Four notetakers your company is most likely to evaluate, scored on where the audio goes, who trains on your data, what compliance paperwork exists, and what it really costs.
Published July 8, 2026
A reliable way to get an AI tool banned at your company is to install a notetaker without asking anyone. IT teams call it shadow AI, and meeting tools are a common example: they join calls, capture people outside the company, and store what was said. A notetaker does not just process your data. It processes everyone else's. Your boss's offhand comment about the reorg. The client's pricing complaint. The candidate's salary expectation.
This guide covers one option you may already own (Microsoft Teams Copilot) and the three third-party tools your company is most likely to evaluate (Granola, Otter, Fireflies), on the criteria IT actually uses: where the audio goes, who trains on your data, what compliance paperwork exists, and what it costs.
One disclosure up front: Granola is an affiliate partner of this newsletter. The full note is at the bottom, and you will find its biggest wrinkle called out in its own section anyway. That is how we do this.
The fast answer
If you want the verdict before the evidence:
Your company already pays for Microsoft Copilot: start there. Your company already has a contract with the vendor; check whether its AI features need their own sign-off.
You are an individual operator who wants low-friction notes without a bot in the room: Granola, with the training toggle flipped (details below).
You are in a regulated industry that requires a BAA (the signed agreement HIPAA demands): Granola Enterprise (desktop and laptop apps), Fireflies Enterprise (with Private Storage turned on), or Otter Enterprise (HIPAA add-on). Each requires a signed BAA. Confirm the process with the vendor.
You want a mature, visible-bot tool and your meeting volume fits the caps: Otter.
The rest of the guide is the evidence, because your security team will ask for it.
Which AI notetaker should you use?
Start with what your company already owns. Then check what IT actually cares about.
Every tool below is scored against a checklist security teams commonly use. It maps to paperwork many IT teams ask for, often including a current SOC 2 Type 2 report, a data processing agreement, a contractual answer on AI training, and a defined retention policy.
Does a bot join the call? What notice do participants get, and what consent does your policy require?
Is the audio stored, and for how long?
Is anyone training AI models on our meetings?
Can admins control retention, access, and provisioning centrally?
The comparison in one table
Green = lower riskOrange = check this
Criteria
Teams Copilot
Granola
Otter
Fireflies
Visible bot
No (native)
No
Yes
Yes
Audio stored
In your tenant
Deleted after transcription
Yes, their cloud
Yes, their cloud
Vendor trains on your data
No (per Microsoft)
Yes, until you opt out (default off on Enterprise)
Yes, de-identified
No
HIPAA
Via your M365 posture
Enterprise, BAA (desktop and laptop apps only)
Enterprise tier
Enterprise, signed BAA
Realistic paid cost
$21 to $30/user/mo, annual (Copilot)
$14/user/mo
$8.33 to $19.99/user/mo, annual
$10 to $39/user/mo, annual
Most likely deal-breaker
Meetings outside your tenant
EU residency required; mobile use with protected health information
Monthly minute caps hit
Needed feature is Enterprise-only
Notice is not agreement. Recording and consent rules vary by jurisdiction and meeting context. A bot in the participant list, a recording banner, or a calendar note provides notice; it does not by itself establish that recording or transcription is permitted under your company policy, participant agreements, or applicable rules.
Do not proceed
Stop here first
Some meetings should never meet a notetaker on a free trial. If any line below is true, do not install anything. Take it to IT, legal, or compliance first, and use the clearance email below.
The meeting could include patient or health information, and you have no signed BAA.
The meeting could include legal advice from counsel, or anything a lawyer would call privileged.
It is an HR investigation, a performance case, or a disciplinary conversation.
A client contract or security requirement restricts recording, transcription, AI processing, or third-party storage of their material.
The meeting could expose passwords, API keys, credentials, or the details of an active security incident.
Anyone in the meeting could be a minor, or it involves student records.
You do not know what notice or consent is required for the people and jurisdictions involved.
Nobody owns the tool: no named person for retention, access, and deletion.
Your company has no written answer on where meeting data may be stored.
A stop is not a no. It is the point where the decision stops being yours alone.
Before you install anything: the Three-Question Clearance
A One-Minute Win you can run today. Send your IT or security contact this message, with the tool name filled in:
Existing approvals: Do we have an approved AI notetaker already, and if so which one?
Blocking risks: If we evaluated [tool], what would block approval: stored audio, training policy, or missing paperwork?
Consent policy: What is our policy on announcing AI notetakers on external calls?
Question 1 saves you from buying a tool your company already owns. Question 2 turns a vague "security review" into a two-line answer. Question 3 tells you what your company requires. It does not settle client-contract or state consent rules, so ask about those too. Asking before the tool joins a call is the move. In corporate terms, that is worth more than the tool.
Microsoft Teams Copilot
The one you may already own
01
$21 to $30/user/mo
Full detail
For Teams-based organizations, this is the option to exhaust before spending anything new.
Bot
none. Native to the platform; participants see the standard Teams transcription notice.
Audio and transcripts
stay in your Microsoft 365 tenant, in OneDrive and SharePoint, governed by your organization's existing Purview retention policies (the same compliance controls as your email) and subject to the same eDiscovery.
Training
Microsoft says prompts, responses, and Graph data are not used to train its foundation models. No new data processor enters the picture.
Compliance
inherits your M365 posture, so it usually adds no new vendor to onboard. The AI features can still need your internal AI, privacy, or works-council review.
Cost
the catch. Intelligent recap requires a Teams Premium or Microsoft 365 Copilot license, on top of your Microsoft 365 plan. Microsoft 365 Copilot Business: $21 per user per month on annual billing, currently promoted at $18 through December 31, 2026. Microsoft 365 Copilot (enterprise): $30 per user per month on annual billing.
