Otter Data, Retention & Training Checklist

Look forOtter keeps audio recordings, transcripts, summaries, action items, and virtual meeting screenshots on AWS S3 in the US West region, with AES-256 server-side encryption. Enterprise can remove audio from past and future conversations and keep the transcripts.

Look forOn Enterprise, ask your account manager to set retention of 24 hours or more, for whole conversations, audio and video, or transcripts. Turning it on deletes every existing conversation older than the limit at once. Those deletions skip Trash, and admins cannot see a list of what was deleted, so export what you need first. The deletion job runs daily and finishes within 48 hours. Deleting transcripts stops summaries from being regenerated. Without a policy, conversations stay until someone deletes them, and a deleted conversation sits in Trash for 30 days unless someone empties it.

Look forSelect Don't allow sharing under Help improve Otter. It removes Otter's access to past conversations and keeps future ones out of training. Until a user chooses, collaborators can opt shared conversations in. Otter's policy allows training on de-identified audio and transcripts, and its terms also allow aggregated or de-identified data for machine learning. Enterprise workspaces start opted out. AI Chat's outside providers do not train on user data. Otter's subprocessor list, effective March 31, 2026, names Anthropic for AI features and OpenAI for evaluating Otter's language models, and bars both from training on customer data. It also names Research Transcriptions, which annotates Otter's training and evaluation data.

Look forEnterprise customers can have their account manager turn off speaker learning if policy requires it. Otter learns voices from speaker tags and shares the profiles across the workspace. With learning off, Otter ignores existing enrollments, and only retention deletes them.

Look forRequest the Trust Center reports for SOC 2, HIPAA, GDPR, CCPA, VPAT, and TX-RAMP Level 2. HIPAA needs Enterprise and a signed business associate agreement (BAA). For healthcare use, follow Otter's guidance to control auto-join and turn off public link sharing. Otter stores data in the US. Every subprocessor on its list is in the US except Crescendo, whose support staff in the Philippines and Honduras see customer data only in support cases a customer opens.

Look forName an owner for deletion requests about your organization's recordings. Otter sends requests to the conversation owner. A European participant who sent Otter a GDPR deletion request reports that Otter pointed them to that owner.