Where does your meeting audio actually go?
I've started asking one question before I let any meeting tool near a client call, ahead of price and ahead of features: where does the audio actually go? A recording is a file with a specific person's voice in it, someone who agreed to talk to me, not necessarily to a vendor in another country. Follow that file and most of the marketing falls away.
follow the audio
There are really two data paths, and every tool is a variation on one of them. The bot-based path streams your call to the vendor's servers, where it's transcribed, summarized, and stored under their terms; the audio is cloud-bound because that's the design. The on-device path captures and often processes the audio on your own hardware, and depending on the tool may sync only the resulting text, or keep everything local. Which path a product takes is the bot-versus-on-device architecture question, and it decides whose disks your client's voice lands on first.
consent is a legal question, and I'm not your lawyer
Here I have to be careful, and so should you. Recording consent is real law, and it varies more than engineers expect. Some jurisdictions are one-party-consent, some require every participant to agree, and inside the EU a recording of an identifiable person is personal data that needs a lawful basis and, usually, the participants actually being told. I'm an engineer, not counsel, and none of this is legal advice for your situation. If real client data or a regulated sector is involved, ask an actual lawyer in the actual jurisdiction, because I've watched confident engineering guesses about this go badly.
The one practical habit that survives every jurisdiction: I ask out loud before recording, every single time.
A transcript is a recording of someone who agreed to talk to you, not necessarily to a third party you never introduced into the room.
the one contract line that deleted my shortlist
Last spring I had a shortlist of notetakers half-approved for a Brno client, most of them the polished bot-based ones. Then their legal team sent a single sentence out of a thirty-odd-page agreement: no third-party sub-processors may handle their data without prior written approval. That one line took out every cloud tool on my list in a stroke, because a bot that streams the call to a vendor is, definitionally, a third-party sub-processor handling the data. I had to walk back a recommendation I'd already made, which was humbling and correct in equal measure. What survived were the on-device tools and the option to build my own, the same data-sovereignty instinct I wrote about around EU model hosting, pointed at meeting audio instead of inference.
the two questions to put to a vendor in writing
When a tool does send audio off your machine, two questions matter more than any feature, and I now ask both in writing. How long do you retain the audio and the transcripts, and can I set that myself? And do you train models on my calls, by default or at all? I've asked three vendors those exact questions and gotten three genuinely different answers, and the defaults were rarely the ones I'd have chosen for a client. When a commercial tool can't answer cleanly, that silence is itself the answer, and rolling your own stops looking like paranoia and starts looking like the sober fallback.
Not paranoia. Just wanting to answer a client's simplest question, where does our conversation end up, without having to guess.