Quick answers
Is Avoma SOC 2 Type II and HIPAA compliant?
Avoma’s help centre says it is compliant with HIPAA, SOC 2 Type II and GDPR. Its security page describes an independent SOC 2 Type II audit and does not mention HIPAA. No audit date or period is given.
Does Avoma train AI on customer data?
The Avoma pages we reviewed do not state it. Its privacy policy (updated 2 January 2026) says Google Workspace API data is not used to train generalised AI or machine-learning models, and says aggregated information may be used for development.
Which AI providers does Avoma use?
Not named on the pages we reviewed. The privacy policy points to a sub-processor list that did not load when we checked.
Where does Avoma host data?
Avoma says AWS facilities in the USA. Its privacy policy says information may be processed “in various sites throughout the globe”.
Summary
Avoma is aimed at sales and customer-facing teams, with conversation analytics alongside notes. For a regulated firm the most useful finding is what is missing: the Avoma pages we reviewed do not state its AI-training position, do not name its AI providers and do not give retention periods. Those are the questions to put to the vendor first.
What Avoma states
| Area | What the vendor states | Source and date |
|---|---|---|
| SOC 2 | Avoma says it has an independent audit for SOC 2 Type II compliance and will share its compliance report with mid-market and enterprise clients “as required”. No audit date or period is given. | S1 · undated |
| HIPAA and GDPR | Avoma’s help centre says it is “compliant with HIPAA, SOC2 Type II, and GDPR”, without audit detail. The security page describes a commitment to GDPR, with consent notifications and a way to request deletion; it does not mention HIPAA. | S2, S1 · undated |
| AI management | Avoma says it is certified to ISO/IEC 42001:2023, the standard for AI management systems. It does not name the certifying body or give a date. | S1, S3 · undated |
| Training on customer data | Not stated on the Avoma pages we reviewed. The privacy policy says Avoma does not use Google Workspace API data to develop, improve or train generalised AI or machine-learning models. It also says anonymous or aggregated information may be used for testing, development and operation of the service. | S4 · updated 2 Jan 2026 |
| AI providers | Not named on the pages we reviewed. The privacy policy refers to sub-processors listed at trust.avoma.com/subprocessors, which did not load when we checked. | S4 · updated 2 Jan 2026 |
| Where data is hosted | Software hosted in AWS facilities in the USA, with no other regions or residency choice mentioned. The privacy policy says information may be stored and processed “in various sites throughout the globe”, and cites the EU-US, UK Extension and Swiss-US Data Privacy Framework principles. | S1, S4 · undated; 2 Jan 2026 |
| Retention and deletion | No retention periods are stated. The privacy policy says information is kept “as long as necessary”, and deletion requests go to help@avoma.com. | S4 · updated 2 Jan 2026 |
| Recording consent | Avoma recommends turning on its meeting reminder and recording consent disclaimer notification, especially for external participants. | S1 · undated |
| Admin controls and sign-on | Single sign-on, SCIM and audit logs are not mentioned on the pages we reviewed. | S1 · undated |
Avoma’s Trust Center (trust.avoma.com) did not load when we checked, so it is not used as a source here. Dates are the page’s own where it shows one; otherwise we say “undated”.
Archiving and recordkeeping
The Avoma pages we reviewed do not describe a connector to a compliance archive such as Global Relay, Smarsh or Proofpoint. That does not mean none exists, only that we found none documented. Ask Avoma how transcripts and summaries can be exported or delivered to your archive, and test that route before relying on it. Our guide to archiving AI meeting notes covers what to ask for.
For the rules that decide whether AI meeting notes are records, see Archiving AI meeting notes: what regulated firms need to check.
Questions to ask before rollout
- Ask for the SOC 2 Type II report and check the audit period, since the pages give none.
- Ask what HIPAA coverage means in practice, and whether Avoma signs a Business Associate Agreement.
- Ask for a written statement on whether customer recordings and transcripts are used to train any model, Avoma’s or a provider’s.
- Ask which AI providers process your meeting content, where, and how long they keep it. Request the sub-processor list, which we could not load.
- Hosting is stated as USA, while the privacy policy allows processing “throughout the globe”. UK and EU firms should confirm where data is processed and under which transfer mechanism.
- Ask for the retention and deletion settings available to admins, and whether they can match your records schedule.
- Ask how recordings, transcripts and summaries reach your archive.
Who it fits
Avoma is built more for sales workflows than for advisory or compliance use specifically. It can still suit firms that want conversation analytics alongside notes, provided the open questions above are answered in writing first.
Sources
- S1: Avoma security page, undated; read 12 October 2026.
- S2: Avoma Help Center: Is my data secure with you?, undated, page footer 2025; read 12 October 2026.
- S3: Avoma blog: ISO/IEC 42001 certification, undated; read 12 October 2026.
- S4: Avoma privacy policy, last updated 2 January 2026.
All sources read on 12 October 2026.
Visit Avoma
Check the vendor’s current pages, then compare it with the other meeting notes tools in the directory.
Go to AvomaCompare all meeting notes tools · Fellow review · Grain review