Is Otter.ai safe and private?

Otter.ai is safe in the narrow sense that it protects stored data with standard controls, and it is not private in the sense that it keeps and uses your recordings. Otter says it has achieved a SOC 2 Type 2 report from an independent auditor ¹ and stores data in AWS S3 with server-side encryption ². The risks people ask about are not break-ins. They are how Otter uses recordings, whether participants know they are being recorded, and a pending lawsuit. Our guide to Otter.ai covers the product as a whole.

Security basics are in place, and use of your data is the issue

SOC 2 Type 2 is an audit of a company's security controls over a period of time. It is a sound sign of security hygiene. It says nothing about what the company chooses to do with your data, which is where Otter's policy matters.

Otter's privacy policy, effective June 16, 2026, lists training its AI on de-identified audio recordings and transcriptions among the purposes for which it uses information ³. Otter says this training is automatic, and that recordings and transcripts are not manually reviewed by a human ⁴. The rights section of the policy lists opt-outs for the sale of personal information and for targeted advertising, but none for AI training ⁵. The question does Otter use recordings to train AI? goes deeper. Deleting a conversation moves it to the Trash, which Otter empties automatically after 30 days ⁶.

The lawsuit is about consent, and it is still open

The main privacy concern is consent. A federal class action filed in August 2025 alleges that Otter's service, by default, does not ask meeting attendees for permission to record ⁷. The cases were consolidated as In re Otter.AI Privacy Litigation in the Northern District of California ⁸.

On August 13, 2026, the court granted Otter's motion to dismiss only in part ⁹. The federal wiretap claim proceeds ¹⁰, as do California privacy and Illinois biometric claims about voiceprints ¹¹. At this stage the court treats the allegations as true to decide whether the case may continue. It is not a finding that Otter broke the law, and Otter disputes the claims. The legal background is in is it legal to use an AI notetaker without consent?.

HIPAA and GDPR: only partly covered

HIPAA

Otter says HIPAA compliance is available only on its Enterprise plan, and that it becomes a Business Associate only once a signed agreement is in place ¹². A Business Associate Agreement is the contract that lets a vendor handle protected health information. So Basic, Pro and Business are not suitable for patient conversations. See is transcription software HIPAA compliant? for the wider picture.

GDPR

Otter's security page says it has incorporated GDPR standards into its data practices ¹³. That is a vendor statement, and there is no regulator-issued "GDPR compliant" badge for software. Whether your use is lawful depends on you too: your legal basis, whether people were told about the recording and whether a processor contract is in place. The question is a voice recording personal data under GDPR? explains why a voice is covered.

It depends on what you record

What to do

1. Tell everyone when Otter is recording. Otter itself says users must always ask for consent and indicate when they are recording ¹⁴.
2. Set auto-join to manual so it records only meetings you choose. The steps are in how to stop Otter.ai joining your meetings.
3. Delete what you do not need, and empty the Trash.
4. Check policy at your workplace or school before connecting a calendar.
5. Use local tools for sensitive material. Dictation that runs on your device, such as Yap, which we make, keeps audio off the cloud, though it writes your own text and does not record meetings. For file transcripts, see transcription software.