Circleback, Fireflies.ai, Fathom, Granola, tl;dv, Gong, Fellow and Avoma each state SOC 2 on their own pages. They differ on report type, where the report sits, whether the statement is tied to a plan and HIPAA support.
Which AI meeting notetakers are SOC 2 compliant?
All eight state SOC 2. Seven word it as Type II and Gong words it as Type 2, which is the same report type.
- Circleback: SOC 2 Type II, stated company-wide, plus a statement that customer data is not used to train models.
- Fireflies.ai: Type II, listed on every plan from Free to Enterprise.
- Fathom: Type II, stated company-wide.
- Granola: Type II on every plan including Basic.
- tl;dv: Type II, with a Vanta trust report.
- Gong: Type 2, plus ISO/IEC 27001:2022 and other ISO standards.
- Fellow: Type II, stated company-wide, with the report on request under a mutual NDA.
- Avoma: Type II, plus ISO/IEC 42001:2023, with a Trust Center.
SOC 2 Type I vs Type II for an AI notetaker
A SOC 2 Type I report describes whether a vendor's security controls are designed appropriately at one point in time. A Type II report tests whether they operated effectively over a period, so it is the stronger statement.
Circleback SOC 2 Type II
What the vendor states: Circleback's security page says it is SOC 2 Type II and EU-U.S. Data Privacy Framework certified and encrypts data at rest and in transit.
Trust portal: The security portal at security.circleback.ai has more information, including a report of an external pentest.
Plans it covers: The statement is company-wide. Prices are Free $0, Pro $15, Business $25 and Enterprise $35 per user per month billed annually. See Circleback pricing.
Also relevant: Circleback does not use customer data to train models and supports GDPR obligations as a processor under its Data Processing Agreement.
Cons: The HIPAA BAA, SSO and SCIM are not on every plan, and the BAA is Circleback's standard BAA with no custom versions.
Best for: A company-wide SOC 2 Type II statement and a no-training statement, with a security portal that includes a pentest report.
Fireflies.ai SOC 2 Type II
What the vendor states: Fireflies.ai says it is certified for GDPR, SOC 2 Type II and HIPAA compliance.
Trust portal: The security page links a Trust Center for SOC 2, HIPAA and GDPR at trust.fireflies.ai.
Plans it covers: The pricing table lists SOC 2 Type II compliance on Free, Pro, Business and Enterprise. HIPAA compliance, SSO, SCIM and custom data retention are Enterprise only.
Also relevant: Fireflies.ai says it does not train on customer data by default.
Best for: SOC 2 Type II on every plan, including Free, with HIPAA compliance on Enterprise.
Fathom SOC 2 Type II
What the vendor states: Fathom's help center says it is HIPAA, SOC2 Type II and GDPR compliant.
Trust portal: The help center points to the Trust Center at trust.fathom.video for privacy and security information.
Plans it covers: The statement is company-wide. Fathom publishes a blanket BAA, and a signed BAA is listed under Enterprise.
Also relevant: Fathom stores all data in the United States and uses de-identified customer data to improve its own models, with an opt-out.
Best for: Buyers who want a published blanket BAA alongside SOC 2 Type II.
Granola SOC 2 Type II
What the vendor states: Granola's security page says independent auditors found its practices meet SOC 2 Type 2 standards, and its help center says it holds SOC 2 Type II certification.
Trust portal: The help center says the full SOC 2 report is available through the Trust Center via Request Access.
Plans it covers: The pricing table lists SOC 2 Type II as included on Basic, Business and Enterprise. HIPAA support and a BAA are for Enterprise customers.
Also relevant: All data is stored on AWS in the US.
Best for: Buyers who want to request the full report on every plan, including free Basic.
tl;dv SOC 2 Type II
What the vendor states: tl;dv's security commitment page says its SOC 2 (Type II) shows its commitment to continuous improvement of its controls for security, privacy, availability and confidentiality.
Trust portal: The page links a Vanta Trust Report at trust.tldv.io.
Plans it covers: The statement is company-wide.
Also relevant: Its data centers are all in Europe, and no customer data is used to train the AI.
Best for: Buyers who want a Vanta trust report and European data centers.
Gong SOC 2 Type 2
What the vendor states: Gong's trust page lists SOC 2 (Type 2), ISO/IEC 27001:2022, 27017, 27018, 27701 and 42001:2023. It says that while Gong is not a covered entity, it maps HIPAA controls in its SOC 2 Type II audit.
Trust portal: Gong describes a publicly available Trust Center at trust.gong.io with downloadable documentation, including a "SOC 2 Type 2 + HIPAA Report".
Plans it covers: The statement is company-wide.
Also relevant: Gong says customer data is never used to train generative AI models.
