Otter.ai
otter.ai
Automated, point-in-time. Not independently reviewed or approved by TRUSTYCYBER unless expressly stated.
- Otter.ai trains its own AI on customer recordings and transcripts; no tier carve-out in the public documents
- Retention terms found: confirm them in writing
See Before you sign, with what to ask for ↓
Scanned Nov 1, 2026 · Public evidence · Point-in-time
Higher scores indicate stronger, independently supported AI assurance, governance, AI systems, models, data, supply chain and third-party assurance evidence. The score and the decision are related but different: a well-scored vendor can still carry conditions.
Before you sign
Why it matters: The Privacy Policy states Otter.ai trains its proprietary AI on de-identified audio recordings and on transcriptions that may contain Personal Information. Terms s.9.9 reserves the right to use machine learning on User Content to calibrate and improve models for every plan, and s.18.4 permits deidentified data to be used for 'machine learning and training'. A human annotation vendor (Research Transcriptions) and 'data labeling service providers' receive data to build training sets. The third-party commitments (Anthropic/OpenAI) do not extend to Otter.ai's own models, and no opt-out or Business/Enterprise exclusion appears in the stashed documents.
What to ask for: Is customer meeting content excluded from training for Business and Enterprise plans, is there an opt-out for other plans, and what de-identification is applied before transcripts reach annotation vendors?
“Improve and monitor the Services, including training our proprietary AI technology on de-identified audio recordings and on transcriptions (which may contain Personal Information)”
“The Service may be implemented using machine learning systems with features and implementations designed to generate statistics, calibrate data models, and improve algorithms in the course of processing User Content and Usage Data (“ Machine Learning ”). Nothing in these Terms prohibits Company from using such Machine Learning for testing, tuning, optimizing, validating, or otherwise enhancing the analytics, models, or algorithms underlying the Service.”
“You acknowledge and agree that Otter.ai may collect, create, process, transmit, store, use, and disclose aggregated and/or deidentified data derived from Data or use of the Services (“ Aggregated Data ”) for its business purposes, including for machine learning and training, industry analysis, benchmarking, and analytics. All Aggregated Data will be in an aggregated and/or deidentified form only and will not identify you.”
“Data labeling service providers who provide annotation services and use the data we share to create training and evaluation data for Otter’s product features.”
“Research Transcriptions Provider for annotating training and evaluation data for our product features. United States”
“Company will be free (during and after the Order Term) to use Usage Data in de-identified and aggregated form to maintain, improve, and enhance Company’s products or services. Examples of Usage Data include technical logs, metadata, telemetry data, and usage information about Customer Content, such as how many times it is accessed. For clarity, Usage Data excludes Customer Content itself.”
Why it matters: The sources describe retention ("On the customer's direction Otter.ai will delete Company Personal Data within 30 days of request, except where law requires retention, in which case the data is isolated and protected.") but not a complete window for every data type.
What to ask for: Get retention periods in writing for inputs, outputs, logs and backups, including any provider that runs the model.
“Otter.ai stores all Personal Information for as long as necessary to fulfill the purposes set out in this Policy, or for as long as we are required to do so by law or in order to comply with a regulatory obligation. When deleting Personal Information, we will take measures to render such Personal Information irrecoverable or irreproducible, and the electronic files which contain Personal Information will be permanently deleted.”
“Customer may delete User Content from their account where it may be stored in a separate trash folder provided with the service for a specified period unless they choose to delete it from the trash folder. Once it has been permanently deleted from the user account either by direct action by the user or on expiration of the specified retention period in the trash folder, no record of the User Content is retained and the User Content cannot be recreated by the service.”
“Upon direction by Company, and in any event no later than 30 days after receipt of a request from Company, Vendor shall promptly delete Company Personal Data as directed by Company, unless Vendor is required by law to retain such data,”
Australian Government checksdirections checked Nov 1, 2026
No vendor-specific PSPF direction names this vendor or product (checked 2026-11-01).
Not found in the sources this scan collected, which is not evidence the vendor has none. IRAP is an assessment, not a certificate, and there has been no public register since 2020. Ask the vendor for its IRAP assessment report and check its date, classification level and the services in scope.
Not found in the sources this scan collected. If the service will hold government data, ask whether it is hosted with a provider certified under the Hosting Certification Framework, and at which level.
No Australian data residency commitment was found in the sources this scan collected. Ask where inputs, outputs, logs and backups are processed and stored, and whether processing can be kept in Australia.
