Is Fireflies AI safe?

That is a competent cloud vendor. It is not the same as your audio never leaving your machine, and it does not settle whether the people you recorded agreed.

Fireflies states that your data is stored and processed in its cloud infrastructure in the United States, on AWS and GCP. Recordings, transcripts, and summaries persist there. We found no statement that audio is deleted automatically after transcription; Fireflies instead documents that an account can set an automatic deletion period for recordings, transcripts, and notes, with one month as its example.

Private Storage, on the Enterprise plan, stores transcripts, audio, and summaries in a Fireflies-managed bucket in Google Cloud US West. A related option, Bring Your Own Storage, puts them in a bucket you own on AWS S3 or Google Cloud Storage. Read the boundary carefully: Fireflies states that data is still processed on its US servers and only stored in the designated bucket. Either option changes who holds the files, not whether Fireflies sees them.

Fireflies’ data processing agreement points to a subprocessor list on its trust center. That page is rendered by script and we could not read it on the review date, so this page names no AI or transcription vendors. If which third parties touch your audio matters to you, open the list yourself before deciding.

Training. Section 5(c) of the terms of service says Fireflies will not use your User Content to train, retrain, fine-tune, or otherwise improve any generative AI models. The privacy policy adds that it does not use personal information for model training and contractually prohibits its vendors from doing so. We found no plan-based exception. This is stronger and clearer than many competitors’ language.

Access. Fireflies states that internally its teams do not have access to your meeting content by default and that any access requires your explicit permission, typically for support. Workspace sharing defaults are a separate, user-controlled layer: an admin can set new meetings to be visible to teammates and anyone with the link, or only to participants and teammates. Check which one your workspace uses, because the vendor’s controls do not help if your own default is wide open.

Deletion. Deleted meetings are, per Fireflies, permanently removed. The terms say deleted content is removed within a reasonable timeframe, with backup and legal-compliance carve-outs, which is a promise without a number. Account deletion is documented at 30 days in both the help center and the privacy policy. For a recording of a meeting you did not host, Fireflies directs you to the host or to support, since the file belongs to their account.

• SOC 2 Type II. Fireflies’ security page lists it. The only dated statement we found is a January 2022 blog post citing compliance as of December 2021. Current attestation is on the trust center, which we could not render; ask for the report.
• GDPR. Listed on the security page, with a data processing agreement published.
• HIPAA. Fireflies states it provides HIPAA-compliant BAAs to healthcare organizations. Our Fireflies HIPAA page covers the plan and storage conditions that come with it.
• ISO 27001. Not claimed on any Fireflies page we read. Third-party trackers disagree with each other about it, so treat it as unverified.

This is where a careful reading of Fireflies’ own compliance article matters most. The bot announces itself three ways: a chat message that it has joined, a spoken notice roughly 10 seconds after Take Notes starts, and an AI Taking Notes watermark on its camera tile. That is more than some competitors do.

Then the model. Fireflies writes that on many platforms users are considered OK with recording as long as they do not object, and that participants must remove the bot or reject recording if they do not agree. Some integrations require opt-in before the bot joins; the default posture elsewhere is opt-out. And Fireflies is explicit that if you disable a consent or notification option, you are responsible for informing participants and for complying with applicable recording laws.

Silence is not consent in an all-party consent state, and a spoken notice followed by nobody objecting may not meet that bar. Fireflies is not claiming otherwise; it is telling you the obligation is yours. If your calls cross into California, Florida, Illinois, or the other all-party states, read recording consent law by state before relying on the bot’s announcement.

One data point on how this plays out: a class action filed in December 2025 in an Illinois federal court alleges that Fireflies records and stores the voiceprints of every meeting participant, including people with no account, without consent under Illinois’ biometric privacy law. It is an allegation and unresolved on our review date. Fireflies’ privacy policy does state that voice and biometric data is destroyed within three years of an individual’s last interaction, a clause specific to that law.

We searched for a reported security incident at Fireflies and found none from Fireflies or from a reputable outlet as of the review date. Absence of a report is not proof of absence, but it is what the record shows.

If your question is whether Fireflies handles data responsibly: its documentation says the right things, in more concrete language than most, and we found nothing contradicting it. Set a retention period, tighten the workspace sharing default, and confirm the subprocessor list, and you have done what a cloud notetaker allows.

If your question is whether the people on your calls agreed: the bot’s announcement helps, but Fireflies puts the legal duty on you, and in all-party states that duty is not met by silence.

If your question is whether the audio can stay off a vendor’s servers entirely: no cloud notetaker can say yes, and Fireflies does not pretend to. That is the case for capturing on your own machine. Minutes records device-side, transcribes locally with whisper.cpp, and writes markdown to your own disk; nothing joins the call and no audio is uploaded. Content leaves your machine only when you send it somewhere, such as a summarizer you configure or an AI agent you connect, and out of the box neither is happening. The full list is on our security page, and the direct comparison, including who should stay with Fireflies, is at Fireflies and Minutes.