Fireflies.ai is a popular meeting AI with a more privacy-forward posture than several competitors. The company publishes a SOC 2 Type 2 report, lists itself in the EU-US Data Privacy Framework, advertises a Zero Data Retention policy with third parties, and offers a Private Storage option for enterprise customers who want their data in EU infrastructure.

That sounds good. For some teams, it is good. For others, the line is finer than the marketing suggests, and the procurement review will find the line.

This article is the procurement review, written for the buyer.

What Fireflies actually offers

Fireflies' security and data documentation lays out a thoughtful posture. The four claims that come up most often:

SOC 2 Type 2, annual third-party audit of security controls.
GDPR alignment, DPA available, listed in EU-US DPF.
Zero Data Retention with third parties, third-party processors do not retain user content after delivering the service.
Private Storage, enterprise option to store user content in EU infrastructure.

These are real commitments. They put Fireflies ahead of vendors who do none of them.

Where the fine print lives

The line for privacy-first teams is in the architecture, not the policy. Two specifics matter:

Default storage is US

Without Private Storage, your audio and transcripts live in US data centers. That is the default for every plan below the enterprise tier. For an EU team running a thirty-person POC, the default applies.

Storage and processing are separate questions

This is the one that catches people. Even with Private Storage enabled (storage in EU infrastructure), Fireflies' processing remains in the United States. The audio leaves the EU to be summarized, then the artifact returns to EU storage.

For data minimization purposes (GDPR Article 5(1)(c)) the storage location matters. For international transfer purposes (Articles 44–50) the processing location matters too, because the audio is in flight to the US for the duration of inference.

The distinction is not academic. Procurement will ask. The answer determines whether you are inside or outside the DPF, and whether your records of processing need a transfer entry per session.

A privacy-first vendor for an EU team is one where storage and processing are both in the EU, by default, on every tier. Anything else is a procurement question worth asking, not a marketing claim worth trusting.

The fact pattern

Criterion	Fireflies (default)	Fireflies (Private Storage, enterprise)	EU-default vendor
Storage region	US	EU	EU
Processing region	US	US	EU
Encryption	AES-256, in transit and at rest	AES-256	AES-256
SOC 2	Type 2	Type 2	Varies
GDPR DPA	Available	Available	Available
Trains on user data	Zero Data Retention claim with third parties	Zero Data Retention claim	None
Default retention	Until user deletes	Until user deletes	Hours, not days
EU-US DPF dependency	Yes	Partial (processing remains US)	None

Read the rows, not the column headers. The right column is what an EU-default architecture looks like; that is the architecture EnClair ships on every plan, including the free tier.

Three buyer questions Fireflies handles well

To be fair: Fireflies has good answers to questions other vendors stumble on.

"Do you sell my data?" No.
"Do third parties retain my content after processing?" Per Fireflies' Zero Data Retention claim, no.
"Is the DPA real and signable in a normal procurement timeline?" Yes.

For US teams or for teams that have already accepted the DPF dependency, this is enough. The shortlist conversation is short.

Three buyer questions where it gets harder

"Does my audio stay in the EU during processing?" Without Private Storage, no. With Private Storage, processing is still US. The answer is "no" or "storage yes, processing no", neither of which is "yes".
"What is my default retention without manual deletion?" Indefinite, until the user deletes. For data minimization, that is a customer-side burden.
"Is EU residency available to my team on its current plan?" Private Storage is enterprise-tier. POCs and mid-market plans do not have it.

For privacy-first EU teams, the answer to "is Fireflies enough" depends on which set of questions is the deal-breaker.

What to evaluate next

If Fireflies' trade-offs sit on the wrong side of your line, the alternative shortlist for EU teams typically includes EU-native vendors that offer storage and processing in EU infrastructure on every plan. The short list is shorter than the broader market list; that is the point of evaluating along the right axes.

For a structured comparison covering Fireflies, Otter, and EU-default options including EnClair, see the GDPR-compliant meeting summarization article.

A note on retention

EnClair stores audio and summaries for 24 hours, then deletes both. Storage and processing are both in Europe, on every plan, from the free tier up. We do not train models on user inputs or outputs. The full posture is on the security page.

What to take from this

Fireflies is a thoughtful privacy posture inside a US-first architecture. For some teams, that is enough. For privacy-first EU teams, the line is whether processing happens in the EU, on every plan, by default. Read the architecture, not the marketing. The procurement conversation goes faster when you do.