--- title: AI Notetaker: Security FAQ slug: ai-notetaker-security-faq docTags: 7ciBZ_ksC9UuPdKWchuuv,LGi7hgvV7rqCsKcv6rmup,9nKTG1Px2G3Do6AIHKrcE createdAt: 2025-10-17T10:03:26.627Z --- *** This article covers frequently asked questions about AI Notetaker security and compliance. # FAQs ### What AI models are used to support AI features? We currently use OpenAI (via OpenAI's API) and Anthropic (via AWS Bedrock). ### Is Ashby's AI Notetaker compliant with the GDPR? Yes. Ashby ensures that its processing of the personal data of EU and UK residents is fully compliant with all applicable data protection laws, including the General Data Protection Regulation (GDPR). In particular, Ashby enters into data processing agreements with customers processing the personal data of EU and UK residents that incorporate the standard contractual clauses (SCCs) adopted by the European Commission pursuant to its Implementing Decision (EU) 2021/914 of June 4, 2021, including all modules governing controller-to-processor transfers of personal data. Further, Ashby has completed a Data Transfer Impact Assessment (DTIA) that assesses the laws and practices of the US that could impinge on the effectiveness of the SCCs as a transfer tool, consistent with the *Schrems II* ruling by the Court of Justice of the European Union. Ashby is certified, and maintains its certification, pursuant to the EU-U.S. Data Privacy Framework (DPF), the UK extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. All transfers of personal data from the EU, UK, or Switzerland are made pursuant to the DPF or the SCCs. ### Will we need to update our privacy policy or notify candidates explicitly that AI is being used during interviews? You should consult with your legal and privacy teams to determine your privacy policy, disclosure policy, and consent policy. You should consider in particular your obligations to disclose that interviews are being recorded, obtain applicable consents (e.g., "two-party" consent requirements in the United States), and honor opt-outs. In the EU, if candidates interact with an AI assistant, deployers may have transparency obligations under the EU AI Act. Ashby provides in-product consent messaging and logging to support these obligations. ### Where are video/audio recordings and transcripts stored? Are they stored on your servers, third-party providers, or another infrastructure? Recordings and meeting transcripts are stored on Ashby's servers in the United States. A third-party service provider also stores recordings for a short period of time while Ashby transfers the files to its own servers after they are created (this provider creates the original recording and transcript). The third-party service provider deletes these files within seven days. For more details on our storage practices, refer to our [Trust Center](https://trust.ashbyhq.com/), which includes a list of Ashby subprocessors. ### Is there an option to automatically delete recordings after a certain period? Can we configure data retention policies ourselves? Yes. Organizations with AI Notetaker can configure separate data retention rules for recording media, transcripts, and AI-generated notes in **Admin > Interviews & Scheduling > AI Notetaker > Data retention**. Each rule has its own retention period and can be enabled independently. When you delete or anonymize a candidate, Ashby automatically deletes the candidate's associated recording media, transcripts, and AI-generated notes. You should obtain your own legal advice to determine the retention periods your organization uses. For more information on configuring retention rules, see [Data retention settings](docId\:aLQifj88_70_q489mKpQP) . ### Who has access to the recordings and transcriptions? By default, interviewers can access their own recordings and transcripts for meetings in which they were scheduled to be a participant. To access recordings for meetings they did not participate in, a user must have one of the following: 1. Access to the **Can see meeting recordings** permission stripe within the specific scope for a meeting (e.g., a specific Job, Department, or Location) 2. The **Admin Private** access role, which includes the **Can see meeting recordings** permission stripe 3. Direct access granted by a colleague who has shared the recording with them Users who receive access through sharing view the recording on a standalone page that includes only the recording, transcript, and notes; no other candidate or briefing details are visible. For more information, see [Sharing a recording](docId\:Ch6TUUE-gvaQcYLMp9Bo8). ### Can Ashby staff or third-party vendors view recordings or transcripts? Only Ashby staff who need access to provide support for and maintain AI Notetaker can view recordings or transcripts. ### Has Ashby conducted a Data Protection Impact Assessment for this feature? Yes. However, Ashby does not share data protection impact assessments (DPIAs) externally. ### Is there a security whitepaper or data processing agreement (DPA) addendum specifically covering AI Notetaker? Ashby's DPA covers AI Notetaker's recordings of interviews and preparation of related transcripts and summaries. ### Can recordings be deleted upon request? Yes. The option to delete a specific recording will be available to Admin users within Ashby soon. In the interim, you can email [support@ashbyhq.com](mailto\:support@ashbyhq.com) with any data deletion requests. After verifying that the requester has adequate permissions, Ashby will execute the deletion on your behalf. ### Do you share recordings with candidates upon request? As a service provider/processor, Ashby does not proactively share candidate data with candidates. If a data subject contacts Ashby directly, we refer them to the data controller. ### Does the AI Notetaker meet ISO 27001, SOC 2 Type II, and other audit standards? Ashby is audited annually in accordance with SOC 2 Type II standards. The latest reports, along with any bridge letters, can be accessed via the [Trust Center](https://trust.ashbyhq.com/). ### How does Ashby comply with the EU AI Act and other AI-specific laws? *EU AI Act:* While the EU AI Act classifies as "high risk" AI systems intended to be used for recruitment purposes (including to analyze and filter job applications and to evaluate candidates), AI Notetaker falls within certain exceptions, including AI systems "intended to perform a narrow procedural task" or "intended to perform a preparatory task." Ashby complies with the EU AI Act requirements that apply to all AI tools deployed in the EU market, including transparency and accountability requirements. *State/local laws:* Certain U.S. laws, such as NYC Local Law 144, may apply if you use AI outputs to evaluate candidates or substantially assist hiring decisions. These laws may trigger annual bias audit, public notices, and candidate disclosure obligations for your organization. AI Notetaker does not trigger such obligations when used purely for recording, transcription, or summarization, but you must assess how your use may implicate such laws.