Meeting transcription tools process some of the most sensitive data in your organisation. Client strategies, medical histories, financial forecasts, and legal advice all pass through these systems. Yet most users never ask the one question that matters: where does my audio go?
This guide is for lawyers, consultants, healthcare professionals, and anyone else with confidentiality obligations. We break down the privacy architecture of every major transcription tool in plain English — no marketing speak, no hand-waving about "enterprise security."
Why privacy matters for meeting transcription
Most professionals treat meeting transcription as a productivity tool, not a data governance decision. That's a mistake. Here's why:
- Solicitor-client privilege: In UK law, privileged communications lose their protection if disclosed to third parties. Uploading a client call to Otter's AWS servers may constitute disclosure.
- GDPR Article 9: Processing of data concerning health, sex life, or political opinions requires explicit consent or a legal basis. If your meeting transcript contains medical information, cloud transcription may violate this.
- HIPAA (US): Healthcare providers in the US need Business Associate Agreements (BAAs) with any vendor processing protected health information. Most transcription tools won't sign one.
- NDA obligations: Many client NDAs prohibit sharing confidential information with subprocessors. Cloud transcription services use subprocessors (AWS, Google Cloud, OpenAI) that may violate these terms.
"We had a barrister client terminate a retainer because we used Otter for case conferences. The chambers' data policy explicitly prohibited cloud audio storage. We didn't even know we were violating it."
What "local-first" actually means
Marketing teams have co-opted the term "local" to mean almost anything. Let's be precise:
- True local-first: Audio is captured on-device, transcribed on-device, and stored on-device. No network connection is required. No data leaves your machine unless you explicitly choose to export it. (Clearminutes, Whisper.cpp)
- Local capture, optional cloud: Audio is captured and transcribed locally, but the tool offers encrypted cloud sync for multi-device access. You can disable this. (Jamie, Granola)
- Local noise processing, cloud transcription: Some audio processing happens locally, but the actual speech-to-text conversion sends data to servers. (Krisp)
- Cloud-only: Audio is uploaded to remote servers for processing and storage. This is the default for most tools. (Otter, Fireflies, Fathom, tl;dv)
The distinction between "local capture" and "true local-first" matters. A tool that records locally but uploads for transcription is not a privacy solution. The audio still leaves your device.
Privacy comparison by tool
| Tool | Audio capture | Transcription | Storage | Subprocessors | Can work offline |
|---|---|---|---|---|---|
| Clearminutes | Local | Local (Whisper) | Local SQLite | None | Yes |
| Jamie | Local | Local | Local + optional cloud | Cloud sync only | Yes (sync disabled) |
| Granola | Local | Local | Local + encrypted cloud | Cloud sync only | Yes (sync disabled) |
| Whisper.cpp | Local (DIY) | Local | Your disk | None | Yes |
| Krisp | Local | Cloud | Cloud | AWS, Google Cloud | No |
| Otter.ai | Cloud | Cloud | Cloud | AWS, Google Cloud, OpenAI | No |
| Fireflies | Cloud | Cloud | Cloud | AWS, Google Cloud | No |
| Fathom | Cloud | Cloud | Cloud | AWS | No |
Legal compliance breakdown
GDPR (UK/EU)
Under GDPR, meeting transcripts are likely "personal data" and may be "special category data" if they contain health, political, or biometric information. Key requirements:
- Lawful basis: You need a lawful basis for processing (usually legitimate interest or consent). Cloud transcription tools process data as a controller or processor, complicating this.
- Data transfers: Transferring data to US servers (where most transcription tools host) requires Standard Contractual Clauses or adequacy decisions post-Schrems II. Many tools don't document this properly.
- Retention: Data cannot be kept indefinitely. Tools that store transcripts forever without auto-deletion may violate Article 5(1)(e).
Local-first tools solve this by default: No data transfer, no retention policy conflict, no subprocessor disclosure required.
HIPAA (US healthcare)
HIPAA requires Business Associate Agreements with any vendor processing PHI. As of April 2026:
- No major transcription tool offers a BAA on standard plans. Some offer BAAs on enterprise plans at significant cost.
- Local-first tools sidestep HIPAA entirely because no vendor processes your data. You become the sole custodian.
Solicitor-client privilege (UK/Commonwealth)
Privilege is lost when confidential communications are disclosed to third parties. Cloud transcription services are third parties. While privilege may survive if the third party acts as an agent, this is untested in court for automated transcription services. The safer path: don't disclose to third parties at all.
Recommendations by profession
Lawyers and legal professionals
Use Clearminutes or Whisper.cpp. True local processing means no third-party disclosure. If you need multi-device access, export transcripts manually or use an encrypted sync solution you control (Syncthing, encrypted USB).
Healthcare professionals
Use Clearminutes on a dedicated device. The local SQLite database keeps PHI on hardware you control. For US practitioners, this avoids HIPAA BAA requirements entirely.
Consultants and agencies
Use Clearminutes or Jamie with cloud sync disabled. Client NDAs typically prohibit sharing with subprocessors — both tools avoid this when used locally.
Financial services
Use Clearminutes. FCA guidelines on outsourcing require firms to maintain control of critical data. Local processing satisfies this; cloud transcription requires due diligence documentation.
Journalists and researchers
Use Whisper.cpp for maximum control, or Clearminutes for a polished interface. Source protection is paramount — cloud transcription creates discoverable records.
"The question isn't whether your transcription tool is secure. The question is whether you can prove to a regulator, a client, or a court that no third party ever had access. With local-first tools, that proof is trivial."
Read our Otter.ai alternatives guide for more privacy-focused options, or see the local vs cloud AI comparison for the technical breakdown.