Product and intended use
Define the configuration, people, information and tasks being assessed.
Plan
Public claim only
Otter.ai meeting transcription and AI summaries. Business/Enterprise service agreements treat the organisation as controller. Consumer/Pro plans are different. Not a legal-research tool.
Ask: Confirm we would buy Business or Enterprise, not Pro, and whether AI Chat on transcripts is included.
Deployment
Public claim only
SaaS. Audio stored on AWS S3. Global processing; privacy policy describes transfers outside the customer's country with SCCs for EEA/UK.
Ask: Where is audio stored and transcribed for an Australian workspace?
Features
Public claim only
Live transcription, summaries, AI chat on meetings, calendar bots joining calls. Users must obtain consent to record.
Ask: Will the Otter bot be allowed in client meetings, and is consent captured?
Australia
Not confirmed
Available in Australia as a SaaS product. Recording laws (state listening devices) and privilege are the firm's problem. No AU residency stated.
Ask: Is AU storage available, and how do we comply with surveillance-device statutes?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Recording and clients
Not confirmed
Otter requires users to obtain consent and indicate recording. A bot joining a client call without informed consent is a professional-conduct issue.
Ask: What consent language and bot-announcement settings will be enforced?
Model provider
Public claim only
Privacy policy lists 'artificial intelligence service providers' as recipients for improving/training proprietary AI. Named foundation-model vendors were not listed on the pages reviewed.
Ask: Name every AI subprocessor that receives audio or transcripts on our plan.
Subprocessors
Public claim only
Stripe (payments), AWS, Google Analytics, Amplitude, Facebook ads, data-labelling providers, cloud and AI providers. No complete dated legal subprocessor list with objection rights was found.
Ask: Provide a current subprocessor list with locations and notice rights for Enterprise.
Training
Public claim only
Privacy policy: Otter may train proprietary AI on de-identified audio recordings and on transcriptions (which may contain personal information), on the basis of consent or legitimate interests. Data-labelling providers create training data. For Business/Enterprise, Otter says it processes as processor on the customer's instructions — get a contractual no-training clause; do not rely on the consumer privacy policy.
Ask: Does our Enterprise DPA prohibit training on our audio and transcripts, including de-identified copies and labelling vendors?
Feedback
Not confirmed
Not separately described.
Ask: Is any in-app feedback used to train models?
Retention
Public claim only
Deleted conversations go to Trash and are auto-deleted after 30 days, or sooner if Trash is emptied. Live retention of active conversations is otherwise while the account exists unless configured.
Ask: What is Enterprise default retention for audio, transcripts and AI summaries?
Deletion
Public claim only
Trash 30 days. Enterprise processor terms should add certified deletion. Not seen in this review.
Ask: Certified deletion of audio, transcripts, embeddings and labelling copies within 30 days of instruction/exit?
Human access
Public claim only
Recording/transcription described as without human interference at capture. Employees background-checked and under confidentiality. Labelling vendors receive data for training features — that is human review of content unless Enterprise excludes it.
Ask: Will any Otter employee or labelling vendor hear our Enterprise audio?
Access
Public claim only
2FA available on all plans. Sharing is user-controlled. SSO/SCIM for Enterprise was not verified on the pages scraped.
Ask: SSO, SCIM, and admin disable of sharing/bots on Enterprise?
Encryption
Public claim only
AWS S3 SSE AES-256; keys rotated. TLS in transit not spelled out on the privacy-security page excerpt but typical for the product; confirm.
Ask: TLS version and encryption of transcripts at rest and in transit?
Assurance
Public claim only
SOC 2 Type 2 claimed; GDPR/CCPA/HIPAA/VPAT badges on the privacy-security page. Report not inspected.
Ask: Current SOC 2 Type II scoped to transcription storage and AI features.
Contract
Public claim only
Enterprise customers get a service agreement; Otter acts as processor. Consumer privacy policy still describes training. Execute a DPA that overrides training.
Ask: Provide Enterprise MSA/DPA with no-training, confidentiality of recordings, liability cap and forum.
Transfers
Public claim only
Global operations; transfers outside the customer's country; SCCs for EEA/UK. No AU residency. AWS regions not named as AU on the security page.
Ask: APP 8 map for audio, transcripts, labelling vendors and AI providers.
Incidents
Not confirmed
Not specified on the pages reviewed.
Ask: Breach notice timeline for recordings (NDB)?
Changes
Not confirmed
Privacy policy may change. Training purposes are already broad.
Ask: Notice before a new AI provider or training purpose?
Exit
Public claim only
User can delete conversations. Enterprise export format not inspected.
Ask: Bulk export of transcripts/audio then certified deletion?
Connectors
Public claim only
Calendar and meeting platforms. Sharing links are a disclosure path.
Ask: Disable public sharing links; list calendar integrations.
Web search
Not confirmed
Not a research product. AI chat on a transcript might still generalise beyond the recording.
Ask: Does Otter Chat answer only from the transcript or also from general model knowledge?
Bots joining meetings
Not confirmed
Otter can join meetings when invited and record. That is an action with legal consequences. Admin controls over auto-join must be verified.
Ask: Can we disable auto-join and require a host confirm before any recording starts?
Oversight
Not confirmed
Transcripts are AI output. Lawyers must check before relying. No court-ready certification. Privilege logs need a human.
Ask: Who in the firm reviews Otter output before it is saved to a matter?