Is Your AI Notetaker SOC 2 Compliant, and What Should You Ask For?
Most AI notetakers say they are SOC 2 compliant. The badge tells you an auditor looked at something. Whether it covers the outside services that hear your meetings is in a section of the report most buyers never open. Here is how to read it, what to ask the vendor for, and where Driffle stands.
The short answer
Most of the well known AI notetakers can show you a SOC 2 Type 2 report. Granola's security page says it reached Type 2 in July 2025. Fireflies lists SOC 2 Type II on its security page. So asking "are you SOC 2 compliant?" rarely separates one tool from another.
The useful question is narrower: does the report cover every company that receives your meeting audio and transcripts? For an AI notetaker the answer is often no, and the report itself tells you so, in a section most buyers skip.
What the badge actually means
SOC 2 is not a certificate. It is a report written by an independent CPA firm after examining a company's controls. A Type 1 report looks at whether the controls are designed properly at a single point in time. A Type 2 report checks whether they actually worked over a period, typically three to twelve months, according to the audit firm A-LIGN.
When a vendor page says "certified for SOC 2", read it as "we have a report". The report is what your security team needs, usually shared under NDA, and the details that matter are inside it.
Follow your audio, not the logo
An AI notetaker is rarely one company. Your meeting audio leaves your laptop, goes to the notetaker's cloud, then usually to a speech to text provider, and the transcript then goes to one or more AI model providers for the summary. Granola's security page is unusually direct about this: it names Deepgram and Assembly for transcription and OpenAI and Anthropic for summaries.
That is normal. Almost nobody trains their own speech and language models. But it means the most sensitive thing you own, the full content of your calls, passes through companies other than the one whose report you are reading.
The section to find: subservice organizations
Auditors call those outside providers subservice organizations, and there are two ways to handle them in a SOC 2 report. Under the inclusive method, the auditor tests the provider's controls too. Under the carve out method, they are left out of the auditor's testing. The audit firm Schellman says most of its clients choose the carve out method.
Either way, the report has to disclose that the providers exist. So open the system description, find the list of subservice organizations, and check two things. Are the speech and AI model providers named at all? And are they carved out? If they are carved out, the report tells you the notetaker says it monitors them. It does not tell you an auditor tested how they handle your audio. Compass IT Compliance points out that in that case it falls to you to get assurance some other way, usually the provider's own report or its retention terms.
Two more parts of the report are worth ten minutes. The exceptions, where the auditor lists controls that failed during the period. And the complementary user entity controls, the things the report assumes you do on your side, such as removing people who leave. If you do not do them, the report covers less than you think.
Check the dates
A Type 2 report covers a window that has already ended. If that window closed months ago, ask for a bridge letter. Know what it is: Secureframe notes that a bridge letter is signed by the vendor's own management, not the auditor, and typically covers no more than three months. It is a promise, not a second audit. A report whose period ended more than a year ago, with no newer one, is a question to ask before you sign.
What to send the vendor
One short email does most of the work. Ask for the latest SOC 2 Type 2 report and its period end date. Ask for the list of every outside company that receives meeting audio, transcripts or notes, and what each one receives. Ask which of those are carved out of the report, and for their own reports or written retention and no training terms. Ask what the report expects you to do on your side. If you handle health data, ask whether they sign a BAA, because SOC 2 does not answer that question at all.
Where Driffle stands
Driffle does not have a SOC 2 report today. Its privacy page says so directly, and says that Driffle does not sign BAAs, so it should not be used for health information. If your security team requires a current Type 2 report before anyone records a call, that rules Driffle out for now, and it is better to know that on day one than after a trial.
Driffle's pipeline has the same shape as everyone else's: audio goes to an outside speech to text provider and transcripts go to AI model providers, and processing runs in the cloud, not on your Mac. The email above applies to Driffle exactly as it applies to any other vendor, so send it.
If your team does not need an audit report to start and you want meeting notes with no bot in the call, Driffle is available for Apple Silicon Macs at driffle.ai/download.
Sources
- Security, privacy, and how it all works. Read 1 November 2026. SOC 2 Type 2 achieved July 2025; transcription providers (Deepgram, Assembly) and AI providers (OpenAI, Anthropic) named.
- Security. Read 1 November 2026. Lists GDPR, SOC 2 Type II and HIPAA.
- What's the Difference Between SOC 2 Type I and Type II? Point in time versus a period, typically 3 to 12 months.
- Which SOC Method Should You Use? Carve-Out vs. Inclusive. Most clients choose carve out; subservice organizations must be disclosed either way.
- Subservice Organizations in SOC Reports: Carve-Out vs. Inclusive Method. Carved out controls are described but not tested; the user entity must obtain assurance by other means.
- What is a SOC 2 Bridge Letter? Signed by management, not the auditor; typically covers no more than three months.
- Privacy and security. Certifications: not yet certified against SOC 2, ISO 27001 or HIPAA; no BAAs.
FAQ
Is Granola SOC 2 compliant?
Granola's security page says it achieved SOC 2 Type 2 in July 2025 and points to its Trust page. The same page names Deepgram and Assembly for transcription and OpenAI and Anthropic for summaries, so ask Granola how those providers are treated in its report.
What is the difference between SOC 2 Type 1 and Type 2?
A Type 1 report checks that controls are designed properly at a single point in time. A Type 2 report checks that they operated effectively over a period, typically three to twelve months. Most security teams ask for Type 2.
Does a SOC 2 report cover the AI models a notetaker uses?
Only if the auditor used the inclusive method for those providers. Under the carve out method, which audit firms say most companies choose, outside providers are named but their controls are not tested. Check the subservice organizations section of the report.
Is a bridge letter as good as a new SOC 2 report?
No. A bridge letter is signed by the vendor's own management, not the auditor, and covers the gap since the last report period ended, typically up to three months. It is the vendor's statement that nothing material changed.
Does Driffle have a SOC 2 report?
No, not today. Driffle's privacy page states that it is not certified against SOC 2, ISO 27001 or HIPAA and does not sign BAAs, so it should not be used for health information.