The call
Buy Enterprise, at US$39 a seat billed annually, if you need auto-delete, recording modes, Private Storage, or HIPAA.
The no-training terms cover every plan, and that protection ends when MCP connectors send meetings to other AI tools.
By default the notetaker keeps audio, a transcript, and a summary of each meeting, stored in the US on AWS and GCP until someone deletes them. Fireflies states that meeting content never trains its own or its vendors' models and that vendors keep nothing after processing.
When you need this
- Security review asks where audio, transcripts, and summaries live, and for how long.
- Customer or candidate meetings must stay out of model training.
- A healthcare, education, or EU-regulated team is evaluating Fireflies.
Worked example: a clinic team's retention setup
Plan
HIPAA needs Enterprise with Private Storage and a signed business associate agreement, so the team buys Enterprise at US$39 a seat a month billed annually.
Recording mode
The admin enforces transcript and summary only, so no audio or video is kept.
Retention
Auto-delete is fixed for the workspace at a period between one week and one year; it applies only to meetings recorded after the change.
Evaluation criteria
What is kept
Which parts of a meeting are stored?
Look forChoose the recording mode your policy allows. The bot keeps audio and a transcript with its summary, plus video from Pro. Take Notes keeps only a transcript and summary. Enterprise admins can enforce transcript and summary only or summary only. They can also choose audio and summary only. Deleted audio and transcripts cannot be recovered.
How long
Who sets the retention period?
Look forSet Enterprise auto-delete between one week and one year. It follows the meeting owner's setting unless an admin fixes it for the workspace. The setting applies only to future meetings. Otherwise, Fireflies keeps meetings until deletion. It deletes account data within 30 days of account closure.
Model training
Does our meeting data train anyone's models?
Look forConfirm the no-training terms in the Privacy Policy and Terms. On every plan, Fireflies excludes meeting content and personal information from AI training and contractually bars vendor training. It retains permission to derive usage statistics and create de-identified aggregate data to improve the service.
Vendors and connectors
Which outside services see meeting content?
Look forReview the published subprocessor list. Transcription and model vendors, including OpenAI and Anthropic, process content under zero data retention. That protection stops when MCP connectors send meetings to ChatGPT, Claude, or other tools.
Residency and compliance
Does Fireflies meet our regulatory baseline?
Look forCheck Fireflies' SOC 2 Type II and FERPA support against your requirements. Its GDPR provisions include the EU-U.S. Data Privacy Framework and standard contractual clauses. HIPAA requires Enterprise with Private Storage and a signed business associate agreement (BAA), and removing any requirement disables HIPAA support. Private Storage keeps data in a region Fireflies manages or in your own AWS S3 or Google Cloud Storage bucket, with Azure unsupported. Processing stays in the US.
Voice data
How is speaker recognition handled?
Look forReview the voice-data policy against the Illinois suits. Fireflies permits service providers to extract voice characteristics to distinguish speakers, never to identify people. It says it does not receive that data and destroys it within three years of a person's last interaction. The first suit, filed in December 2025, was dropped in March 2026, and the consolidated Fricker case awaits a ruling on Fireflies' request to dismiss it.
Questions to ask vendors
- Can we see the current subprocessor list, and which subprocessors receive audio?
- Which recording mode will we enforce for customer and candidate meetings?
- How do we keep a meeting under legal hold when auto-delete is on? Fireflies' auto-delete, data storage, and Private Storage pages describe no legal-hold setting, so get the answer in writing.
- Which region or bucket will Private Storage use for our workspace?
Red flags
- Protected health information captured outside an Enterprise workspace with Private Storage and a signed BAA.
- An EU residency requirement that covers processing, which stays in the US even with Private Storage in the EU.
- Meeting data sent to an AI assistant through MCP on the assumption that zero data retention still applies.
- Auto-delete assumed to clear past meetings, when it applies only to meetings created afterward.
Products in this piece
Sources
- Official documentation
- 15
- Public source
- 5
- Fireflies pricing & plans
- Fireflies Knowledge Base: Recording modes for compliance
- Fireflies Knowledge Base: Learn about the auto-delete meeting feature
- Fireflies Knowledge Base: Learn about Private Storage
- Fireflies Knowledge Base: Learn about data storage and transfer
- Fireflies Knowledge Base: How Fireflies.ai keeps your information safe
- Fireflies Knowledge Base: Learn about how we encrypt your data
- Fireflies Knowledge Base: Set up HIPAA compliance for your workspace
- Fireflies Knowledge Base: Updates to our Privacy Policy, Terms of Service & DPA
- Fireflies Privacy Policy (updated September 28, 2026)
- Fireflies Terms of Service (updated September 28, 2026)
- Fireflies: Security
- Fireflies Knowledge Base: Fireflies MCP server
- Fireflies Knowledge Base: Does the desktop app save an audio recording?
- Cruz v. Fireflies.AI Corp., class action complaint, C.D. Ill. No. 3:25-cv-03399 (Dec 18, 2025)
- Top Class Actions: Fireflies.AI sued over alleged unlawful data collection from meeting participants (Mar 19, 2026)
- Hacker News comment on setting up Fireflies for a company under ISO audit (Mar 31, 2026)
- Morgan State University: AI Meeting Note-Taking Tools (Jun 10, 2026)
- Fireflies blog: Is Fireflies HIPAA Compliant? Private Storage and Security Explained (Sep 13, 2026)
- CourtListener: Fricker v. Fireflies.AI Corp., 1:26-cv-02675 (N.D. Ill.) docket (viewed Oct 25, 2026)