What your organisation still has to do
Every level of government
- Treat AI outputs, including meeting transcripts and summaries, as public records: capture or dispose of them under your records authority (the Archives Act 1983 for Commonwealth agencies, your state's records legislation for state agencies and councils). Source ↗
Commonwealth agencies
- Assess foreign ownership, control or influence risk for this technology asset, as PSPF Direction 001-2024 requires. Source ↗
- Apply the DTA Policy for the responsible use of AI in government: record the use case, assess its impact before deployment, and keep your AI transparency statement current. Source ↗
- Assess the service against the ISM controls for the highest classification of data you intend to use with it (OFFICIAL, OFFICIAL: Sensitive or PROTECTED). Source ↗
State agencies and councils
- Assess the service under your state's privacy law, which governs where residents' personal information may go: for example the PPIP Act 1998 in New South Wales, the Privacy and Data Protection Act 2014 in Victoria or the Information Privacy Act 2009 in Queensland.
- New South Wales agencies: complete the NSW AI Assessment Framework self-assessment, which Circular DCS-2024-04 makes mandatory. Source ↗
- Victorian public sector: follow Administrative Guideline 2024/07 on the safe and responsible use of generative AI. Source ↗
Buyer questionsanswered only from the public evidence scanned, click a row for the answer
!Will they train on your data?Ask the vendor
Personal Information is disclosed to data labeling providers who use it to create training and evaluation data for Otter's product features.
Confirm in writing: Ask the vendor to state this in writing before signing.
“No Customer Data will be used to train or improve Anthropic’s artificial intelligence models. Anthropic does not store Customer Data sent through the API on their platform.”
“Data labeling service providers who provide annotation services and use the data we share to create training and evaluation data for Otter’s product features.”
“Improve and monitor the Services, including training our proprietary AI technology on de-identified audio recordings and on transcriptions (which may contain Personal Information)”
“The Service may be implemented using machine learning systems with features and implementations designed to generate statistics, calibrate data models, and improve algorithms in the course of processing User Content and Usage Data (“ Machine Learning ”). Nothing in these Terms prohibits Company from using such Machine Learning for testing, tuning, optimizing, validating, or otherwise enhancing the analytics, models, or algorithms underlying the Service.”
“You acknowledge and agree that Otter.ai may collect, create, process, transmit, store, use, and disclose aggregated and/or deidentified data derived from Data or use of the Services (“ Aggregated Data ”) for its business purposes, including for machine learning and training, industry analysis, benchmarking, and analytics. All Aggregated Data will be in an aggregated and/or deidentified form only and will not identify you.”
“Company will be free (during and after the Order Term) to use Usage Data in de-identified and aggregated form to maintain, improve, and enhance Company’s products or services. Examples of Usage Data include technical logs, metadata, telemetry data, and usage information about Customer Content, such as how many times it is accessed. For clarity, Usage Data excludes Customer Content itself.”
!How long do they keep your data?Ask the vendor
Personal Information is kept for as long as necessary for the stated purposes or as required by law; no fixed retention periods are published, though deletion is committed to be irrecoverable.
Requires written confirmation, see Before you sign ↓
“Otter.ai stores all Personal Information for as long as necessary to fulfill the purposes set out in this Policy, or for as long as we are required to do so by law or in order to comply with a regulatory obligation. When deleting Personal Information, we will take measures to render such Personal Information irrecoverable or irreproducible, and the electronic files which contain Personal Information will be permanently deleted.”
“Customer may delete User Content from their account where it may be stored in a separate trash folder provided with the service for a specified period unless they choose to delete it from the trash folder. Once it has been permanently deleted from the user account either by direct action by the user or on expiration of the specified retention period in the trash folder, no record of the User Content is retained and the User Content cannot be recreated by the service.”
“Upon direction by Company, and in any event no later than 30 days after receipt of a request from Company, Vendor shall promptly delete Company Personal Data as directed by Company, unless Vendor is required by law to retain such data,”
!Who else can access your data?Ask the vendor
Research Transcriptions (United States) is a subprocessor that annotates training and evaluation data for Otter.ai product features, meaning Customer Data may be handled by a human annotation vendor.
Confirm in writing: Ask the vendor to state this in writing before signing.
“Anthropic Provider for backend support of AI-enabled functionality.”
“OpenAI Provider for evaluating the effectiveness of our Large Language Models (LLM). The provider is used to provide input on whether product feature(s) may contain harmful information. No Customer Data will be used to train or improve OpenAI’s artificial intelligence models. OpenAI does not store Customer Data sent through the API on their platform.”
