The same checks apply: storage location, training, consent and retention.

Can Fireflies record in-person meetings?

It offers mobile recording; tell everyone in the room.

Can I keep Fireflies data in the UK?

Not from what Fireflies publishes. Enterprise private storage can keep data in the EU, but processing still happens in the US.

Does Fireflies send my meetings to OpenAI?

Fireflies says it uses AI providers under agreements that stop them storing or training on your data.

Home › Answers › Data, privacy and GDPR

Is Fireflies AI GDPR compliant and safe?

Last checked: 18 October 2026 · The AI Till, UK

Short answer

Fireflies says it's GDPR compliant, doesn't use your meeting data for AI training, and supports UK data transfers. By default, your recordings and transcripts are stored and processed in the United States; EU storage is an Enterprise option, with processing still in the US. Lawful use is down to you: tell attendees and set retention.

Key facts (18 October 2026)

Question	Fireflies' answer
Where is data stored?	US cloud (AWS and Google Cloud) by default
EU storage?	Enterprise private storage; processing stays in the US
Used for AI training?	Fireflies says no
Who owns the data?	You do, per its terms
What's collected?	Audio, video, transcripts, summaries, attendee names and emails
Security	AES-256 encryption at rest, TLS 1.2 in transit
Certifications	SOC 2 Type 2 and ISO/IEC 42001, per Fireflies

How UK transfers work

Because data goes to the US, a UK business needs a lawful basis for that transfer. Fireflies' data processing addendum (DPA) says it is self-certified under the EU-US Data Privacy Framework, including the UK extension. If that ever stops applying, the DPA falls back to the standard contractual clauses with the UK's international data transfer addendum.

Other points from the DPA (last updated 6 March 2026):

Fireflies acts as your processor; you're the controller.
The DPA is part of Fireflies' terms, and Fireflies also offers a version you can sign online.
It will notify you of new subprocessors, and you have 30 days to object.
At the end of the contract, it deletes or returns your data as you instruct.
It may create de-identified data to improve its products.

Using it lawfully in the UK

Tell everyone in the meeting that it's being recorded and transcribed.
Name meeting transcription in your privacy notice.
Sign Fireflies' data processing agreement (it offers this online; the DPA is also part of its terms) and keep a copy with your records.
Set retention and delete old recordings.
Don't record sensitive meetings, such as HR or health discussions, without a DPIA.

Is it safe?

It's a mainstream tool with security controls, but any bot that joins every meeting from your calendar can capture things you didn't intend. Turn off auto-join and choose meetings manually.

To do that, Fireflies' guide says to go to Settings, then Recording & Privacy, and turn off "Auto-record meetings". Or set "Auto-join calendar meetings" to "Only when I invite fred@fireflies.ai". Meeting rules you've set up may still apply, so check those too.

Worked example: client calls at an accountancy practice

Say you run a three-person bookkeeping practice in Exeter and want Fireflies to take notes on client calls.

Turn off auto-join so it only joins calls you choose.
Add a line to your meeting invite: "We use an AI note-taker for this call. Tell us if you'd prefer we didn't."
Say it again at the start of the call, and switch it off if the client objects.
Skip sensitive calls. A client discussing a health issue or a dispute with staff is a call to take notes by hand.
Set a deletion routine. For example, delete recordings once the summary is filed in the client record.

This is a hypothetical approach. Your retention period should match your own privacy notice.

Common mistakes

Leaving auto-join on. The bot can turn up in calls you forgot about.
Not telling external guests. They're the people most likely to object.
Keeping every recording forever.
Assuming "GDPR compliant" means your use is compliant. It covers Fireflies' side, not yours.

Alternatives

See is Otter AI GDPR compliant? and is it legal to record calls with AI?

Sources

Checked 18 October 2026. Rules and prices change, so check the source before you rely on it. This is general information, not legal, tax or financial advice.

More on data, privacy and gdpr

All data, privacy and gdpr answers · All answers · Guides · AI tools directory

Get one useful AI tool in your inbox each weekday

Free, plain English, five minutes to read. Unsubscribe any time.

See our privacy notice.