{ "schema_version": 1, "slug": "ai-meeting-recording-compliance", "title": "Meeting-AI vendor register — recording, retention, training carve-out, NYC Bar 2025-6 alignment", "description": "A maintained 9-vendor register of meeting-AI tools used by midsize law firms, with verified retention posture, training-data carve-out, consent-capture features, and alignment to NYC Bar Formal Opinion 2025-6 (Dec. 22, 2025). Updated quarterly. Each row traces to a citation in the per-page manifest.", "license": "CC-BY-4.0", "last_updated": "2026-05-04", "row_count": 9, "rows": [ { "vendor": "Otter.ai", "product": "Otter Business / Enterprise", "vendor_tier": "Mass-market", "trains_on_user_content_default": "Yes — trains proprietary AI on de-identified audio and on transcripts that may contain Personal Information", "training_carve_out_available": "Yes (enterprise) — enterprise customers are data controllers under separate enterprise agreement", "training_carve_out_tier": "Business / Enterprise", "enterprise_data_controller_model": "Yes — enterprise customer is data controller; Otter is processor", "default_retention_window": "Until deletion or workspace duration; admin-set custom retention; trash auto-deletes after 30 days", "admin_retention_override": "Yes — admin sets custom Workspace duration that auto-deletes", "zero_data_retention_option": "Not published as a named ZDR product feature", "consent_capture_feature": "In-meeting consent prompt + post-meeting summary (varies by integration)", "subprocessor_disclosure_published": "Partial — names AWS / Amplitude / AppsFlyer / Google in policy text but no dedicated subprocessor list", "audit_log": "Workspace audit history", "nyc_2025_6_alignment_posture": "Conditional — requires Business / Enterprise tier with admin-configured retention to align with NYC Bar 2025-6 storage / training / deletion review", "source_id": "S10", "last_verified": "2026-05-04", "change_history": "Initial publication" }, { "vendor": "Microsoft Copilot", "product": "Microsoft 365 Copilot (Teams + Copilot Chat)", "vendor_tier": "Enterprise", "trains_on_user_content_default": "No — prompts, responses, and Microsoft Graph data not used to train foundation LLMs", "training_carve_out_available": "N/A — no training default", "training_carve_out_tier": "All paid tiers", "enterprise_data_controller_model": "Yes — Microsoft is processor under Microsoft Product Terms / Data Protection Addendum", "default_retention_window": "Per organization Purview retention policy (no fixed default); discoverable via eDiscovery", "admin_retention_override": "Yes — Purview retention policy + Content Search", "zero_data_retention_option": "Customer-controlled via Purview retention; not branded as ZDR", "consent_capture_feature": "Recording / transcription on by tenant policy; Copilot prompt distinct from meeting recording", "subprocessor_disclosure_published": "Yes — published Microsoft Trust Center subprocessor list", "audit_log": "Unified audit log captures Copilot prompts and responses", "nyc_2025_6_alignment_posture": "Best-aligned for enterprise tenant deployment with Purview retention configured; eDiscovery exposure is the residual risk", "source_id": "S11", "last_verified": "2026-05-04", "change_history": "Initial publication" }, { "vendor": "Fireflies.ai", "product": "Fireflies.ai (Business / Enterprise)", "vendor_tier": "Mass-market", "trains_on_user_content_default": "No — does not use personal information for AI model training; vendors contractually prohibited", "training_carve_out_available": "Default — Zero Data Retention policy on meeting content for paid tiers", "training_carve_out_tier": "Business / Enterprise", "enterprise_data_controller_model": "Yes — processor under DPA for business customers", "default_retention_window": "Zero Data Retention for meeting content (audio / video / transcripts / summaries) by policy", "admin_retention_override": "Yes — Rules Engine for Enterprise", "zero_data_retention_option": "Yes — published ZDR for meeting content", "consent_capture_feature": "Auto-join + in-meeting notification", "subprocessor_disclosure_published": "Yes — published list at trust.fireflies.ai/subprocessors", "audit_log": "Admin Rules Engine activity log", "nyc_2025_6_alignment_posture": "Aligned in policy posture; vendor-supervision step still requires firm to verify ZDR is enabled per workspace", "source_id": "S12", "last_verified": "2026-05-04", "change_history": "Initial publication" }, { "vendor": "Granola", "product": "Granola (Standard / Enterprise)", "vendor_tier": "Mass-market", "trains_on_user_content_default": "Anonymized data only; opt-out available; Enterprise users default off", "training_carve_out_available": "Yes — opt-out by user; off by default for Enterprise", "training_carve_out_tier": "Standard (opt-out) / Enterprise (default off)", "enterprise_data_controller_model": "Indirect — no third-party model training; Granola itself trains on de-identified data unless opted out", "default_retention_window": "Recordings deleted after transcription is created; transcript retained", "admin_retention_override": "Limited; user can delete individual notes or request full data deletion", "zero_data_retention_option": "Recording-deletion-after-transcription is the closest analog to ZDR", "consent_capture_feature": "Visible-bot UI; user-controlled", "subprocessor_disclosure_published": "Limited — third-party LLM providers named but no full subprocessor list", "audit_log": "Yes — workspace activity", "nyc_2025_6_alignment_posture": "Conditional alignment for Enterprise default-off; Standard tier requires opt-out before NYC Bar 2025-6 deployment", "source_id": "S13", "last_verified": "2026-05-04", "change_history": "Initial publication" }, { "vendor": "Zoom AI Companion", "product": "Zoom AI