“Research Transcriptions Provider for annotating training and evaluation data for our product features. United States”
“Amazon Web Services, Inc. Cloud service provider and customer data storage platform United States”
“We disclose Device Information, Cookies, and Location Information to Mobile advertising tracking providers, Analytics providers, Advertising Partners, and Providers of integrated third-party programs, apps, or platforms. Under various U.S. state privacy laws, some of these data disclosures may broadly be considered a “sale” of Personal Information and processing of Personal Information for targeted advertising.”
“Google Cloud Platform Cloud service provider United States Crusoe Cloud service provider United States”
“Zendesk Cloud-based customer support services. Personal data may be contained in the customer support tickets. United States OneSignal Customer engagement and push notifications. United States Stripe Cloud-based Payment Processing United States Zuora Subscription Management & Billing United States Slack Internal messaging platform for communications. United States”
“Intercom Support services. Intercom will only process customer data if it is shared between Customer and Otter.ai in the support tool. United States”
“WorkOS Directory sync for enterprise login workflow. United States PlanHat Customer Success platform for post-sales lifecycle. United States On24 Webinar and virtual event hosting platform. United States”
“Workato Provider for building automations and integrations. United States”
!Where is your data processed?Ask the vendor
User Content is hosted on Amazon Web Services, described as based in the United States; AWS data centres are described as located throughout the world. No customer-selectable region or in-country residency option is disclosed.
Confirm in writing: Ask the vendor to state this in writing before signing.
“User Content is hosted by Amazon Web Services (AWS), which is certified SOC 2 Type 2. AWS maintains a list of certifications and third-party assessments. The AWS infrastructure is managed in Amazon controlled data centers throughout the world and the data centers are secured with physical controls to prevent unauthorized access.”
“Crescendo (formerly PartnerHero) The subprocessor only has access to Customer Data in the course of customer-initiated support cases. United States / Philippines / Honduras”
“To facilitate our global operations, Otter.ai may transfer, store and process your operations with our partners and service providers based outside of the country in which you are based. Laws in those countries may differ from the laws applicable to your country of residence. Where we transfer, store and process your Personal Information outside of the EEA or the UK we will ensure that the appropriate safeguards are in place to ensure an adequate level of protection such as through acceding to the Standard Contractual Clauses.”
!What happens in a security incident?Ask the vendor
Otter.ai will notify the customer without undue delay after becoming aware of a Personal Data Breach involving Customer Personal Data; no fixed hour or day window is stated.
Requires written confirmation, see Before you sign ↓
“Company will notify Customer without undue delay after becoming aware of a Personal Data Breach involving Customer Personal Data. If Company’s notification is delayed, it will be accompanied by reasons for the delay.”
Email to send the vendor7 items to confirm in writing
Hello Otter.ai team, We are assessing Otter.ai as part of our supplier review. Before we proceed, please confirm the following in writing: 1. What is your commitment to notify customers of a security incident affecting our data, including the timeframe? 2. How long do you retain our data, in days, for each type (inputs, outputs, logs and backups), and how is it deleted? 3. Do you use our data (inputs, outputs or uploaded files) to train or improve your models? Please confirm in writing, including any opt-out and whether it applies to every plan. 4. Please provide your current, dated subprocessor list and explain how you notify customers of changes. 5. In which countries and regions is our data processed and stored, and can processing be limited to a region we choose? 6. Does Otter.ai hold a current SOC 2 Type 2 or ISO/IEC 27001 certificate in its own name, and can the report be shared under NDA? 7. What is the contractual breach-notification window, is there a vulnerability disclosure or penetration-testing program, and how are AI feature changes communicated to Business/Enterprise administrators? A written reply to each point, or a link to where it is documented, is enough. Where a point is covered by a certification or independent report, please include the certificate number or the report and its date. Thank you,
Key findingsclick a row for the evidence
✓Named AI providers with no-training, no-storage commitments and a full subprocessor registerStrong
Otter.ai names Anthropic (backend AI functionality) and OpenAI (LLM evaluation / harmful-output checks) and states for each that no Customer Data is used to train their models and neither stores Customer Data sent via API. The subprocessor page lists every provider with its role and country, and the DPA gives a 30-day objection right on changes.
A buyer can identify exactly which third-party model providers sit in the request path and hold the vendor to specific written commitments about them, which is more than most meeting-transcription vendors publish.
Question for vendor: Please confirm the Anthropic and OpenAI commitments are contractual (zero data retention terms) and provide the dated agreements or attestations.
