What actually leaves your machine when you use an AI notetaker

Every AI meeting notetaker claims some version of "your data is safe." Most of those claims are marketing wrappers around whatever the product's architecture happens to do. The real question — the one that matters to security teams evaluating the tool for install — is more specific: when this notetaker is running on my laptop, exactly what data leaves the machine, when, to which company?

This post breaks it down for the four AI notetakers I get asked about most: Otter, Fireflies, Granola, and AI Assist (my own product). Skim the tables, then read the section for whichever you're evaluating.

The four categories of data that can leave

Every AI notetaker touches four kinds of data. What "leaves your machine" depends on which categories the vendor moves off-box, and where they end up.

1. Audio — the raw waveform of the meeting, captured either by a bot in the call or by the user's browser tab.
2. Transcript — the text transcription produced from that audio, plus any captions the platform (Meet, Zoom, Teams) natively provides.
3. Summaries + LLM prompts — the text sent to a language model to produce meeting notes, action items, or answers to follow-up questions.
4. Metadata — meeting IDs, participant lists, timestamps, calendar events, contact info, and analytics telemetry.

A tool can be "local-first" for one category and full-cloud for another. That's why "your audio stays private" is usually not a complete claim — even if audio never leaves, the transcript often does.

Otter

Otter is a fully-cloud SaaS. A bot ("Otter Assistant") joins your Meet, Zoom, or Teams call as a participant. When it's running:

Everything leaves. Otter's terms of service (as of 2026) don't currently use your recordings for training their base models, but the full pipeline runs on their servers with their vendor accounts. If your legal or security team's threshold is "audio and transcripts must never touch a vendor server we can't audit," Otter is disqualified before installation.

Fireflies

Fireflies uses the same architecture as Otter — a bot ("Fireflies Fred") joins the call, audio streams to their cloud, transcription and summarization run on their infrastructure.

Same qualitative story as Otter, with two Fireflies-specific wrinkles: their CRM auto-push (Salesforce, HubSpot, etc.) means transcripts and summaries can propagate to a fourth or fifth vendor if you enable those integrations; and their AskFred Q&A processes retrospective queries through their own AI stack, which may or may not match the LLM you'd choose yourself.

Granola

Granola is the "no-bot" pioneer — it captures audio locally via the macOS system audio path rather than sending a bot into the call. Its trust story is stronger than Otter or Fireflies on the "no third-party joins your call" axis, but the audio path itself still routes through Granola's cloud for transcription.

Granola's product polish and workspace collaboration are excellent — for teams that don't need the audio-stays-local property, it's a very defensible choice. But the "no bot" story is often mistaken for "no cloud processing." The audio still leaves the machine to be transcribed.

AI Assist

Full disclosure: I'm the founder. This post exists partly because an r/selfhosted commenter pointed out (correctly) that my earlier "audio never leaves your machine" wording was misleading — audio does leave, just to the user's own OpenAI account rather than through my backend. Below is the accurate version, and it's still a meaningfully different trust story than the alternatives above.

Two things about this setup that are different from the vendors above:

• The vendor relationship is one you already have. If OpenAI and Anthropic are already on your team's approved-vendor list (they usually are — most engineering teams already run other services through them), you're not adding a fifth trust boundary; you're using ones you already audit.
• My backend is not in the audio, transcript, or LLM prompt path. The only thing it stores is billing state (Stripe subscription IDs, license flags) and your Auth0 identity for device pairing. No meeting content, ever.

Full data-flow diagram and per-category encryption at rest: /security. Every claim in this post is verifiable via lsof -i on the running helper to see what outbound connections it makes.

What to ask any vendor before installing

Regardless of which tool you pick, if your team asked me to evaluate one before install, these are the five questions I'd want answered in writing:

1. Does audio leave my machine? If yes, to whose servers? Not "is it encrypted" — encryption in transit is table stakes. The question is which company's compute processes it.
2. Does the transcript persist on a server I don't control? If yes, for how long, under what retention policy, and what happens on account termination?
3. Do LLM prompts go to a model the vendor chose or one I chose? If the vendor picks the model, they can silently swap it. If you pick, you can pin.
4. What integrations forward transcripts elsewhere by default? CRM push, Slack, calendar sync — each is a fifth or sixth trust boundary to think about.
5. Can I verify these answers without trusting your word? lsof, netstat, packet captures, a published data-flow doc — the best vendors let you check.

Answer these five for any tool and you'll have a clearer picture of what "your data is safe" actually means in that product's specific case. That's usually a much shorter list than the marketing page suggests.