AI tools and client data
Is Plaud safe for client data?
Short answer: Whether Plaud is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself. On Starter, Pro and Unlimited (personal account) and on Team, Plaud says it does not train its models on what the recorder picks up, by default. Every fact on this page is Plaud's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap. Obsidian Ridge's free 30-day AI security assessment shows which AI tools your staff actually use.
See which AI tools your staff usePlan by plan, in Plaud’s own words
A pocket recorder and the app behind it: it records conversations in the room or on a phone call, transcribes them and writes summaries. Nobody asks IT before buying one, and it records the half of the conversation a meeting notetaker never reaches — the one in the room.
| What you are asking | Starter, Pro and Unlimited (personal account) | Team |
|---|---|---|
| Trains the vendor's models by default | No, unless you have agreed to it in advance. Plaud extends it to third-party models as well as its own, and names the audio explicitly.“We will never use your Content (such as your audio files, photos, or text, the files you upload, or your conversations with the agent)…” source, read | No, unless you have agreed to it in advance. Plaud extends it to third-party models as well as its own, and names the audio explicitly.“We will never use your Content (such as your audio files, photos, or text, the files you upload, or your conversations with the agent)…” source, read |
| How to turn training off | Not found in the pages we read. | Not found in the pages we read. |
| How long data is kept | As long as the account lives. There is no period for a recording of its own — deleting it is the account holder's job.“Most of your data is associated with your account and is kept for as long as your account remains active.” source, read | As long as the account lives. There is no period for a recording of its own — deleting it is the account holder's job.“Most of your data is associated with your account and is kept for as long as your account remains active.” source, read |
| What an admin can see or control | Not found in the pages we read. | Seat management and, more usefully, a defined offboarding path — which is the question when the person who recorded the client leaves.“Secure User Offboarding” source, read |
| Single sign-on | Not found in the pages we read. | SAML single sign-on, on the Team plan only.“SAML SSO” source, read |
| Business Associate Agreement | Not found in the pages we read. | Not found in the pages we read. |
| Where the data is processed | Your own region, by location. On a personal account it follows you rather than being set by anybody.“Your personal data is processed and stored on secure servers in the region corresponding to your location…” source, read | Set for the workspace rather than per person, which is the version a practice wants.“Workspace-level Data Residence” source, read |
An empty cell is not a reassurance and not a criticism. "Not found in the pages we read." means the Plaud pages listed under Sources, read on the dates shown, do not answer it — so there is nothing for us to repeat, and something for you to ask Plaud before client information goes near it.
What this means for
The duty does not change because the tool is new. What changes is where the client information ends up.
- Law firms. A client confidence pasted into a personal account has left the firm’s control. Our law firm page sets out the duties we build evidence for; the decision here is whether a personal account may touch a client matter at all.
- Dental and medical practices. We didn't find a BAA statement in the pages listed below; ask Plaud before any patient data goes in. See dental practices.
- CPA and accounting firms. Your written information security plan has to describe the tools people actually use, not the ones you approved. See accounting firms.
- Financial advisers. Client account data in a personal assistant is the exposure; see financial advisers.
- Software teams. A coding assistant reads the repository and can run commands, so the question is what it can reach, not what it was asked. See what AI agents on work laptops can reach.
How to tell which version your staff use
The plan is the whole answer, and you cannot tell from the outside. Three ways to find out, in order of how much they prove.
1. Ask
Quick, free, and incomplete. People forget the tool they installed once and the account they signed in with.
2. Look at the billing and the admin console
This finds what the business pays for. It does not find a personal account, which is the one that matters here.
3. Look on the computers
A tool somebody installed themselves never appears in an IT list. Obsidian Ridge’s free 30-day AI security assessment takes a quiet inventory for 30 days and shows what each tool could reach, then a CISSP goes through it with you. See the assessment, or read a sample set of findings.
Settings to check today
From Plaud’s own documentation. Each one is a change somebody can make this afternoon.
- Put the recorders in the device list. This is hardware with client conversations on it, and it goes home in a pocket.“Device Management” source, read
- Know that asking the assistant about a recording uploads it. The recorder is local; the agent is not.“your conversations with the agent and any files you upload for processing are transmitted to and stored in our cloud storage service…” source, read
- Decide whether speaker recognition is on. It builds a voiceprint of the people in the room, which is biometric data about your clients.“We retain a voiceprint only for as long as it is needed for the speaker-recognition feature in the account that generated it.” source, read
- Closing the account is the deletion event. Plaud publishes nothing that removes a recording while the account is open.“When you deactivate your account, we will take steps to delete or anonymize this data in accordance with applicable laws.” source, read
Worth knowing
- The bar on training reaches Plaud's model providers by contract, not only Plaud.“Our LLM service providers are contractually prohibited from using your data to train their models…” source, read
- Deletion is published as reaching the backups too, with a stated window.“Destruction is permanent and propagates to our backups, and any residual copy ages out of the backup window within 30 days.” source, read
- Search queries are covered separately, by a zero-retention requirement on that vendor.“our search service vendor is contractually required to maintain a zero-data-retention policy with respect to your search queries.” source, read
Questions we get asked
Is Plaud safe for client data?
Whether Plaud is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself.
On Starter, Pro and Unlimited (personal account) and on Team, Plaud says it does not train its models on what the recorder picks up, by default.
Every fact on this page is Plaud's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap.
Does Plaud train its models on what we put into Plaud?
On Starter, Pro and Unlimited (personal account) and on Team, Plaud says it does not train its models on what the recorder picks up, by default.
On Starter, Pro and Unlimited (personal account), Team: No, unless you have agreed to it in advance. Plaud extends it to third-party models as well as its own, and names the audio explicitly.
Plaud's own words: "We will never use your Content (such as your audio files, photos, or text, the files you upload, or your conversations with the agent)…" (read 2026-11-03).
How long does Plaud keep what we put into Plaud?
On Starter, Pro and Unlimited (personal account), Team: As long as the account lives. There is no period for a recording of its own — deleting it is the account holder's job.
Plaud's own words: "Most of your data is associated with your account and is kept for as long as your account remains active." (read 2026-11-03).
Can an administrator read what we put into Plaud?
On Starter, Pro and Unlimited (personal account): Not found in the pages we read. On Team: Seat management and, more usefully, a defined offboarding path — which is the question when the person who recorded the client leaves. Plaud's own words: "Secure User Offboarding" (read 2026-11-03).
Will Plaud sign a Business Associate Agreement for Plaud?
We didn't find a BAA statement in the pages listed below; ask Plaud before any patient data goes in.
How do we find out which version of Plaud our staff are using?
Look on the computers. A tool somebody installed themselves, or signed into with a personal account, does not appear in any IT list. Obsidian Ridge's free 30-day AI security assessment takes that inventory for 30 days and shows what each tool could reach.
Sources
Plaud’s own pages, with the date each was read. Nothing on this page comes from anywhere else.
All 35 tools, side by side, or run the AI tool risk checker over the ones you know about.
Other tools people ask about
Same question, different answers. The ones in the same category are the ones staff swap between.
Is Fathom safe for client data?
Meeting notetaker · Fathom
Is Zoom AI Companion safe for client data?
Meeting notetaker · Zoom
Is Otter.ai safe for client data?
Meeting notetaker · Otter.ai