VendorScore · Comparison · Data-access posture
Evidence dated 2026-10-07, public docs only, not legal advice.
Short answer
Both process your recordings and transcripts in plaintext with vendor-managed keys. In the scored configurations, Otter.ai (48/100) has somewhat less inherent vendor read access than Fireflies.ai (42/100); neither offers end-to-end encryption or customer-managed keys, and the Fireflies evidence is thinner because its subprocessor list couldn't be read.
Higher score = less inherent vendor read access in the scored configuration, not a more secure product. Each score comes from that vendor's VendorScore page.
| Otter.ai | Fireflies.ai | |
|---|---|---|
| Overall score | 48/100 | 42/100 |
| Scored configuration | Otter Enterprise workspace: AI model training off by default, admin-locked Notetaker auto-join, pre-meeting recording notifications, 'Remove audio recordings', custom retention, SSO/SCIM. | Fireflies Enterprise: Private Storage / bring-your-own-storage (BYOS), Transcript/Summary-Only mode (no audio/video retained), custom retention, Rules Engine, SSO/SCIM. |
| Key custody option | Otter-managed keys (AWS S3 server-side AES-256). No customer-managed key, BYOK or EKM option found. | Vendor-managed encryption; no customer-managed key option found. Enterprise Private Storage (BYOS) keeps data in a bucket you own, but Fireflies must read and write it. |
| E2EE / CSE scope | None: audio is processed in Otter's cloud for transcription, summaries and AI chat. | None. Fireflies' own docs call AES-256 at rest plus TLS 1.2+ 'end-to-end encryption'; that's server-side and transport encryption, not E2EE. |
| AI training default (scored config) | Not used for training by default. Enterprise workspaces are opted out of AI model training by default. Outside Enterprise, de-identified data is used for training automatically. | Not used for training by default. Fireflies says it doesn't use personal information for AI model training and bars its vendors from doing so; its wording isn't fully consistent across pages. |
| EU residency | Not offered in public docs; listed subprocessors, including AWS storage, show the United States. | Storage only, and only partly: Private Storage lets Enterprise choose the storage location, but data is processed on Fireflies' US servers. |
| DPA link | Otter.ai DPA | Fireflies.ai DPA |
Dimension scores (key custody, plaintext access, encryption claims, subprocessors, auditability) stay in the full PDFs.
Get the full 5-dimension PDFs — join the waitlist
PDFs aren't for sale yet. Join the waitlist and we'll email yours when it's ready. No calls.
No. Otter stores data with server-side AES-256 encryption and processes audio in its cloud. A Fireflies Knowledge Base page describes AES-256 at rest and TLS 1.2+ in transit as end-to-end encryption, but that's server-side and transport encryption, not E2EE. We found no customer-managed key option for either.
In the scored configurations, Otter.ai scores 48/100 (Enterprise workspace) and Fireflies.ai 42/100 (Enterprise with Private Storage and Transcript/Summary-Only mode), so Otter has somewhat less inherent vendor read access. The Fireflies report confidence is medium-low.
Both say only with your consent. Otter requires explicit customer consent before employees and support access a transcript or audio recording to troubleshoot. Fireflies says its teams don't have access to meeting content by default and any access requires your explicit permission, typically for support.
Otter: Enterprise workspaces are opted out of AI model training by default; outside Enterprise, Otter de-identifies user data before training its models. Fireflies' privacy policy says it doesn't use personal information for AI model training and contractually prohibits its vendors from doing so, but its DPA lets it create de-identified data to improve its products.
Otter lists Anthropic and OpenAI as AI subprocessors and says no Customer Data is used to train or improve their models. Fireflies' docs name OpenAI and Anthropic, plus unnamed transcription providers, under zero-retention, no-training agreements; its full subprocessor list renders only via JavaScript, so we couldn't read it.
Otter's public docs don't offer EU hosting, and its listed subprocessors show the United States. Fireflies' Enterprise Private Storage lets you choose where data is stored, but Fireflies says data is processed on its servers in the U.S.
Every URL cited on this page. Scores, configurations and facts come from the linked VendorScore vendor pages and their reports; nothing here goes beyond them.
This comparison restates the vendor pages for the scored configurations only; default setups usually score lower. A higher score means less inherent vendor read access in that configuration, not a safety rating. VendorScore doesn't certify compliance. Public-docs review only. Not a pen test, not legal advice, not a SOC 2 substitute.