“Anthropic Provider for backend support of AI-enabled functionality.”
“No Customer Data will be used to train or improve Anthropic’s artificial intelligence models. Anthropic does not store Customer Data sent through the API on their platform.”
“OpenAI Provider for evaluating the effectiveness of our Large Language Models (LLM). The provider is used to provide input on whether product feature(s) may contain harmful information. No Customer Data will be used to train or improve OpenAI’s artificial intelligence models. OpenAI does not store Customer Data sent through the API on their platform.”
“Amazon Web Services, Inc. Cloud service provider and customer data storage platform United States”
“Customer may object to the addition of a Subprocessor based on reasonable grounds relating to a potential or actual violation of Data Protection Law by providing written notice detailing the grounds of such objection within thirty (30) days following Company’s notification of the intended change.”
“Google Cloud Platform Cloud service provider United States Crusoe Cloud service provider United States”
“Zendesk Cloud-based customer support services. Personal data may be contained in the customer support tickets. United States OneSignal Customer engagement and push notifications. United States Stripe Cloud-based Payment Processing United States Zuora Subscription Management & Billing United States Slack Internal messaging platform for communications. United States”
✗Otter.ai trains its own AI on customer recordings and transcripts; no tier carve-out in the public documentsGap
The Privacy Policy states Otter.ai trains its proprietary AI on de-identified audio recordings and on transcriptions that may contain Personal Information. Terms s.9.9 reserves the right to use machine learning on User Content to calibrate and improve models for every plan, and s.18.4 permits deidentified data to be used for 'machine learning and training'. A human annotation vendor (Research Transcriptions) and 'data labeling service providers' receive data to build training sets. The third-party commitments (Anthropic/OpenAI) do not extend to Otter.ai's own models, and no opt-out or Business/Enterprise exclusion appears in the stashed documents.
Meeting content is typically confidential and may include third-party personal data. The vendor's own training use is the primary data-training exposure here, and de-identification of transcripts is asserted, not described.
Question for vendor: Is customer meeting content excluded from training for Business and Enterprise plans, is there an opt-out for other plans, and what de-identification is applied before transcripts reach annotation vendors?
“Improve and monitor the Services, including training our proprietary AI technology on de-identified audio recordings and on transcriptions (which may contain Personal Information)”
“The Service may be implemented using machine learning systems with features and implementations designed to generate statistics, calibrate data models, and improve algorithms in the course of processing User Content and Usage Data (“ Machine Learning ”). Nothing in these Terms prohibits Company from using such Machine Learning for testing, tuning, optimizing, validating, or otherwise enhancing the analytics, models, or algorithms underlying the Service.”
“You acknowledge and agree that Otter.ai may collect, create, process, transmit, store, use, and disclose aggregated and/or deidentified data derived from Data or use of the Services (“ Aggregated Data ”) for its business purposes, including for machine learning and training, industry analysis, benchmarking, and analytics. All Aggregated Data will be in an aggregated and/or deidentified form only and will not identify you.”
“Data labeling service providers who provide annotation services and use the data we share to create training and evaluation data for Otter’s product features.”
“Research Transcriptions Provider for annotating training and evaluation data for our product features. United States”
“Company will be free (during and after the Order Term) to use Usage Data in de-identified and aggregated form to maintain, improve, and enhance Company’s products or services. Examples of Usage Data include technical logs, metadata, telemetry data, and usage information about Customer Content, such as how many times it is accessed. For clarity, Usage Data excludes Customer Content itself.”
!No independent certification of Otter.ai itself - only AWS's SOC 2 Type 2 is citedGap
The only attestation mentioned is AWS's SOC 2 Type 2 for the hosting layer. The EU-U.S. DPF statement and the 'annual self-assessment' are self-certifications. No SOC 2, ISO/IEC 27001, ISO/IEC 42001, HIPAA or similar attestation of Otter.ai appears in the stash. independent_assurance is marked not_evidenced rather than not_applicable: a hosted SaaS processing meeting audio can and typically does obtain such assurance, so its absence is a genuine gap. The blog index mentions 'HIPAA support' only as a comparison-article topic, not as an Otter.ai claim, so it was not extracted.
Without an independent report the security measures in Appendix 3 and the training/retention commitments rest on vendor assertion alone.
Question for vendor: Does Otter.ai hold a current SOC 2 Type 2 or ISO/IEC 27001 certificate in its own name, and can the report be shared under NDA?
“User Content is hosted by Amazon Web Services (AWS), which is certified SOC 2 Type 2. AWS maintains a list of certifications and third-party assessments.”