Companion", "vendor_tier": "Enterprise", "trains_on_user_content_default": "No — does not use customer audio / video / chat / screen-sharing / attachments to train Zoom or third-party AI", "training_carve_out_available": "N/A — no training by default", "training_carve_out_tier": "All paid tiers", "enterprise_data_controller_model": "Yes — processor under Zoom DPA", "default_retention_window": "Default per Zoom retention; Meeting Summary Zero Data Retention available", "admin_retention_override": "Yes — Meeting Summary Zero Data Retention option", "zero_data_retention_option": "Yes — Meeting Summary ZDR", "consent_capture_feature": "In-meeting indicator + admin-configurable consent", "subprocessor_disclosure_published": "Yes — published Zoom Trust Center subprocessor list", "audit_log": "Admin audit log", "nyc_2025_6_alignment_posture": "Aligned for enterprise deployments with Meeting Summary ZDR enabled; default retention is the gating control", "source_id": "pending_direct_fetch", "last_verified": "2026-05-04", "change_history": "Initial publication; vendor docs verified via search summary, direct fetch blocked by SSO redirect" }, { "vendor": "Read.ai", "product": "Read.ai (Pro / Enterprise)", "vendor_tier": "Mass-market", "trains_on_user_content_default": "No by default — never uses meeting content for training unless user explicitly opts in", "training_carve_out_available": "Yes — opt-in only; default is no training", "training_carve_out_tier": "Pro / Enterprise", "enterprise_data_controller_model": "Yes — processor under DPA for paid tiers", "default_retention_window": "User-set retention; option to delete high-fidelity recordings or full transcripts after summary", "admin_retention_override": "Yes — admin-controlled retention defaults", "zero_data_retention_option": "Available — admin can require deletion of recording / transcript artifacts after summary", "consent_capture_feature": "In-meeting consent + bot disclosure", "subprocessor_disclosure_published": "Limited — AWS named; full subprocessor list pending", "audit_log": "Workspace audit", "nyc_2025_6_alignment_posture": "Aligned for default-off-training tier when retention defaults configured to delete after summary", "source_id": "pending_direct_fetch", "last_verified": "2026-05-04", "change_history": "Initial publication; vendor docs verified via search summary, direct fetch returned 404 / 403" }, { "vendor": "Google Meet", "product": "Google Meet (Workspace) take notes for me", "vendor_tier": "Enterprise", "trains_on_user_content_default": "No — Workspace data not used to train generative AI models without admin consent", "training_carve_out_available": "N/A — controlled by Workspace admin", "training_carve_out_tier": "Business / Enterprise", "enterprise_data_controller_model": "Yes — processor under Google Workspace DPA", "default_retention_window": "Per Workspace admin-configured retention (Drive / Vault)", "admin_retention_override": "Yes — Vault retention rules", "zero_data_retention_option": "Available — admin can delete Drive-stored transcripts on schedule", "consent_capture_feature": "Auto-disclosure banner when transcription enabled", "subprocessor_disclosure_published": "Yes — published Workspace subprocessor list", "audit_log": "Vault eDiscovery + admin audit", "nyc_2025_6_alignment_posture": "Aligned for Workspace deployments where Vault retention is configured", "source_id": "pending_direct_fetch", "last_verified": "2026-05-04", "change_history": "Initial publication; vendor docs verified via Google Workspace published documentation but direct re-fetch pending" }, { "vendor": "Harvey", "product": "Harvey (Practice Workspace / Vault)", "vendor_tier": "Legal-specific", "trains_on_user_content_default": "No — contractually prohibits model providers from training on customer data", "training_carve_out_available": "Default — Zero Data Retention agreements with model providers", "training_carve_out_tier": "All tiers", "enterprise_data_controller_model": "Yes — Harvey is processor; data logically isolated per customer", "default_retention_window": "Customer-configured; no published default", "admin_retention_override": "Yes — admin-configured retention", "zero_data_retention_option": "Yes — Harvey contractually prohibits model providers from training on customer data and only uses data for processing requests", "consent_capture_feature": "N/A — Harvey is a legal-AI workspace, not a meeting recorder; relevant where firms route meeting transcripts to Harvey for downstream summarization", "subprocessor_disclosure_published": "Yes — published list", "audit_log": "Workspace audit log", "nyc_2025_6_alignment_posture": "Aligned for meeting-content processing under firm-controlled retention; not a recorder itself", "source_id": "L0026", "last_verified": "2026-05-04", "change_history": "Initial publication" }, { "vendor": "Spellbook", "product": "Spellbook", "vendor_tier": "Legal-specific", "trains_on_user_content_default": "No — Zero Data Retention agreements with LLM providers", "training_carve_out_available": "Default — ZDR with LLM providers", "training_carve_out_tier": "All tiers", "enterprise_data_controller_model": "Yes — processor under Rally Innovations DPA", "default_retention_window": "Customer-configured; SOC 2 Type II / HIPAA / GDPR / EU AI Act compliant", "admin_retention_override": "Yes — admin-configured", "zero_data_retention_option": "Yes — ZDR with LLM providers", "consent_capture_feature": "N/A — Spellbook is a contract drafting tool, not a meeting recorder", "subprocessor_disclosure_published": "Yes — published", "audit_log": "Audit logging", "nyc_2025_6_alignment_posture": "Aligned for downstream contract-drafting from meeting transcript content; not a recorder itself", "source_id": "L0027", "last_verified": "2026-05-04", "change_history": "Initial publication" } ] }