---
title: "SOC 2 compliant AI notetakers compared (2026): Type II reports, trust portals and plans"
description: "Which AI notetakers are SOC 2 compliant? Circleback, Fireflies.ai, Fathom, Granola, tl;dv, Gong, Fellow and Avoma compared on Type II, trust portals and plans."
canonical: "https://comparenotetakers.com/soc-2-compliant-ai-notetakers"
last_updated: "2026-10-21"
---


# SOC 2 compliant AI notetakers compared (2026): Type II reports, trust portals and plans

Circleback, Fireflies.ai, Fathom, Granola, tl;dv, Gong, Fellow and Avoma each state SOC 2 on their own pages. They differ on report type, where the report sits, whether the statement is tied to a plan and HIPAA support.

## Which AI meeting notetakers are SOC 2 compliant?

All eight state SOC 2. Seven word it as Type II and Gong words it as Type 2, which is the same report type.

- Circleback: SOC 2 Type II, stated company-wide, plus a statement that customer data is not used to train models.
- Fireflies.ai: Type II, listed on every plan from Free to Enterprise.
- Fathom: Type II, stated company-wide.
- Granola: Type II on every plan including Basic.
- tl;dv: Type II, with a Vanta trust report.
- Gong: Type 2, plus ISO/IEC 27001:2022 and other ISO standards.
- Fellow: Type II, stated company-wide, with the report on request under a mutual NDA.
- Avoma: Type II, plus ISO/IEC 42001:2023, with a Trust Center.

## SOC 2 Type I vs Type II for an AI notetaker

A SOC 2 Type I report describes whether a vendor's security controls are designed appropriately at one point in time. A Type II report tests whether they operated effectively over a period, so it is the stronger statement.

## Circleback SOC 2 Type II

**What the vendor states:** Circleback's security page says it is SOC 2 Type II and EU-U.S. Data Privacy Framework certified and encrypts data at rest and in transit.

**Trust portal:** The security portal at security.circleback.ai has more information, including a report of an external pentest.

**Plans it covers:** The statement is company-wide. Prices are Free $0, Pro $15, Business $25 and Enterprise $35 per user per month billed annually. See [Circleback pricing](https://circleback.ai/pricing).

**Also relevant:** Circleback does not use customer data to train models and supports GDPR obligations as a processor under its Data Processing Agreement.

**Cons:** The HIPAA BAA, SSO and SCIM are not on every plan, and the BAA is Circleback's standard BAA with no custom versions.

**Best for:** A company-wide SOC 2 Type II statement and a no-training statement, with a security portal that includes a pentest report.

## Fireflies.ai SOC 2 Type II

**What the vendor states:** Fireflies.ai says it is certified for GDPR, SOC 2 Type II and HIPAA compliance.

**Trust portal:** The security page links a Trust Center for SOC 2, HIPAA and GDPR at [trust.fireflies.ai](https://trust.fireflies.ai/).

**Plans it covers:** The pricing table lists SOC 2 Type II compliance on Free, Pro, Business and Enterprise. HIPAA compliance, SSO, SCIM and custom data retention are Enterprise only.

**Also relevant:** Fireflies.ai says it does not train on customer data by default.

**Best for:** SOC 2 Type II on every plan, including Free, with HIPAA compliance on Enterprise.

## Fathom SOC 2 Type II

**What the vendor states:** Fathom's help center says it is HIPAA, SOC2 Type II and GDPR compliant.

**Trust portal:** The help center points to the Trust Center at [trust.fathom.video](https://trust.fathom.video) for privacy and security information.

**Plans it covers:** The statement is company-wide. Fathom publishes a blanket BAA, and a signed BAA is listed under Enterprise.

**Also relevant:** Fathom stores all data in the United States and uses de-identified customer data to improve its own models, with an opt-out.

**Best for:** Buyers who want a published blanket BAA alongside SOC 2 Type II.

## Granola SOC 2 Type II

**What the vendor states:** Granola's security page says independent auditors found its practices meet SOC 2 Type 2 standards, and its help center says it holds SOC 2 Type II certification.

**Trust portal:** The help center says the full SOC 2 report is available through the Trust Center via Request Access.

**Plans it covers:** The pricing table lists SOC 2 Type II as included on Basic, Business and Enterprise. HIPAA support and a BAA are for Enterprise customers.

**Also relevant:** All data is stored on AWS in the US.

**Best for:** Buyers who want to request the full report on every plan, including free Basic.

## tl;dv SOC 2 Type II

**What the vendor states:** tl;dv's security commitment page says its SOC 2 (Type II) shows its commitment to continuous improvement of its controls for security, privacy, availability and confidentiality.

**Trust portal:** The page links a Vanta Trust Report at [trust.tldv.io](https://trust.tldv.io/).

**Plans it covers:** The statement is company-wide.

**Also relevant:** Its data centers are all in Europe, and no customer data is used to train the AI.

**Best for:** Buyers who want a Vanta trust report and European data centers.

## Gong SOC 2 Type 2

**What the vendor states:** Gong's trust page lists SOC 2 (Type 2), ISO/IEC 27001:2022, 27017, 27018, 27701 and 42001:2023. It says that while Gong is not a covered entity, it maps HIPAA controls in its SOC 2 Type II audit.