“Otter.ai has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. DPF Principles with respect to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF.”
“We conduct an annual self-assessment of our practices regarding Personal Information intended to verify that the assertions we make about our practices are true and that such practices have been implemented as represented.”
!US-hosted with offshore support access and no residency optionGap
User Content is hosted on AWS (described as US-based) and every listed subprocessor is in the United States, with Crescendo support staff also in the Philippines and Honduras able to access Customer Data during customer-initiated cases. Cross-border transfers rely on SCCs and the UK Addendum. No Australian, EU or customer-selectable processing region is disclosed, so data_location is tagged descriptive/mixed rather than favorable.
Buyers with data-residency obligations (including Australian government and regulated entities) cannot meet them on the basis of these documents and would need a contractual residency commitment.
Question for vendor: Can customer data be pinned to a specific AWS region, and can offshore support access be contractually excluded?
“User Content is hosted by Amazon Web Services (AWS), which is certified SOC 2 Type 2. AWS maintains a list of certifications and third-party assessments. The AWS infrastructure is managed in Amazon controlled data centers throughout the world and the data centers are secured with physical controls to prevent unauthorized access.”
“Crescendo (formerly PartnerHero) The subprocessor only has access to Customer Data in the course of customer-initiated support cases. United States / Philippines / Honduras”
“To facilitate our global operations, Otter.ai may transfer, store and process your operations with our partners and service providers based outside of the country in which you are based. Laws in those countries may differ from the laws applicable to your country of residence. Where we transfer, store and process your Personal Information outside of the EEA or the UK we will ensure that the appropriate safeguards are in place to ensure an adequate level of protection such as through acceding to the Standard Contractual Clauses.”
“Amazon Web Services, Inc. Cloud service provider and customer data storage platform United States”
!Breach notice has no fixed window; no vulnerability program or model evaluation practice disclosed; Service may change without noticeGap
The DPA commits to breach notification 'without undue delay' but gives no hour or day window. Nothing in the stash describes vulnerability disclosure, penetration testing or a bug bounty, so vulnerability_and_incident_handling is partial. testing_and_evaluation is partial on the single statement that OpenAI is used to check features for harmful output; no accuracy, bias or transcription-quality evaluation is described, and the Terms expressly disclaim transcription accuracy. The Terms also let Otter.ai modify or discontinue features without notice.
A buyer relying on Otter.ai outputs in regulated settings needs defined incident timelines, evidence of security testing, and advance notice of AI feature changes.
Question for vendor: What is the contractual breach-notification window, is there a vulnerability disclosure or penetration-testing program, and how are AI feature changes communicated to Business/Enterprise administrators?
“Company will notify Customer without undue delay after becoming aware of a Personal Data Breach involving Customer Personal Data. If Company’s notification is delayed, it will be accompanied by reasons for the delay.”
“The provider is used to provide input on whether product feature(s) may contain harmful information.”
“OUTPUTS MAY BE INACCURATE, INAPPROPRIATE, FALSE, INCOMPLETE, OR BIASED, AND MAY NOT REFLECT OTTER.AI’S VIEWS. YOU ARE RESPONSIBLE FOR IMPLEMENTING REASONABLE PRACTICES, INCLUDING HUMAN OVERSIGHT, TO ENSURE THAT OUTPUTS ARE CORRECT AND COMPLETE AND TO GUARD AGAINST THE OUTPUTS BEING USED IN AN UNSUITABLE OR UNLAWFUL WAY, OR IN VIOLATION OF THE RIGHTS OF OTHERS. YOU SHOULD NOT RELY ON AI OUTPUTS WITHOUT INDEPENDENTLY CONFIRMING THEIR ACCURACY.”
“Otter.ai reserves the right to modify or discontinue the Service at any time (including by limiting or discontinuing certain features of the Service), temporarily or permanently, without notice to you.”
Assurance dimensionsweighted components of one score, not eight separate ratings
Organisation & AI governance15% of the score40
Who owns AI risk: policies, responsible-AI principles, human oversight and administrative controls.
Assessed against ISO 42001 · NIST AI RMF · AIUC-1
“Where we have an Otter Business or enterprise service agreement in place with an enterprise customer who is asking you to use our Services (for example your employer), we obtain and process your Personal Information on behalf of and at the instructions of that customer. In that context, such enterprise customers are the data controllers and their privacy policies will apply to the processing of your Personal Information.”
“Otter.ai has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. DPF Principles with respect to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF.”
