Is Otter.ai ISO 27001 certified?

Unverified

Otter.ai, Inc. · Meetings & notetakers

Not verified. We could not confirm an ISO/IEC 27001 certification for Otter.ai.

What we checked

This assessment separates the consumer product from any business plan. It uses the vendor documents linked below; an unverified item is not a pass.

ISO/IEC 27001: Not verified; No public ISO/IEC 27001 certification was confirmed. Request evidence from Otter.ai, Inc. if this is a procurement requirement.
SOC 2: Confirmed; Otter.ai, Inc. also reports a SOC 2 attestation, which can complement but does not replace ISO scope evidence.
Default data training: Opt-out required; Otter uses a proprietary method to de-identify user data and trains its own models on it by default, with opt-out controls reportedly available in account data settings.
Business-tier training: Opt-out required; Otter de-identifies and trains on user data by default (third-party AI service providers do not train on it); enterprise customers act as data controllers and can configure controls.

Practical risk: Otter trains its own models on de-identified user content by default and its meeting assistant can auto-join calendar meetings, raising consent and surveillance concerns (it is the subject of a wiretap/consent class action).

How to make a decision

Check the precise account tier, written contract and intended data before approving Otter.ai. A security certification, DPA or setting can apply to only part of a vendor's service. Keep the source links with your supplier review and revisit them when the vendor changes its terms.

More on Otter.ai

Is Otter.ai HIPAA compliant?Is Otter.ai GDPR compliant?Is Otter.ai SOC 2 compliant?Does Otter.ai train on your data?

See the full Otter.ai risk profile, with every data-handling fact and its source, or browse all rated AI tools.