Best for: Buyers who also need ISO standards such as ISO/IEC 27001:2022.
Fellow SOC 2 Type II
What the vendor states: Fellow's help center says its latest SOC 2 Type II report covers the Security and Confidentiality criteria and is valid for 12 months.
Trust portal: The help center links the Trust Centre at trust.fellow.app. The report is available on request under a mutual NDA.
Plans it covers: The statement is company-wide. Fellow provides BAAs for HIPAA through Support.
Also relevant: Fellow says it never trains on customer data and hosts on AWS in the Canada Central region.
Best for: Buyers who accept a mutual NDA and want a BAA from Support.
Avoma SOC 2 Type II
What the vendor states: Avoma's security page says it maintains SOC 2 Type II and ISO/IEC 42001:2023 certifications.
Trust portal: The page links the Trust Center at trust.avoma.com, which uses Request access.
Plans it covers: The statement is company-wide. HIPAA compliance is listed on Enterprise.
Also relevant: Avoma hosts all its software in AWS facilities in the USA.
Best for: Buyers who want ISO/IEC 42001:2023 alongside SOC 2 Type II.
SOC 2 compliant AI notetakers side by side
| Tool | SOC 2 type stated | Report access | Covers free plan | HIPAA BAA |
|---|---|---|---|---|
| Circleback | Type II | Security portal with a pentest report | Company-wide statement | Standard BAA, not on every plan |
| Fireflies.ai | Type II | Trust Center | Yes, listed on Free | HIPAA compliance, Enterprise |
| Fathom | Type II | Trust Center | Company-wide statement | Blanket BAA published; signed BAA under Enterprise |
| Granola | Type 2 and Type II | Trust Center, Request Access | Yes, listed on Basic | BAA for Enterprise customers |
| tl;dv | Type II | Vanta trust report | Company-wide statement | |
| Gong | Type 2 | Public Trust Center | Company-wide statement | |
| Fellow | Type II | On request under a mutual NDA; Trust Centre | Company-wide statement | BAA on request from Support |
| Avoma | Type II | Trust Center, Request access | Company-wide statement | HIPAA compliance on Enterprise |
What SOC 2 doesn't tell you
A SOC 2 statement does not answer three other questions.
- HIPAA and BAA: A SOC 2 report does not replace a BAA. Circleback includes its standard BAA on some plans, Granola includes one with Enterprise, Fathom publishes a blanket BAA, Fellow provides BAAs on request, and Avoma lists HIPAA compliance on Enterprise.
- Data region: Circleback processes data in the United States, Fathom, Granola and Avoma keep it in the US, tl;dv says its data centers are in Europe, and Fellow hosts on AWS in the Canada Central region.
- Training on data: Circleback, tl;dv and Fellow say they do not train on customer data, Gong says never for generative models, Fireflies.ai says not by default, and Fathom and Granola train on de-identified or anonymized data with an opt-out.
How to choose an AI notetaker by SOC 2 status
- Free plan listed: Fireflies.ai and Granola list SOC 2 Type II on their free plans, while Circleback, Fathom, tl;dv, Gong, Fellow and Avoma make company-wide statements.
- Report on request: Granola and Avoma offer Request Access, Fellow shares its report under a mutual NDA, and Gong lists downloadable documents.
- ISO as well: Gong lists ISO/IEC 27001:2022 and Avoma lists ISO/IEC 42001:2023, while Fathom and Granola say they do not have ISO 27001.
FAQ
Which AI meeting notetakers are SOC 2 compliant?
Circleback, Fireflies.ai, Fathom, Granola, tl;dv, Fellow and Avoma name Type II on their own pages, and Gong names Type 2.
Is Fireflies SOC 2 compliant?
Yes. Fireflies.ai says it is certified for SOC 2 Type II, listed on Free, Pro, Business and Enterprise.
Is Granola SOC 2 Type II?
Yes. Granola holds SOC 2 Type II certification, listed on Basic, Business and Enterprise, with the report available through its Trust Center.
How do I get an AI notetaker's SOC 2 report?
Start with the vendor's trust portal. Granola's and Avoma's Trust Centers offer Request Access, Fellow shares its report on request under a mutual NDA, and Fireflies.ai, Fathom, tl;dv and Gong link a trust center or trust report. Circleback's security portal at security.circleback.ai includes a pentest report.
Does a SOC 2 statement cover the free plan?
Fireflies.ai and Granola list it on their free plans. Circleback, Fathom, tl;dv, Gong, Fellow and Avoma make company-wide statements.
Is Circleback SOC 2 compliant?
Yes. Circleback's security page says it is SOC 2 Type II, and its security portal at security.circleback.ai has a report of an external pentest.