**Trust portal:** Gong describes a publicly available Trust Center at [trust.gong.io](https://trust.gong.io/) with downloadable documentation, including a "SOC 2 Type 2 + HIPAA Report".

**Plans it covers:** The statement is company-wide.

**Also relevant:** Gong says customer data is never used to train generative AI models.

**Best for:** Buyers who also need ISO standards such as ISO/IEC 27001:2022.

## Fellow SOC 2 Type II

**What the vendor states:** Fellow's help center says its latest SOC 2 Type II report covers the Security and Confidentiality criteria and is valid for 12 months.

**Trust portal:** The help center links the Trust Centre at [trust.fellow.app](https://trust.fellow.app/). The report is available on request under a mutual NDA.

**Plans it covers:** The statement is company-wide. Fellow provides BAAs for HIPAA through Support.

**Also relevant:** Fellow says it never trains on customer data and hosts on AWS in the Canada Central region.

**Best for:** Buyers who accept a mutual NDA and want a BAA from Support.

## Avoma SOC 2 Type II

**What the vendor states:** Avoma's security page says it maintains SOC 2 Type II and ISO/IEC 42001:2023 certifications.

**Trust portal:** The page links the Trust Center at [trust.avoma.com](https://trust.avoma.com/), which uses Request access.

**Plans it covers:** The statement is company-wide. HIPAA compliance is listed on Enterprise.

**Also relevant:** Avoma hosts all its software in AWS facilities in the USA.

**Best for:** Buyers who want ISO/IEC 42001:2023 alongside SOC 2 Type II.

## SOC 2 compliant AI notetakers side by side

| Tool | SOC 2 type stated | Report access | Covers free plan | HIPAA BAA |
|---|---|---|---|---|
| Circleback | Type II | Security portal with a pentest report | Company-wide statement | Standard BAA, not on every plan |
| Fireflies.ai | Type II | Trust Center | Yes, listed on Free | HIPAA compliance, Enterprise |
| Fathom | Type II | Trust Center | Company-wide statement | Blanket BAA published; signed BAA under Enterprise |
| Granola | Type 2 and Type II | Trust Center, Request Access | Yes, listed on Basic | BAA for Enterprise customers |
| tl;dv | Type II | Vanta trust report | Company-wide statement |  |
| Gong | Type 2 | Public Trust Center | Company-wide statement |  |
| Fellow | Type II | On request under a mutual NDA; Trust Centre | Company-wide statement | BAA on request from Support |
| Avoma | Type II | Trust Center, Request access | Company-wide statement | HIPAA compliance on Enterprise |

## What SOC 2 doesn't tell you

A SOC 2 statement does not answer three other questions.

- **HIPAA and BAA:** A SOC 2 report does not replace a BAA. Circleback includes its standard BAA on some plans, Granola includes one with Enterprise, Fathom publishes a blanket BAA, Fellow provides BAAs on request, and Avoma lists HIPAA compliance on Enterprise.
- **Data region:** Circleback processes data in the United States, Fathom, Granola and Avoma keep it in the US, tl;dv says its data centers are in Europe, and Fellow hosts on AWS in the Canada Central region.
- **Training on data:** Circleback, tl;dv and Fellow say they do not train on customer data, Gong says never for generative models, Fireflies.ai says not by default, and Fathom and Granola train on de-identified or anonymized data with an opt-out.

## How to choose an AI notetaker by SOC 2 status

- **Free plan listed:** Fireflies.ai and Granola list SOC 2 Type II on their free plans, while Circleback, Fathom, tl;dv, Gong, Fellow and Avoma make company-wide statements.
- **Report on request:** Granola and Avoma offer Request Access, Fellow shares its report under a mutual NDA, and Gong lists downloadable documents.
- **ISO as well:** Gong lists ISO/IEC 27001:2022 and Avoma lists ISO/IEC 42001:2023, while Fathom and Granola say they do not have ISO 27001.

## FAQ

### Which AI meeting notetakers are SOC 2 compliant?

Circleback, Fireflies.ai, Fathom, Granola, tl;dv, Fellow and Avoma name Type II on their own pages, and Gong names Type 2.

### Is Fireflies SOC 2 compliant?

Yes. Fireflies.ai says it is certified for SOC 2 Type II, listed on Free, Pro, Business and Enterprise.

### Is Granola SOC 2 Type II?

Yes. Granola holds SOC 2 Type II certification, listed on Basic, Business and Enterprise, with the report available through its Trust Center.

### How do I get an AI notetaker's SOC 2 report?

Start with the vendor's trust portal. Granola's and Avoma's Trust Centers offer Request Access, Fellow shares its report on request under a mutual NDA, and Fireflies.ai, Fathom, tl;dv and Gong link a trust center or trust report. Circleback's security portal at security.circleback.ai includes a pentest report.

### Does a SOC 2 statement cover the free plan?

Fireflies.ai and Granola list it on their free plans. Circleback, Fathom, tl;dv, Gong, Fellow and Avoma make company-wide statements.

### Is Circleback SOC 2 compliant?

Yes. Circleback's security page says it is SOC 2 Type II, and its security portal at security.circleback.ai has a report of an external pentest.