.avif)
SOC 2 Type II · HIPAA · GDPR · EU & US hosting · No AI training
See MeetGeek on Your Own Meetings
Book a 20-minute demo and bring your security questions. We'll walk your team through the setup, the documents and the controls.
Security
Security at MeetGeek
MeetGeek is audited every year against SOC 2 Type II and supports GDPR, CCPA and HIPAA, with a Business Associate Agreement for healthcare teams. Your meetings are stored in the EU or the US and encrypted in transit and at rest. They are not used to train AI models.
Security at a Glance
- Audit
- SOC 2 Type II, audited every year
- Deletion
- Deleted after 7 days, backups kept up to 30 days
- Data region
- EU or US, backups in the same region
- Encryption
- TLS 1.2+ in transit, AES-256 at rest
- AI training
- Never. Your meetings are not used to train AI
- Login
- SSO and SCIM on Enterprise
- Healthcare
- HIPAA BAA on all plans
- Breach notice
- Within 72 hours at the latest
SOC 2 Type II
Audited every year by an independent auditor for security, privacy and confidentiality.
ISO 9001
Certified to ISO 9001, the international standard for quality management.
HIPAA (with BAA)
Business Associate Agreement available on all plans.
GDPR
On the EU instance, meetings are stored in the EU, under a DPA with Standard Contractual Clauses.
CCPA
We don't sell or share personal information. California residents can access, correct and delete their data.
Trusted by 50,000+ teams across 100+ countries
Data residency
Where Your Meeting Data Is Stored
Each MeetGeek workspace runs in one region: the EU or the US. Your meeting content (recordings, transcripts and summaries) and its encrypted backups are stored in that region. Choose EU or US when you sign up or during onboarding.
EU instance
Hosted on AWS in the European Union. Your contract is with our EU company, AIVISION PRODUCTS SRL.
Recordings, transcripts and summaries stored in the EU
Backups encrypted and kept in the EU
US instance
Hosted on AWS in the United States. Your contract is with MeetGeek US Infra, Inc.
Recordings, transcripts and summaries stored in the US
AI processing in the US
Backups encrypted and kept in the US
Provider | What it does | Where |
|---|---|---|
| AWS | What it does Cloud hosting and storage | Where Your region (EU or US) |
| OpenAI | What it does AI summaries, insights and chat. No training, zero data retention | Where Your region (EU or US) |
| Mixpanel | What it does Product analytics (no meeting data processed) | Where EU |
| Intercom | What it does Support tickets you send us | Where US |
See the current list on our subprocessor page. If you subscribe to updates, we tell you at least 30 days before adding a new one.
Protection
How We Protect Your Data
The same controls apply to every plan, from Basic to Enterprise.
Encryption
TLS 1.2 or higher in transit. AES-256 at rest, with keys managed in AWS Key Management Service. TLS setup graded A+ by Qualys SSL Labs and CryptCheck.
Isolated infrastructure
A private network of microservices on AWS. Production is separate from development and testing. Each organization's data is logically separated, with access checks on every request.
Least-privilege access
Our team accesses production data only when needed, with multi-factor authentication. Every access is logged.
Secure development
We follow OWASP ASVS, an industry checklist for secure web apps. Every code change is checked automatically for security flaws (SonarQube) and we scan the live app regularly (OWASP ZAP).
Independent penetration tests
A third party tests MeetGeek at least once a year. The latest report is in the Security Portal.
Backups and recovery
Encrypted backups in your region and a written recovery plan. If our infrastructure goes down, we aim to restore service within 4 hours.
GDPR checklist
Before You Roll Out MeetGeek Under GDPR
The checks a data protection officer usually runs before a company records meetings with AI. Each one comes with how MeetGeek covers it.
Tell people their meeting is recorded
With the AI Meeting Agent, MeetGeek announces itself when it joins and lets participants leave. You can also email participants before the meeting, and on Business and Enterprise ask for their consent. When you record without a bot, your team tells the participants. Your company still decides the legal basis and updates its own privacy notice.
