Fireflies AI

Fireflies AI is SOC 2 Type II compliant. On SOC2C this listing is Listed.

According to Fireflies AI's public trust center, Fireflies AI is GDPR compliant. On SOC2C this listing is Listed.

According to Fireflies AI's public trust center, Fireflies AI is HIPAA compliant. On SOC2C this listing is Listed.

Fireflies AI is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Yes. Fireflies AI's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

At Fireflies.ai, you retain complete ownership of your data. While your information is securely stored in the cloud, you have full control over it. At your authenticated request, we can immediately purge and permanently delete your data from our systems. In alignment with our terms of service, you remain the sole owner of your content, ensuring your rights and privacy are fully protected.

At Fireflies.ai, we provide flexible and secure data management options tailored to your organization’s needs, ensuring the highest levels of security, compliance, and performance: Default Data Management By default, your data is securely stored and processed in our US-based cloud infrastructure, designed for reliability and adherence to industry standards: - Servers: Hosted on the Google Cloud Platform (GCP), known for its robust security features and scalability. - Database: Managed within a Virtual Private Cloud (VPC) on AWS, offering enhanced isolation and data protection. This setup ensures that your data is protected and optimized for performance throughout the storage and processing lifecycle. Flexible Storage Options 1. Fireflies Managed Storage: - Infrastructure: Data is stored on a dedicated cloud storage solution managed by Fireflies, providing secure and seamless access. - Data Locality: - Processing: All data processing occurs within the United States. - Storage: Data is stored in your preferred geographic location, ensuring compliance with regional data residency requirements. 2. Bring Your Own Storage (BYOS): - Infrastructure: You have the option to store your data in your own AWS or GCP storage bucket, giving you full control over your storage environment. - Data Locality: - Processing: All data processing is conducted within the United States. - Storage: Data resides in your chosen storage location, as configured in your AWS or GCP infrastructure. This flexibility allows organizations to customize their data management to align with specific compliance, security, and operational requirements, providing you with complete confidence and peace of mind.

No. We follow the principle of least privilege, strictly granting access to sensitive data on a need-to-know basis, with monitoring and auditing. If greater access is needed, for example, during a support request, you must first grant permission. Yes. You can delete the data from the user dashboard or by contacting the support team. Once deleted, it is impossible to recover the meeting data.

No. We don’t use your data for training purposes. No, Fireflies does not share your data with third parties.We prioritize your privacy and have signed a Business Associate Agreement (BAA) with OpenAI and other third-party ASR (Automatic Speech Recognition) vendors. The BAA enforces: - Zero Data Retention Policy: Vendors cannot store or retain your data. - Restricted Access: Vendors are prohibited from accessing or using your data for any purpose beyond the agreed services. - No Training on Your Data: Your data will not be used to train AI models.

No. Fireflies does not create, store, or process voiceprints or biometric identifiers. Fireflies uses a vendor for transcription & speaker diarization, which returns generic speaker labels “Speaker 1”, “Speaker 2", etc. Vendor has a zero data retention policy and does not train on voice data. When available, Fireflies labels speakers using conference metadata.