Is Fathom AI safe? What it trains on, who it tells, and who can open your recordings

The Morse teamPublished October 31, 202610 min read

As of October 2026, Fathom AI is safe by the usual security measures, with a SOC 2 Type 2 report and a HIPAA business associate agreement, but it isn't private by default: Fathom keeps every recording until you delete it, trains its own AI on de-identified meeting data unless you opt out, and lists six outside AI companies that handle meeting content (Fathom Trust Center). The people you record get the least say. Whether they hear about the recording before it starts depends on your settings, your meeting platform, and which Fathom app you use.

We read Fathom's privacy policy (last updated August 16, 2026), its terms of service (March 4, 2026), its business associate agreement, its voiceprint notice, its trust center, its pricing page, 24 of its help center articles, and Superhuman's September 14, 2026 announcement that it had bought Fathom, all on October 31, 2026. Fathom deserves credit in two places. Its subprocessor list names each company that handles meeting content and marks which are "Forbidden from training AI on Fathom Customer Data," and its help center says a deleted recording "cannot be recovered."

Fathom privacy settings at a glance

Free, Premium, and Team plans unless noted, read October 31, 2026.

Does Fathom train AI on your meetings?

Yes, its own models, on de-identified data, unless you opt out. Fathom's privacy policy says it "may use and create de-identified data generated from Meeting Content Information" to train "our in-house artificial intelligence models" (Fathom privacy policy). The policy defines Meeting Content Information to include recordings, transcripts, and "names and emails of meeting attendees." Fathom's terms repeat the training clause and say you can opt out "within your Fathom account settings" (Fathom terms).

Fathom's security FAQ asks "Do you train AI models on customer data?", answers no, and then says "Fathom uses de-identified customer data to improve the accuracy of our proprietary AI models" (Fathom). The no refers to Anthropic, OpenAI, and Google, which Fathom says aren't "contractually permitted" to train on its users' data. We found no page where Fathom describes how it de-identifies a recording.

To opt out, open My Settings at fathom.video/customize, as Fathom's trust center directs (Fathom). On a Team plan, an admin can opt out every user in Organization Settings. The other people in your meeting have no setting of their own.

Which AI companies see your Fathom transcripts?

More than Fathom's FAQ names. The FAQ lists three AI subprocessors: Anthropic, OpenAI, and Google (Fathom). Fathom's trust center lists six "AI Provider" subprocessors that handle meeting content: Anthropic, OpenAI, ElevenLabs, Fireworks, Modal, and Voyage AI (Fathom Trust Center). The same list names Google Cloud Platform as the primary cloud provider holding recordings and transcripts, and Elastic as a search provider that handles meeting content.

Each of the six AI providers is marked "Forbidden from training AI on Fathom Customer Data." The list doesn't say how long any of them keeps what it receives. Fathom says customers who subscribe to trust center updates get notified when it adds, removes, or changes a subprocessor (Fathom Trust Center).

A Fathom user can also send meetings to a consumer chatbot. Fathom's MCP connector lets ChatGPT and Claude "ask questions about your meetings" across every call the user can view (Fathom). What happens to a meeting after that is up to the chatbot's own settings, which Fathom's guide doesn't cover. For how they compare, see which AI companies train on your data.

Does Fathom tell people they're being recorded?

It depends on which Fathom you use.

The bot. The default bot joins under the name "(NAME)'s Fathom Notetaker" (Fathom). Fathom's FAQ says the bot stays visible in the participant list and that Zoom notifies participants (Fathom). Premium users can rename the bot and remove the in-meeting banners (Fathom).

Consent emails. For bot meetings, Fathom sends one only when the meeting is external, the Fathom user hosts it, and "the number of guest attendees is exactly 1" (Fathom). The email goes out 24 hours ahead, and Fathom "does not send consent emails for same-day meetings." If a guest doesn't answer, "Fathom will still join and capture the call as normal." A guest who clicks no turns off auto-record for that call, and the host can still start recording by hand.

Bot-free capture. Fathom 3.0 can record without a bot, and as of October 30, 2026 it's available only on Macs running macOS 14.2 or newer (Fathom). Its upgrade guide says you "can enable" Recording Notice, which posts "Fathom is recording and taking notes, and you consent by continuing." in the meeting chat. With Recording Notice off, the guide says the consent prompts appear "directly in the app," asking you to confirm. Fathom's FAQ still says "participants are always notified" in the bot-free version (Fathom).

The iPhone app. It records in-person conversations from your phone's microphone, and "the recording starts immediately" (Fathom). Fathom's guide to the app describes no notice to the people in the room.

The legal duty is yours. Fathom's terms forbid using the service "if any participant on your call does not consent to be recorded" and make you promise you obtained "the required consent of every meeting participant" before the call begins (Fathom terms). Fathom's privacy policy notes that "some states or countries require all parties to consent," so say it out loud at the start (Fathom privacy policy). This isn't legal advice.

Who can open a Fathom recording link?

Anyone who has it, on the free plans. Fathom's sharing guide says the link sent to attendees on Free and Individual plans has "Anyone with the link can view" selected by default (Fathom). Attendees "can forward or share it with others," and anyone with the link can watch. To restrict a recording, choose Only people added can view, one recording at a time on those plans.

Auto-share reaches more people than were in the room. Fathom sends to everyone on the calendar invite, "even if they didn't attend the meeting" (Fathom). There's no unsend, though you can remove a person's access afterward. A share link carries the recording, the transcript, and attendees' questions, and the viewer needs no Fathom account (Fathom). We cover how links like these spread in AI chat share links.

