Your attorney just wrapped up a confidential call with a client in Bradenton. Ten minutes later, a neat little summary of everything they discussed — names, case details, legal strategy — landed in the cloud on someone else’s server. Nobody hit “record.” The AI note-taker did it automatically.
If that makes your stomach drop, good. It should.
AI meeting note-takers have quietly become one of the biggest privacy blind spots in small businesses across Tampa Bay. Your staff may already be using one — and you might not even know it.
How These Tools Sneak Into Your Meetings
An AI note-taker is software that joins your Teams, Zoom, or Google Meet call. It records the audio, turns it into a written transcript, and spits out a tidy summary with action items.
Sounds helpful, right? It is — until you realize what happens next.
Some of these tools connect to your calendar and auto-join every meeting. Client calls. Internal HR conversations. Strategy sessions. All of it gets captured without anyone clicking a button.
Your Words Are on Someone Else’s Server Right Now
Here’s where it gets uncomfortable. Not all AI note-takers handle your data the same way.
Some tools, like Microsoft 365 Copilot in Teams, keep everything inside your own Microsoft environment. Your data stays in your control, and Microsoft states it doesn’t use your data to train its AI models.
Others? Not so much.
Otter.ai, for example, stores recordings on its own servers. Otter was hit with a class-action lawsuit in 2025 alleging it secretly recorded conversations and used that data for AI training. Their policies around data use have drawn serious scrutiny.
Fireflies.ai stores data on its servers and processes it through third-party AI services. Your meeting content passes through external systems during processing.
Fathom says it doesn’t use meeting data for model training and offers SOC 2 compliance. But it’s still a third-party tool holding your recordings.
The point is: where your data goes depends entirely on which tool someone on your team downloaded last Tuesday.
Florida Law Says Everyone Has to Know
Here’s something every law firm and accounting firm in Manatee County needs to hear.
Florida is an all-party consent state. Under Florida Statute § 934.03, everyone on a call must know they’re being recorded and agree to it. If an AI note-taker auto-joins a meeting and nobody announces it’s recording, that’s a legal problem — not a technicality.
And beyond the law? A client who finds out they were secretly recorded isn’t going to care about your note-taker’s features. They’re going to care that you broke their trust.
Why This Keeps Attorneys and CPAs Up at Night
If you’re a law firm or attorney in Tampa Bay, an AI note-taker recording a client call could compromise attorney-client privilege. Courts have already signaled that sending privileged information through third-party AI tools may waive that protection. Once it’s on someone else’s server, you may no longer be able to claim it was confidential.
If you’re a CPA or financial advisor, client financial data captured in a meeting recording may trigger obligations under the FTC Safeguards Rule. Wealth management firms face similar scrutiny from SEC regulations.
For dental practices and healthcare providers, recorded conversations about patients could create HIPAA exposure.
Same question for all of you: is this tool handling sensitive data in a way that meets your obligations?
Six Questions to Ask Before It’s Too Late
- Where is the data stored? Inside your own environment (like Microsoft 365), or on the vendor’s servers?
- Does the vendor use your data to train their AI? Read the fine print — not the marketing page.
- Can you delete recordings and transcripts? If you can’t control it, you don’t own it.
- Does the tool auto-join meetings? Can you control which ones it joins?
- Who in your organization can access the recordings? Think about what’s in those transcripts.
- Are participants notified they’re being recorded? In Florida, this isn’t optional.
What Your Next Ten Minutes Should Look Like
Walk down the hall (or open Slack) and ask your team one question: “Is anyone using an AI note-taker?”
If the answer is yes, find out which one. Find out where the recordings go. And find out if clients on those calls knew they were being recorded.
You might not love the answers. But you’ll be glad you asked before a client — or a regulator — asks first.
Book a free 15-minute risk assessment with Justin and Sara at Reef Cyber Security. We help accounting firms, law firms, and financial advisors in Bradenton and Tampa Bay figure out which tools are safe — and which ones are quietly putting your practice at risk. Learn more about our security consulting.
