Vetting an AI Notetaker: Security, SOC 2 and Retention Questions

SOC 2 is an audit framework, and what matters is the report itself. Ask the vendor for their current SOC 2 report under NDA, and read these parts:

• Type: a Type I report describes controls at a point in time, and Type II covers how they operated over a period.
• Period covered: check the dates and whether they're recent.
• Scope: which systems and services were audited, and whether the product you'll use is included.
• Trust criteria: security is the base, and availability or confidentiality may also matter to you.
• Exceptions: any findings the auditor noted, and the vendor's responses.

If a vendor says only that they're "compliant," ask for the report. Don't assume any tool has a specific certification. Confirm it in the vendor's own documentation and have your security team review it.

Find out what's stored, where and for how long, then compare it with your own policy. Ask:

1. What's kept: audio, video, transcripts, summaries, and metadata such as participant names?
2. Where is it stored, and can you choose a region if your customers require it?
3. What are the default retention periods, and can admins change them?
4. Can you delete a recording or a whole account on request, and how long does deletion take, including from backups?
5. What happens to your data if you cancel?

Match the answers with your customer contracts. Some customers restrict recording or require deletion after a set time, and your notetaker settings have to allow that.

This is the question that surprises people most. Ask directly, and get the answer in the terms or a data processing addendum:

• Are your transcripts used to train or improve any models, theirs or a third party's?
• Which third-party AI providers process your data, and under what terms?
• Can you opt out, and is that the default or a setting someone must change?
• How is data separated between customers?

A vague answer is a reason to ask again or move on. If your sales calls include customer confidential information, you need clear commitments in writing.

By default, many notetakers make meeting content visible to attendees or teammates. Check the controls before rollout:

• Single sign-on and multi-factor authentication for the tool.
• Role-based permissions, so you can limit who sees which calls.
• Sharing settings, including public links, and whether admins can disable them.
• Audit logs showing who viewed or exported a recording.
• Integrations, such as the CRM sync, and what data flows to them. See how this ties to CRM data hygiene.

Then set a default that fits the sensitivity of your calls. Customer-facing calls might be shared with the sales team, while calls about renewals or pricing may need narrower access.

Recording laws differ by location and by who is on the call, and some places require consent from everyone. Talk to your attorney about which rules apply to your calls, especially across states or countries, and don't rely on the tool's defaults.

Then plan the rollout:

• Add a clear notice at the start of calls, and give people a way to opt out.
• Publish a short internal policy on what may and may not be recorded.
• Run a pilot with a small group before company-wide use.
• Recheck the vendor's terms and security page every year.

For the wider review process, pre-clearing security reviews covers how to make answers reusable, and the comparison of notetakers can help you shortlist.