“We conduct an annual self-assessment of our practices regarding Personal Information intended to verify that the assertions we make about our practices are true and that such practices have been implemented as represented.”
“To troubleshoot and address Customer issue(s), the Company support team will request and obtain explicit permission from Customer and approval from appropriate system administrator(s) before accessing specific User Content that is related to the Customer reported issue(s). Access to User Content to troubleshoot customer issues is further restricted to select support personnel assisting with the issue(s). These types of support requests are logged.”
“Customer is authenticated by password or using Google, Microsoft, or Apple login. Two factor authentication may be enabled by account administrator(s) for Basic Workspace, Pro Workspace, Business or Enterprise accounts.”
AI system15% of the score47
What AI the vendor actually runs and where it sits in the product, the map everything else is judged against.
Assessed against ISO 42001 · NIST AI RMF
“The Service enables users to transform recorded voice conversations into transcribed notes that can be searched and shared. You may choose whether to use the free version of the Service (“ Free Service ”) or the subscription-based paid version of the Service for which you may be required to pay fees (the “ Paid Service ”).”
“The Service creates legible notes from recorded voice conversations using proprietary technologies for automated speech recognition (ASR), keyword extraction and voice to text synchronization. Data may be ingested directly via recording using a mobile or web application, upload of audio files or synchronization with other applications including cloud storage or online video conferencing that store or capture recorded audio. Audio is processed in cloud infrastructure and delivered to the Otter application where it may be consumed or downloaded in a variety of formats.”
“The Service may Process voiceprints to recognize users and automatically tag their name within the transcript.”
“OtterPilot may take automatic screenshots which are available meeting transcripts to add value to the meetings by extracting useful visual information. The automatic screenshots will only take place in virtual meetings.”
“You also have the right to review your Personal Information used in the profiling, and if applicable, have the data corrected and the profiling decision reevaluated based upon the corrected data. We do not engage in such profiling.”
How AI features are evaluated before and after release, evals, red-teaming, monitoring.
Assessed against NIST GenAI · NIST AI RMF · ISO 42001
“The provider is used to provide input on whether product feature(s) may contain harmful information.”
How changes to models and AI features are controlled and communicated: versioning, notice, rollback.
Assessed against ISO 27001 · ISO 42001
“Customer may object to the addition of a Subprocessor based on reasonable grounds relating to a potential or actual violation of Data Protection Law by providing written notice detailing the grounds of such objection within thirty (30) days following Company’s notification of the intended change.”
“We will endeavor to provide the owner of Customer’s account with notice of any new Subprocessors to the extent required under the Agreement, along with posting such updates here. Please check back frequently for updates.”
“Otter.ai reserves the right to modify or discontinue the Service at any time (including by limiting or discontinuing certain features of the Service), temporarily or permanently, without notice to you.”
AI system description: vendor-evidenced, not yet independently corroborated.
Model10% of the score60
Which model providers and versions process customer data, and how changes to them are disclosed.
Assessed against NIST GenAI · ISO 42001
“Anthropic Provider for backend support of AI-enabled functionality.”
“No Customer Data will be used to train or improve Anthropic’s artificial intelligence models. Anthropic does not store Customer Data sent through the API on their platform.”
“OpenAI Provider for evaluating the effectiveness of our Large Language Models (LLM). The provider is used to provide input on whether product feature(s) may contain harmful information. No Customer Data will be used to train or improve OpenAI’s artificial intelligence models. OpenAI does not store Customer Data sent through the API on their platform.”
Model provider transparency: vendor-evidenced, not yet independently corroborated.
Customer data15% of the score72
Whether customer data trains models, how long it is retained, where it is processed, and how it is protected.
Assessed against ISO 27018 · OAIC APPs · EU AI Act
“Improve and monitor the Services, including training our proprietary AI technology on de-identified audio recordings and on transcriptions (which may contain Personal Information)”
“The Service may be implemented using machine learning systems with features and implementations designed to generate statistics, calibrate data models, and improve algorithms in the course of processing User Content and Usage Data (“ Machine Learning ”). Nothing in these Terms prohibits Company from using such Machine Learning for testing, tuning, optimizing, validating, or otherwise enhancing the analytics, models, or algorithms underlying the Service.”
“You acknowledge and agree that Otter.ai may collect, create, process, transmit, store, use, and disclose aggregated and/or deidentified data derived from Data or use of the Services (“ Aggregated Data ”) for its business purposes, including for machine learning and training, industry analysis, benchmarking, and analytics. All Aggregated Data will be in an aggregated and/or deidentified form only and will not identify you.”
