Otter.ai AI Vendor Risk Profile
AI meeting assistant that provides real-time transcription, automated summaries, and action item extraction for meetings across Zoom, Google Meet, and Microsoft Teams.
Risk overview
Risk score: 42/100
Risk tier: Elevated
Safety rating: 58/100 (higher is better)
Lower risk scores indicate lower assessed risk.
Last verified: Apr 19, 2026 Aging
Risk dimensions
| Dimension | Risk score |
|---|---|
| Data Handling | 42/100 |
| IP Exposure | 40/100 |
| Jurisdiction | 13/100 |
| Security | 46/100 |
| Regulatory Compliance | 60/100 |
| Transparency | 80/100 |
| Business Stability | 41/100 |
| Dependency Chain | 35/100 |
| Agent Governance | Not assessed |
Analyst summary
Rating: Acceptable
Otter.ai is a leading meeting transcription service with HIPAA BAA support and SOC 2 Type II posture. The 2022 Politico incident raising concerns over transcript data exposure and Otter's default training on user content outside enterprise agreements are the main residual risks.
Bottom line: Solid choice for general meeting transcription on Business or Enterprise; vet sensitivity carefully for confidential meetings.
Strengths
- HIPAA BAA available for Business and Enterprise customers
- SOC 2 Type II certified with GDPR DPA
- Customer retains ownership of audio, transcripts, and generated summaries
- Deep integration with Zoom, Google Meet, and Microsoft Teams workflows
Concerns
- Default plans use conversation data to improve models (enterprise opt-out required)
- 2022 Politico report raised concerns about transcript visibility with external participants
- Indefinite retention of conversation data within user accounts by default
- No FedRAMP authorization disclosed
Best for
- Business teams capturing and searching meeting content with HIPAA posture
- Customer-facing teams needing automated notes and action-item extraction
- Healthcare and regulated industries on Business plans with BAA
Avoid if
- Your meetings routinely include highly confidential or attorney-client-privileged content
- You need FedRAMP authorization for government meeting transcription
- You cannot accept Otter joining meetings as a participant (visible to attendees)
- You need strong guarantees that competitors or outside parties cannot access transcripts
Citations
- Data Handling — Data Retention Period
Otter.ai retains recorded conversations and transcripts indefinitely within user accounts; users can delete individual conversations at any time.
- Data Handling — Hipaa Baa Available
Otter.ai offers HIPAA Business Associate Agreements for Enterprise customers on Business and Enterprise plans.
- Data Handling — Third Party Data Sharing
Otter.ai has faced public criticism after a Politico article in 2022 reported transcript data exposure concerns when users shared meetings.
- Data Handling — Trains On User Data
Otter.ai may use conversation data and transcripts to improve its speech recognition and summarization models, with enterprise opt-out available.
- Ip Profiles — User Owns Outputs
You retain ownership of the audio recordings, transcripts, and other content you upload to or generate through Otter.ai.
- Jurisdiction Profiles — Incorporation Country
Otter.ai, Inc. (AISense Inc.) is a Delaware corporation headquartered in Mountain View, California.
- Security Compliance — Gdpr Compliant
Otter.ai complies with GDPR and offers a Data Processing Addendum for Business customers.
- Security Compliance — Soc2 Type2
Otter.ai maintains SOC 2 Type II compliance with reports available to Business and Enterprise customers under NDA.