Data

Otter and the GDPR: AI training, data location and DPA

Business: Trains on your data, with no documented way to stop it. EU hosting not documented · DPA on request.

Vendor: Otter.aiMeetings and notesChecked on How we check

Verdict

Is Otter GDPR compliant?

Pro

Personal

Trains on your data, with no documented way to stop it

EU hosting not documented · DPA in the terms

Price: $8.33 / user / mo

Business

Business

Trains on your data, with no documented way to stop it

EU hosting not documented · DPA on request

Price: $19.99 / user / mo

No tool is GDPR compliant on its own: that depends on how your business uses it. This page shows the vendor's side, from its own pages. It is not legal advice.

Plans

Which Otter plan stops the AI training?

Every one of the 2 plans we checked trains on your data or doesn't say.

Training

Does Otter train on your data?

Trains on your data by default? · Pro

Checked

Trains on your data, with no documented way to stop it.

Yes. Otter trains its own models on de-identified recordings and transcripts; only Enterprise workspaces are opted out by default

Source: otter.aiFAQ 'Do you use recordings and transcriptions to train your models?'Second source: otter.aiChecked on

Trains on your data by default? · Business

Checked

Trains on your data, with no documented way to stop it.

Yes: Otter trains its own models on de-identified recordings and transcripts. Enterprise workspaces are opted out by default; no opt-out for Business is documented

Source: otter.aiUses of data (effective 16 Jun 2026)Second source: help.otter.aiChecked on

Location

Where does Otter store your data?

Where data is stored by default · Pro

Checked

United States: AWS is the cloud provider and all listed sub-processors are in the US

Source: otter.aiCore infrastructure (AWS, United States)Checked on

Where data is stored by default · Business

Checked

United States: AWS named as cloud provider; all listed sub-processors in the US

Source: otter.aiCore infrastructure (AWS, United States)Second source: otter.aiChecked on

Contract

Does Otter sign a data processing agreement?

Data processing agreement (DPA) · Pro

Checked

DPA in the terms.

Yes, inside the Terms of Service (Appendix 1, GDPR DPA), which apply to all plans

Source: otter.aiSection 18.2 and Appendix 1Checked on

Data processing agreement (DPA) · Business

Checked

DPA on request.

Yes, inside the Terms of Service (Appendix 1, GDPR DPA); terms effective 19 Sep 2025; a signing step is referenced but not described

Source: otter.aiSection 18.2 and Appendix 1Checked on

Processors

Who else handles Otter data?

Sub-processors (companies that handle the data for them) · Pro

Checked

17 listed.

Public. 17 entries, all US (one also in the Philippines and Honduras); AI: Anthropic, OpenAI; effective 31 Mar 2026

Source: otter.aiCore and other sub-processorsChecked on

EU–US Data Privacy Framework · Pro

Checked

On the list.

Active (Otter.ai, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Otter.ai'Checked on

Sub-processors (companies that handle the data for them) · Business

Checked

17 listed.

Public. 17 entries, all US (one also Philippines and Honduras); AI: Anthropic, OpenAI; effective 31 Mar 2026; changes posted on the page

Source: otter.aiCore and other sub-processorsChecked on

EU–US Data Privacy Framework · Business

Checked

On the list.

Active (Otter.ai, Inc.; EU-US, Swiss-US, UK Extension)

Source: dataprivacyframework.govSearch 'Otter.ai'Checked on

Retention

How long does Otter keep your data?

How long data is kept · Pro

Checked

Conversations stay until deleted; deleted conversations sit in the Trash for 30 days, or go at once if the Trash is cleared

Source: otter.aiParagraph on deleting conversationsChecked on

How long data is kept · Business

Checked

Conversations stay until deleted; deleted conversations sit in the Trash and are removed after 30 days, or at once if the Trash is cleared

Source: otter.aiParagraph on deleting conversationsChecked on

Security

Which certifications and admin controls does Otter have?

Security certifications · Pro

Checked

SOC 2 Type 2 report; follows HIPAA requirements; no ISO certificate is claimed

Source: otter.aiSections 'SOC 2 TYPE 2' and 'HIPAA'Checked on

Security certifications · Business

Checked

SOC 2 Type 2 report; follows HIPAA requirements. Security policies are based on the ISO 27001/2 framework, but no ISO certificate is claimed

Source: otter.aiSections 'SOC 2 TYPE 2', 'HIPAA' and the frameworks FAQChecked on

The vendor doesn't say: switch-off, EU hosting, admin controls, price.

Alternatives

Otter alternatives that don't train on your data

Other meetings and notes tools whose business plan doesn't train on your data and includes a DPA.

The five marks, in order: No AI training · EU hosting · DPA · Sub-processors listed · DPF or EU vendor. ✓ meets it, ✕ doesn't, – partly, ? not stated.

Tool · PlanVerdictYour five rules
  • jamie

    Team · €33 / user / mo

    Doesn't train on your dataData in the EU by default · DPA on request

    ✓✓✓✓✓

  • Leexi

    Business · €39 / user / mo

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓✓✓

  • Noota

    Business · $39 / mo

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓✓✓

  • tl;dv

    Business (+1) · €29 / user / mo

    Doesn't train on your dataData in the EU by default · DPA in the terms

    ✓✓✓✓✓

  • Trint

    Advanced · See details

    Doesn't train on your dataEU hosting available · DPA on request

    ✓✓✓✓✓

If no plan gives you the training default or data location you need, the tool may not be the right fit. We design and build what your team is missing around your own rules, and keep it running after launch.

See what we build

Need something your tools can't do?

We design and build what your team is missing, around the way you already work and the data rules you set.

Book a callServices