notta Enterprise Risk Assessment | AI Tool Risk

Back to AI Tools

notta

Risk Overview

Moderate Risk

4.7

/10

Speech to Text

Meeting Transcription

Meeting Summaries

Top Risks

Default AI training on user meeting content requiring Enterprise plan upgrade to opt out (most aggressive training policy in batch); Japanese jurisdiction and APPI (foreign government data access risk); data stored in Tokyo (non-EU/US for many enterprise users); calendar integration for meeting auto-join; non-consenting participants transcribed; enterprise plan required for basic privacy control.

Mitigations

SOC 2 Type II + ISO 27001 certified; machine-only transcription; GDPR/CCPA/HIPAA compliance; AES-256 encryption; AWS infrastructure; Japanese APPI provides user rights; Google Workspace API restricted from generalized training.

Get started

Is your team using

notta

safely?

Book a Demo Free Assessment

Highest Risk Categories

The highest-scoring risk categories identified in this assessment.

Training Use

Critical finding: Notta uses Japanese-language user conversations to train AI models by default. Opt-out from training requires upgrading to Enterprise plan -- users on free/standard plans cannot opt out without paying extra. Google Workspace APIs not used for generalized AI training (restricted per Google policy), but Nottas own models trained on user content by default on non-enterprise plans. Most aggressive training policy in this batch.

/10

Data Retention

Data stored on AWS Tokyo. Specific retention periods not prominently published in English-language materials reviewed. Standard data deletion rights per GDPR/CCPA/APPI stated. No zero-data-retention policy. Post-deletion backup retention period not specified. Japanese APPI compliance means certain deletion rights apply.

/10

Legal Terms

Japanese company subject to Japanese law (APPI) and also GDPR/CCPA compliance stated. ToS terms contain liability limitations but Japanese jurisdiction means no US-style mandatory arbitration with class action waiver. Different legal framework -- Japanese consumer protection law generally applies. Lower arbitration risk than US companies.

/10