“Company will be free (during and after the Order Term) to use Usage Data in de-identified and aggregated form to maintain, improve, and enhance Company’s products or services. Examples of Usage Data include technical logs, metadata, telemetry data, and usage information about Customer Content, such as how many times it is accessed. For clarity, Usage Data excludes Customer Content itself.”
“Otter.ai stores all Personal Information for as long as necessary to fulfill the purposes set out in this Policy, or for as long as we are required to do so by law or in order to comply with a regulatory obligation. When deleting Personal Information, we will take measures to render such Personal Information irrecoverable or irreproducible, and the electronic files which contain Personal Information will be permanently deleted.”
“Customer may delete User Content from their account where it may be stored in a separate trash folder provided with the service for a specified period unless they choose to delete it from the trash folder. Once it has been permanently deleted from the user account either by direct action by the user or on expiration of the specified retention period in the trash folder, no record of the User Content is retained and the User Content cannot be recreated by the service.”
“Upon direction by Company, and in any event no later than 30 days after receipt of a request from Company, Vendor shall promptly delete Company Personal Data as directed by Company, unless Vendor is required by law to retain such data,”
“User Content is hosted by Amazon Web Services (AWS), which is certified SOC 2 Type 2. AWS maintains a list of certifications and third-party assessments. The AWS infrastructure is managed in Amazon controlled data centers throughout the world and the data centers are secured with physical controls to prevent unauthorized access.”
“Communication over the internet with Company via web application are transmitted over secure encrypted connection. Company uses HTTPS for communications and industry standard encryption algorithms for stored User Content and passwords.”
“To facilitate our global operations, Otter.ai may transfer, store and process your operations with our partners and service providers based outside of the country in which you are based. Laws in those countries may differ from the laws applicable to your country of residence. Where we transfer, store and process your Personal Information outside of the EEA or the UK we will ensure that the appropriate safeguards are in place to ensure an adequate level of protection such as through acceding to the Standard Contractual Clauses.”
“We disclose Device Information, Cookies, and Location Information to Mobile advertising tracking providers, Analytics providers, Advertising Partners, and Providers of integrated third-party programs, apps, or platforms. Under various U.S. state privacy laws, some of these data disclosures may broadly be considered a “sale” of Personal Information and processing of Personal Information for targeted advertising.”
“Data labeling service providers who provide annotation services and use the data we share to create training and evaluation data for Otter’s product features.”
“No Customer Data will be used to train or improve Anthropic’s artificial intelligence models. Anthropic does not store Customer Data sent through the API on their platform.”
Customer data treatment: the certifications above are independently corroborated, but they cover the management system — these specific disclosures are the vendor's own statements, not yet independently verified.
AI supply chain10% of the score60
The named chain of AI and infrastructure providers behind the product, and how it is disclosed.
Assessed against ISO 27001 · ISO 27017
“Amazon Web Services, Inc. Cloud service provider and customer data storage platform United States”
“Crescendo (formerly PartnerHero) The subprocessor only has access to Customer Data in the course of customer-initiated support cases. United States / Philippines / Honduras”
“Research Transcriptions Provider for annotating training and evaluation data for our product features. United States”
“Google Cloud Platform Cloud service provider United States Crusoe Cloud service provider United States”
“Zendesk Cloud-based customer support services. Personal data may be contained in the customer support tickets. United States OneSignal Customer engagement and push notifications. United States Stripe Cloud-based Payment Processing United States Zuora Subscription Management & Billing United States Slack Internal messaging platform for communications. United States”
“Intercom Support services. Intercom will only process customer data if it is shared between Customer and Otter.ai in the support tool. United States”
“WorkOS Directory sync for enterprise login workflow. United States PlanHat Customer Success platform for post-sales lifecycle. United States On24 Webinar and virtual event hosting platform. United States”
“Workato Provider for building automations and integrations. United States”
Subprocessors & supply chain: vendor-evidenced, not yet independently corroborated.
Security foundation15% of the score45
How security problems are found, reported and handled: disclosure channels, bug bounty, incident response.
Assessed against ISO 27001 · NIST AI RMF
“Company will notify Customer without undue delay after becoming aware of a Personal Data Breach involving Customer Personal Data. If Company’s notification is delayed, it will be accompanied by reasons for the delay.”
Independent assurance evidence10% of the score55
Whether claimed certifications and attestations are independently corroborated, checked against official registries and issuing bodies. Which certifications, and what each one does and does not establish, is stated per certificate.
