AI tools and client data
Is Otter.ai safe for client data?
Short answer: Whether Otter.ai is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself. On Basic and Pro (personal account) and on Business and Enterprise, Otter.ai may use what staff type to train its models. Every fact on this page is Otter.ai's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap. Obsidian Ridge's free 30-day AI security assessment shows which AI tools your staff actually use.
See which AI tools your staff usePlan by plan, in Otter.ai’s own words
A notetaker that joins calls and writes them down. In a practice that means a transcript of a clinical or client conversation, kept wherever the person who installed it signed in.
| What you are asking | Basic and Pro (personal account) | Business and Enterprise |
|---|---|---|
| Trains the vendor's models by default | Yes. Otter.ai lists training its own AI on de-identified recordings and on transcriptions among its purposes.“Improve and monitor the Services, including training our proprietary AI technology on de-identified audio recordings and on transcriptions (which may contain Personal Information)” source, read | Otter.ai offers Enterprise a way out of model training through an account manager, which means data is in scope until somebody arranges it.“Keep your organization's data out of AI model training. Contact your account manager to get started.” source, read |
| How to turn training off | Not found in the pages we read. | Not found in the pages we read. |
| How long data is kept | No period is published; Otter.ai states a purpose test instead.“Otter.ai stores all Personal Information for as long as necessary to fulfill the purposes set out in this Policy” source, read | Not found in the pages we read. |
| What an admin can see or control | Not found in the pages we read. | An admin sets access policies, workspace permissions and sharing rules centrally.“Centrally configure access policies, workspace permissions, content sharing rules, and security settings to ensure compliance and manage internal governance at scale.” source, read |
| Single sign-on | Not found in the pages we read. | Enterprise customers, alongside two-factor an admin can enforce.“Otter provides access controls at the user and team levels, including two-factor authentication (2FA) and Single Sign-On (SSO) for enterprise customers.” source, read |
| Business Associate Agreement | Not found in the pages we read. | Enterprise plan only, arranged with an account manager. Otter.ai says it is a business associate only once the agreement is signed.“It becomes a Business Associate only when a signed BAA is in place.” source, read |
| Where the data is processed | Not found in the pages we read. | Not found in the pages we read. |
An empty cell is not a reassurance and not a criticism. "Not found in the pages we read." means the Otter.ai pages listed under Sources, read on the dates shown, do not answer it — so there is nothing for us to repeat, and something for you to ask Otter.ai before client information goes near it.
What this means for
The duty does not change because the tool is new. What changes is where the client information ends up.
- Law firms. A client confidence pasted into a personal account has left the firm’s control. Our law firm page sets out the duties we build evidence for; the decision here is whether a personal account may touch a client matter at all.
- Dental and medical practices. Otter.ai publishes a BAA position for this product, which is where that conversation starts. See dental practices.
- CPA and accounting firms. Your written information security plan has to describe the tools people actually use, not the ones you approved. See accounting firms.
- Financial advisers. Client account data in a personal assistant is the exposure; see financial advisers.
- Software teams. A coding assistant reads the repository and can run commands, so the question is what it can reach, not what it was asked. See what AI agents on work laptops can reach.
How to tell which version your staff use
The plan is the whole answer, and you cannot tell from the outside. Three ways to find out, in order of how much they prove.
1. Ask
Quick, free, and incomplete. People forget the tool they installed once and the account they signed in with.
2. Look at the billing and the admin console
This finds what the business pays for. It does not find a personal account, which is the one that matters here.
3. Look on the computers
A tool somebody installed themselves never appears in an IT list. Obsidian Ridge’s free 30-day AI security assessment takes a quiet inventory for 30 days and shows what each tool could reach, then a CISSP goes through it with you. See the assessment, or read a sample set of findings.
Settings to check today
From Otter.ai’s own documentation. Each one is a change somebody can make this afternoon.
- Know that it can capture the screen as well as the audio, so a chart or a file on screen is in the record.“OtterPilot may take automatic screenshots” source, read
- Decide who may record at all. Otter.ai's own description makes the transcript the product, and the transcript is the client's words.“you may provide us with your audio recordings (“Audio Recordings”), automatic OtterPilot screenshots and any text, images or videos that you upload” source, read
Questions we get asked
Is Otter.ai safe for client data?
Whether Otter.ai is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself.
On Basic and Pro (personal account) and on Business and Enterprise, Otter.ai may use what staff type to train its models.
Every fact on this page is Otter.ai's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap.
Does Otter.ai train its models on what our staff type into Otter.ai?
On Basic and Pro (personal account) and on Business and Enterprise, Otter.ai may use what staff type to train its models. On Basic and Pro (personal account): Yes.
Otter.ai lists training its own AI on de-identified recordings and on transcriptions among its purposes.
Otter.ai's own words: "Improve and monitor the Services, including training our proprietary AI technology on de-identified audio recordings and on transcriptions (which may contain Personal Information)" (read 2026-11-02).
On Business and Enterprise: Otter.ai offers Enterprise a way out of model training through an account manager, which means data is in scope until somebody arranges it.
Otter.ai's own words: "Keep your organization's data out of AI model training. Contact your account manager to get started." (read 2026-11-02).
How long does Otter.ai keep what we put into Otter.ai?
On Basic and Pro (personal account): No period is published; Otter.ai states a purpose test instead.
Otter.ai's own words: "Otter.ai stores all Personal Information for as long as necessary to fulfill the purposes set out in this Policy" (read 2026-11-02). On Business and Enterprise: Not found in the pages we read.
Can an administrator read what our staff typed into Otter.ai?
An admin sets access policies, workspace permissions and sharing rules centrally. Otter.ai's own words: "Centrally configure access policies, workspace permissions, content sharing rules, and security settings to ensure compliance and manage internal governance at scale." (read 2026-11-02).
Will Otter.ai sign a Business Associate Agreement for Otter.ai?
Enterprise plan only, arranged with an account manager. Otter.ai says it is a business associate only once the agreement is signed.
Otter.ai's own words: "It becomes a Business Associate only when a signed BAA is in place." (read 2026-11-02). A signed BAA is between your practice and Otter.ai; we do not sign it for you, and we do not read a compliance badge as one.
How do we find out which version of Otter.ai our staff are using?
Look on the computers. A tool somebody installed themselves, or signed into with a personal account, does not appear in any IT list. Obsidian Ridge's free 30-day AI security assessment takes that inventory for 30 days and shows what each tool could reach.
Sources
Otter.ai’s own pages, with the date each was read. Nothing on this page comes from anywhere else.
- otter.ai/privacy-policy, read
- otter.ai/enterprise, read
- help.otter.ai/hc/en-us/articles/33975072019991-HIPAA-Otter-ai, read
All 15 tools, side by side, or run the AI tool risk checker over the ones you know about.
Other tools people ask about
Same question, different answers. The ones in the same category are the ones staff swap between.
Is Fireflies.ai safe for client data?
Meeting notetaker · Fireflies.ai
Is Zoom AI Companion safe for client data?
Meeting notetaker · Zoom
Is Read AI safe for client data?
Meeting notetaker · Read AI