups.” source, read Only here. Fathom publishes the rule that deletes recordings on a schedule as an Enterprise feature.“Setting a Retention Policy allows organizations to automatically delete recordings in Fathom after a configured period of time…” source, read
What an admin can see or controlNot found in the pages we read.One place an administrator can switch the training off for everybody, rather than asking each person to do it.“Organizations on Team Edition can opt out all users on their account by going to Organization Settings.” source, read One place an administrator can switch the training off for everybody, rather than asking each person to do it.“Organizations on Team Edition can opt out all users on their account by going to Organization Settings.” source, read
Single sign-onNot found in the pages we read.Not found in the pages we read.Not found in the pages we read.
Business Associate AgreementBlanket. Fathom publishes the agreement and says a covered entity is party to it by signing up, with no separate document to chase.“By entering into the Service Agreement as a Covered Entity, Covered Entity agrees to the terms of this Agreement.” source, read Blanket. Fathom publishes the agreement and says a covered entity is party to it by signing up, with no separate document to chase.“By entering into the Service Agreement as a Covered Entity, Covered Entity agrees to the terms of this Agreement.” source, read Blanket. Fathom publishes the agreement and says a covered entity is party to it by signing up, with no separate document to chase.“By entering into the Service Agreement as a Covered Entity, Covered Entity agrees to the terms of this Agreement.” source, read
Where the data is processedThe United States, with no regional option published.“All Fathom data is stored in the United States.” source, read The United States, with no regional option published.“All Fathom data is stored in the United States.” source, read The United States, with no regional option published.“All Fathom data is stored in the United States.” source, read

An empty cell is not a reassurance and not a criticism. "Not found in the pages we read." means the Fathom pages listed under Sources, read on the dates shown, do not answer it — so there is nothing for us to repeat, and something for you to ask Fathom before client information goes near it.

What this means for

The duty does not change because the tool is new. What changes is where the client information ends up.

  • Law firms. A client confidence pasted into a personal account has left the firm’s control. Our law firm page sets out the duties we build evidence for; the decision here is whether a personal account may touch a client matter at all.
  • Dental and medical practices. Fathom publishes a BAA position for this product on Individual plans, which is where that conversation starts. See dental practices.
  • CPA and accounting firms. Your written information security plan has to describe the tools people actually use, not the ones you approved. See accounting firms.
  • Financial advisers. Client account data in a personal assistant is the exposure; see financial advisers.
  • Software teams. A coding assistant reads the repository and can run commands, so the question is what it can reach, not what it was asked. See what AI agents on work laptops can reach.

How to tell which version your staff use

The plan is the whole answer, and you cannot tell from the outside. Three ways to find out, in order of how much they prove.

  1. 1. Ask

    Quick, free, and incomplete. People forget the tool they installed once and the account they signed in with.

  2. 2. Look at the billing and the admin console

    This finds what the business pays for. It does not find a personal account, which is the one that matters here.

  3. 3. Look on the computers

    A tool somebody installed themselves never appears in an IT list. Obsidian Ridge’s free 30-day AI security assessment takes a quiet inventory for 30 days and shows what each tool could reach, then a CISSP goes through it with you. See the assessment, or read a sample set of findings.

Settings to check today

From Fathom’s own documentation. Each one is a change somebody can make this afternoon.

  • Turn the training opt-out on for the whole organisation rather than trusting each person to find it in their own settings.“Organizations on Team Edition can opt out all users on their account by going to Organization Settings.” source, read
  • Ask for a retention rule in writing. Fathom says the setting is not self-serve, so there is a request to make and a reply to keep.“Setting a retention policy for all users on your account isn’t self-serve yet.” source, read
  • Understand what the rule does once it is on: it reaches backwards through what you already have, not just forwards.“Once a retention rule is active, any recording older than the set period will be permanently deleted.” source, read

Worth knowing

  • Fathom publishes this about its AI sub-processors. The sentence in the table above is about Fathom's own models. Both are Fathom's own statements; ask Fathom which applies to your plan.“None of our AI sub-processors (Anthropic, OpenAI, or Google) are contractually permitted to use our users’ data to train their AI models.” source, read
  • A countersigned copy is available if your own file needs one rather than a link.“If you’d prefer a signed BAA between you and Fathom, please reach out…” source, read
  • Fathom publishes the Business Associate Agreement for every plan, and publishes the retention policy as Enterprise-only. Both are Fathom's own statements; ask Fathom which applies to your plan.“This feature is available only for users of the Enterprise Plan.” source, read

Questions we get asked

Is Fathom safe for client data?

Whether Fathom is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself.

On Individual plans, Team Edition and Enterprise Plan, Fathom may use what the meeting recording contains to train its models unless somebody turns that off.

Every fact on this page is Fathom's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap.

Does Fathom train its models on what we put into Fathom?

On Individual plans, Team Edition and Enterprise Plan, Fathom may use what the meeting recording contains to train its models unless somebody turns that off.

On Individual plans, Team Edition and Enterprise Plan: Yes, on de-identified data, for Fathom's own models — and there is a switch. Its model providers are barred from training separately.

Fathom's own words: "Fathom uses de-identified customer data to improve the accuracy of our proprietary AI models in order to improve our service for all users." (read 2026-11-03).

How long does Fathom keep what we put into Fathom?

On Individual plans and Team Edition: Deleting the account is the published deletion event, and Fathom gives the backup window too. Fathom's own words: "When you delete your account, all recording data and metadata are removed.

After an additional 7 days, all data is also removed from our backups." (read 2026-11-03). On Enterprise Plan: Only here. Fathom publishes the rule that deletes recordings on a schedule as an Enterprise feature.

Fathom's own words: "Setting a Retention Policy allows organizations to automatically delete recordings in Fathom after a configured period of time…" (read 2026-11-03).

Can an administrator read what we put into Fathom?

On Individual plans: Not found in the pages we read. On Team Edition and Enterprise Plan: One place an administrator can switch the training off for everybody, rather than asking each person to do it.

Fathom's own words: "Organizations on Team Edition can opt out all users on their account by going to Organization Settings." (read 2026-11-03).

Will Fathom sign a Business Associate Agreement for Fathom?

On Individual plans: Blanket. Fathom publishes the agreement and says a covered entity is party to it by signing up, with no separate document to chase.

Fathom's own words: "By entering into the Service Agreement as a Covered Entity, Covered Entity agrees to the terms of this Agreement." (read 2026-11-03).

A signed BAA is between your practice and Fathom; we do not sign it for you, and we do not read a compliance badge as one.

How do we find out which version of Fathom our staff are using?

Look on the computers. A tool somebody installed themselves, or signed into with a personal account, does not appear in any IT list. Obsidian Ridge's free 30-day AI security assessment takes that inventory for 30 days and shows what each tool could reach.

Sources

Fathom’s own pages, with the date each was read. Nothing on this page comes from anywhere else.

All 35 tools, side by side, or run the AI tool risk checker over the ones you know about.

Other tools people ask about

Same question, different answers. The ones in the same category are the ones staff swap between.