Assessed against ISO 17021-1 · ISO 42006 · ISO 27006-1 · ISO 27008
“User Content is hosted by Amazon Web Services (AWS), which is certified SOC 2 Type 2. AWS maintains a list of certifications and third-party assessments.”
Read from the registry record above, cited, not reproduced.
None of the corroborated certifications is AI-specific (ISO/IEC 42001 or AIUC-class) — this assurance is security and data-transfer attestation, not AI-management-system assurance.
Legal & contractual10% of the score60
The contractual backbone a buyer can rely on, terms, DPAs, privacy commitments and regulatory posture.
Assessed against EU AI Act · OAIC APPs
“OUTPUTS MAY BE INACCURATE, INAPPROPRIATE, FALSE, INCOMPLETE, OR BIASED, AND MAY NOT REFLECT OTTER.AI’S VIEWS. YOU ARE RESPONSIBLE FOR IMPLEMENTING REASONABLE PRACTICES, INCLUDING HUMAN OVERSIGHT, TO ENSURE THAT OUTPUTS ARE CORRECT AND COMPLETE AND TO GUARD AGAINST THE OUTPUTS BEING USED IN AN UNSUITABLE OR UNLAWFUL WAY, OR IN VIOLATION OF THE RIGHTS OF OTHERS. YOU SHOULD NOT RELY ON AI OUTPUTS WITHOUT INDEPENDENTLY CONFIRMING THEIR ACCURACY.”
“Law enforcement agencies, public authorities or other judicial bodies and organizations. We disclose Personal Information if we are legally required to do so, or if we have a good faith belief that such use is reasonably necessary to comply with a legal obligation, process or request;”
“If a change to these Terms materially modifies your rights or obligations, we may require that you accept the modified Terms in order to continue to use the Service. Material modifications are effective upon your acceptance of the modified Terms. Immaterial modifications are effective upon publication.”
“To the extent Data falls within the scope of the General Data Protection Regulation or the United Kingdom General Data Protection Regulation, the terms of the Data Processing Attachment in Appendix 1 of these Terms (“ DPA ”) apply to the processing of any Customer Personal Data (as defined in the DPA). To the extent Data falls within the scope of any U.S. state privacy laws or their implementing regulations, the terms of the U.S. State Data Processing Agreement in Appendix 6 (“ U.S. State DPA ”) apply”
“Acknowledge that all the data under your account is owned by the Workspace or Organization and the Workspace or Organization administrators have the right to access, disclose, restrict and remove information in your account. This includes the data that predates when you joined the Workspace or Organization account.”
Legal & contractual transparency: vendor-evidenced, not yet independently corroborated.
Not graded: Agent, not applicable to this scan.
What would strengthen assuranceeach figure is from today's score, resolving one changes the others
Resolving an evidence gap strengthens the dimension it belongs to, and with it the score: 54 → up to 78 with every identified gap resolved.
AI supply chainclick a node to focus it · drag to pan · zoom with the controls
View as list
What you inheritTrustyCyber's AI Shared Responsibility Matrix v1.0
This scan names the vendor’s AI supply chain without assessing the responsibility split, that depends on how you consume the product. Under the common managed models, a deployer inherits 16 of the matrix’s 41 responsibilities from providers, each with named evidence owed.
Map your inherited responsibilitiesAssurance evidence: certifications 3, registry checks and verification ladders, click to view
Held by Amazon Web Services for the hosting infrastructure, as cited in Otter.ai's Appendix 3 security measures. Not a certification of Otter.ai, Inc. or the Otter.ai Service itself; no Otter.ai-held attestation appears in the stashed documents.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Not claimed in any public source scanned. This is the AI-management-system certification — in its absence, the vendor’s AI governance rests on its general security and privacy certifications.
Checked against Data Privacy Framework (dataprivacyframework.gov), Nov 1, 2026: Verified on the registry
Sources 13, click to view
Appendix: standards landscape 8, click to view
Where each standard behind this assessment stands today, from TrustyCyber’s continuously maintained standards radar.
Want to go further?
This scan assesses Otter.ai at an organisational level. Assurance can vary significantly between products, models and agents, enter the product you’re evaluating to run a deeper AI System Assurance Scan.
Scan a specific product →This automated result is based on publicly available information at the time of scanning. It is not an audit, certification, legal opinion or assurance engagement. Publicly unavailable evidence may materially change the conclusion.
Monitor for changes
Get an email if its TRUSTYCYBER Score, grade or certifications change. One credit per refresh; reading the report always stays free.