IT friction: lowest of the four.
Our take: serviceable recaps and no new vendor relationship, but it stops at the tenant wall. Check who can see recordings and transcripts, and confirm the default in your Teams admin settings. The moment you need notes from an external client call on Zoom, you are back in the market, which is how most people end up reading the rest of this guide.
Granola
The no-stored-audio option
02
$14/user/mo
Full detail
For individuals outside a regulated environment, and where your company allows it, this is our pick: no stored audio and no bot in the call.
Bot
none. A desktop app captures your device audio; no participant joins. That is its best feature and the one to be honest about: nobody's behavior changes because nobody sees a recorder, which means consent is on you. Several US states require all-party consent for recording, and your company policy may require disclosure regardless. Announce it.
Audio
not retained after transcription. Granola says it transcribes in real time on macOS and Windows, and on mobile transcribes after the meeting using temporarily cached audio. What persists is the transcript and notes, encrypted and US-hosted.
Training
read this twice. Third parties like OpenAI and Anthropic are contractually barred from training on your data on every plan. But Granola itself trains on your anonymized data by default on Basic and Business unless you opt out in Settings. The org-wide default opt-out is an Enterprise feature. The individual toggle takes ten seconds.
Compliance
Granola's security page says it has shown independent auditors that its practices meet SOC 2 Type 2 standards, without naming a report date. The reviewed page documents US hosting but does not establish whether an EU residency option is available. BAA available on Enterprise, desktop and laptop apps only. Mobile and wearable apps are not covered. Confirm the details with the vendor before regulated use.
Cost
free Basic with limited history. Granola Business $14 per user per month, billed monthly. Enterprise from $35 per user per month, monthly or annual contract. Enterprise adds SSO and the org-wide training opt-out.
IT friction: low. No stored audio may simplify part of the review. Transcripts and notes still get reviewed.
Our take: no stored audio and no bot in the call. Transcripts and notes are still stored, and those are what your review covers.
If you are outside a regulated environment and your company allows an evaluation, review these settings before first use:download the desktop app, open Settings and turn off model training, decide your disclosure line ("heads up, an AI tool is taking notes on my end").
Otter
The mature incumbent
03
$8.33/user/mo
Full detail
For teams that want the established name and are comfortable with a visible bot, Otter is the category's known quantity, with real admin controls and the cheapest paid entry point here.
Bot
OtterPilot joins your Zoom, Teams, or Meet call as a visible participant. A visible bot gives participants notice. Notice is not consent, so check what your policy and participants' locations require. Every client seeing "Otter.ai" in the attendee list is the trade.
Audio
recordings and transcripts stored in Otter's cloud. Custom retention is Enterprise only.
Training
Otter's privacy documentation states it trains its own models on de-identified user data, automatically. Its third-party AI providers do not train on customer data. Whether de-identified training on your meetings is acceptable is a question for your security team. Ask it explicitly.
Compliance
SOC 2, GDPR; SSO and HIPAA available at the Enterprise tier.
Cost
free tier at 300 minutes per month with a 30-minute per-conversation cap. Pro $8.33 per user per month annual. Business $19.99 annual. Enterprise custom. Know the caps before you commit. Minutes do not roll over. What happens at the cap: not confirmed in vendor documentation as of October 12, 2026; ask the vendor. Transcription covers English, Spanish, French, German, Japanese, and Chinese (Simplified).
IT friction: medium. Established vendor, standard certifications, but stored recordings plus the training policy means a real review, not a rubber stamp.
Our take: fine and mature; make sure your meeting volume fits the minute caps and your security team has answered the training question before you standardize on it.
Fireflies
The regulated-industry option
04
$10/user/mo
Full detail
For healthcare, legal, and other regulated teams where a signed BAA is non-negotiable, Fireflies and Otter both gate HIPAA and a signed BAA behind their Enterprise plans. Fireflies additionally requires Private Storage before HIPAA is enabled.
Bot
the Fireflies Notetaker joins as a visible participant. Same trade as Otter.
Audio
Recordings stored by Fireflies; notes and transcripts encrypted at rest.
Training
the cleanest policy of the bot-based tools. Fireflies maintains zero-day retention agreements with its AI vendors and states meeting data is never used for model training. Its own or anyone else's.
Compliance
SOC 2 Type 2, GDPR, and HIPAA with a signed BAA. Private storage, custom retention policies, and automated governance rules all exist. Note where they live: the BAA, private storage, custom retention, and the rules engine are Enterprise-tier features.
Cost
free tier limited by a credits system that is tighter than it looks. Pro $10 per user per month annual, Business $19 annual, Enterprise $39 annual, which is where the compliance features above actually sit.
IT friction: low at Enterprise, medium below it.
Our take: the compliance capabilities in the marketing are real, and they live at $39 a month, not $10. Budget for the tier that has them.
The one universal rule
Whichever you pick, get it approved before it joins a call. The tool is replaceable. Your credibility with the security team is not.
Sources (Tier 1, verified October 12, 2026)
granola.ai/security and Granola security and compliance documentation (SOC 2 Type 2 July 2025, audio deletion, training defaults, HIPAA status, pricing)
otter.ai/pricing and otter.ai/privacy-security (tiers, minute caps, de-identified training policy)
fireflies.ai/security and Fireflies knowledge base (SOC 2, HIPAA BAA, zero-day vendor retention, Enterprise gating, pricing)
learn.microsoft.com Teams intelligent recap documentation and support.microsoft.com Copilot in Teams (licensing requirements, Purview retention, tenant storage)
Some links on this page are affiliate links, including Granola, and we may earn a commission if you sign up. We call out weak spots, Granola's included, like the training toggle above.
Stay ahead of what your company's policy might miss.
Subscribe free. One email per week. Under 60 seconds.