Sign a Data Processing Addendum
Our DPA includes the EU Standard Contractual Clauses, the UK Addendum and Swiss terms.
Choose where data is stored
Pick the EU instance. Meeting content and backups are stored in the EU, under a contract with our EU company.
Review the subprocessors
See the current list on our subprocessor page.
Run a DPIA if you need one
Many companies run a data protection impact assessment before recording meetings. Our DPA, subprocessor list and SOC 2 report answer most of what it asks.
Set retention and deletion
Choose how long meetings are kept. Deleted data is permanently removed after 7 days and backups are kept for up to 30 days.
Plan for access and deletion requests
People can ask for their data at privacy@meetgeek.ai. Admins and users can delete recordings themselves.
Agree how incidents are reported
We notify you within 72 hours at the latest if a breach affects personal data.
Plans
Security Features by Plan
Encryption, hosting and the no-training rule are the same on every plan. Higher plans give admins more control.
Feature | Basic | Pro | Business | Enterprise |
|---|---|---|---|---|
Encryption, EU or US hosting, no AI training | Included | Included | Included | Included |
Transcripts kept | 3 months | 1 year | Unlimited | Custom |
Audio kept | 1 month | 6 months | 12 months | Custom |
After you delete | Every plan: deleted after 7 days, backups kept up to 30 days | |||
Admin user management | Not included | Included | Included | Included |
Admins can make all meetings private by default | Not included | Not included | Included | Included |
Recording consent notifications | Not included | Not included | Included | Included |
Single sign-on (SSO) | Not included | Not included | Not included | Included |
Automatic user setup and removal (SCIM) | Not included | Not included | Not included | Included |
Organization-wide settings and locks | Not included | Not included | Not included | Included |
HIPAA BAA: available on all plans. Prices and full plan details on the pricing page.
We Don't Train AI on Your Meetings
Your recordings, transcripts and summaries are never used to train AI models, ours or anyone else's. Read our Data Processing Addendum for how we process your data.
Our AI provider works under zero data retention and no training
We build and test MeetGeek with dummy, de-identified data
HIPAA and the Business Associate Agreement
MeetGeek signs a Business Associate Agreement (BAA) with healthcare organizations that record protected health information, on all plans. Send a request and our team confirms the setup for your use case.
Encryption, access controls and audit logs for health data
Retention you control, with custom periods on Enterprise
Data kept in the US or the EU
Response
Incidents, Uptime and Vulnerability Reports
What happens if something goes wrong and how to reach us.
Breach notification within 72 hours
If a security incident affects your personal data, we tell you within 72 hours at the latest, as our DPA requires.
Live status page
Uptime and incident history for the web app, the meeting assistant and the API on meetgeek.instatus.com.
Report a vulnerability
Write to security@meetgeek.ai. We reply as soon as possible, investigate every report and fix confirmed issues.
Governance
Security and Governance Behind the Badges
The practices our auditors check every year.
Employee security training
Everyone at MeetGeek completes security and data-handling training when they join and on an ongoing basis.
Documented policies
Access control, data classification, data sanitization, backup, asset management and anti-malware policies, available on request.
Business continuity planning
A documented business continuity and disaster recovery policy covers recovery if our infrastructure is disrupted.
Documents for Your Security Review
Everything your IT or legal team usually asks for. This page is a summary: the DPA and our privacy policy are the binding documents.
Security FAQ
The questions IT and procurement teams ask us most.
Is MeetGeek SOC 2 compliant?
Is MeetGeek ISO 27001 certified?
Is MeetGeek HIPAA compliant?
Does MeetGeek support SSO and SCIM?
Where is my meeting data stored?
Is my data used to train AI models?
Can MeetGeek employees see my recordings?
How do I get the DPA, SOC 2 report and security questionnaire answers?
Is MeetGeek GDPR compliant?