At work, the company owns the recordings. Fathom's terms say content in a Team Account "belongs to your company" (Fathom terms). On Enterprise, an admin can turn on Let Admins Access Any Meeting, which lets account admins open meetings that are otherwise private; it's off by default (Fathom). Our guide to AI on a work laptop covers what else an employer can see.

How long does Fathom keep your recordings?

Until you delete them. Fathom's trust center says it will "retain your recordings and other data indefinitely unless you manually delete individual recordings or your account" (Fathom Trust Center). An account you stop using stays, with its data, until you delete it (Fathom privacy policy).

Deleting one recording also deletes its notes, and Fathom says it "cannot be recovered" (Fathom). Deleting your whole account is where Fathom's pages disagree:

• The trust center says backups are cleared "after an additional 7 days" (Fathom Trust Center).
• The privacy policy promises "commercially reasonable efforts" to delete within 30 days and says Fathom "cannot guarantee" it (Fathom privacy policy).
• The terms say copies "may persist in database backups for up to 30 days" (Fathom terms).

On a company account, the privacy policy says Fathom "will not be able to delete" your data at your request, so you ask your admin. Automatic deletion rules are Enterprise only and set by emailing help@fathom.video, according to the help center (Fathom). The trust center says the Pro plan of Team Edition supports them, and Fathom's pricing page lists "Custom data retention programs" only under Enterprise (Fathom pricing).

Is Fathom HIPAA compliant and SOC 2 certified?

Fathom says yes to both. Its help center says Fathom "is HIPAA, SOC2 Type II, and GDPR-compliant" (Fathom). Its terms make a business associate agreement part of the contract for anyone HIPAA applies to, and that agreement was last updated September 9, 2026 (Fathom BAA). Fathom offers a separately signed BAA through help@fathom.video (Fathom).

The SOC 2 Type 2 report itself is behind a Request access button on the trust center, beside a 2025 to 2026 bridge letter (Fathom Trust Center). Fathom says it doesn't hold ISO 27001. A BAA covers what Fathom does with health information, but on Free and Individual plans the recording link still defaults to anyone with the link. Therapists weighing this can read private AI for therapists.

Does Superhuman's purchase of Fathom change your privacy?

Not on paper yet. Superhuman, formerly Grammarly, announced on September 14, 2026 that it had acquired Fathom and plans to bring its notetaking "to its suite of apps and agents" (Superhuman). The announcement says "this same meeting dataset can become available to AI agents." It says nothing about training or data handling.

Fathom's privacy policy was last updated August 16, 2026, before the deal, and doesn't mention Superhuman (Fathom privacy policy). Its business-transfer clause says data passed in a sale stays governed by the policy "in effect at the time the applicable information was collected." Fathom's policy changes take effect "when it is posted," and Fathom says it "may notify you" of material ones. Our guide to AI privacy policy changes explains what continued use means under clauses like these.

Has Fathom been sued over recording?

We found no lawsuit naming Fathom, as of October 31, 2026. We searched news and legal press that day. The federal docket searches we tried wouldn't load, so a filing we couldn't see is possible.

If you have a dispute, Fathom's terms send it to binding individual arbitration and waive class actions (Fathom terms). You can opt out by mailing a letter to Fathom's legal department within 30 days of agreeing to the terms. This isn't legal advice.

How Morse handles what you ask after a Fathom call

Every section above traces back to where the meeting sits. Fathom keeps it on its servers, where six AI providers handle it, a link can open it, a training setting decides whether it improves Fathom's models, and, since September, a new owner decides what comes next. Morse has no part in the call itself. What you type into a Morse chat afterward is yours to choose. Those chats are stored in your browser, encrypted, and Morse's servers don't keep your messages or log what you write.

• E2EE, for a passage with a client's own words in it. Fathom's list names six AI providers that handle meeting content. In an E2EE chat, only the enclave your browser has checked can read the message. Your browser verifies the enclave's proof that it's genuine, then seals the message on your device for that enclave alone, and Morse's servers relay text they can't read. The guarantee rests on the enclave hardware and attestation working as designed. E2EE runs open-weight models like GLM, Kimi, and DeepSeek, and comes with Pro, at $19 a month.
• Private, the mode every new chat starts in, for questions about the work the meeting covered. Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't.
• Anonymous, for putting a meeting question to GPT, Claude, or Gemini without your account attached. Fathom's connector hands meetings to ChatGPT and Claude in your own account there. In Anonymous mode, our proxy removes your account, email, and IP address and sends the message under Morse's own account. The provider sees the message without knowing it's you, and may keep it for a limited time to check for abuse, under its own policy. Morse strips who you are, not what you paste, so cut the attendees' names first.

Fathom's training opt-out sits in My Settings. Morse has nothing equivalent to find, because it doesn't train AI on your content, sell your data, or show ads (Morse privacy policy). Clearing your browser or deleting your account removes your chats, and Morse can't recover them, so keep your own copy of anything you need. Because we don't store chats, we usually have very little to give authorities. For what other apps collect, see what data AI chatbots collect.

So is Fathom safe enough for you?

• Training: opt out in My Settings, and ask your admin to opt out the whole organization. Morse doesn't train AI on your content.
• Consent: turn on Auto Request Recording Consent and Recording Notice, and say it out loud anyway, since the email skips same-day meetings, and bot meetings with more than one guest.
• Links: set each recording to Only people added can view, and set auto-share to Summary only or Nothing.
• Retention: delete recordings you no longer need, since nothing expires on its own below Enterprise.
• Asking AI about the meeting: keep what you type to an E2EE chat on Morse, where only a verified enclave reads it and the history is stored only in your browser, encrypted.

Try a chat from the Morse home page without an account, or start free with no card needed.