Fathom Buyer's Checklist: Security, Privacy, HIPAA and Plans

Fathom is a reasonable choice for a business team, but only after an admin makes a few decisions that the defaults leave open. Fathom says it holds SOC 2 Type II and complies with GDPR, and it keeps all customer data in the United States. The real exposure sits in the settings: auto-record is a scope you pick, auto-share can send recordings to every invitee, and on Free and individual plans the link attendees receive opens, by default, for anyone who holds it. For a team, Team at $15 per user per month billed annually ($19 billed monthly, 2-user minimum) is where organization-wide controls begin, and Fathom's pricing lists a standard BAA on Team and Business. SSO, SCIM, custom retention and the download and deletion locks need Enterprise.

Consent and recording: what the other side of the call sees

With the bot, Fathom cannot record quietly: the Notetaker shows in the participant list, and hiding the in-meeting banner, a Premium option, does not hide it. Bot-free capture has no bot, so participants see a consent message in the meeting chat only when Recording Notice is on, and Team admins can enforce it. Legally, consent is your job: Fathom's Terms make the user responsible for getting every participant's agreement before the call, and its help names the meeting host as the data controller. The optional consent email, when switched on, covers far less than buyers assume. With the bot, it goes out only for an external meeting the Fathom user hosts with exactly one guest, 24 hours ahead ^[1]. Silence is not a refusal. Fathom still joins.

• Pick the auto-record scope on purpose. The choices are all meetings, external only, internal only, or none. Fathom's getting-started guide nudges new users toward recording everything.
• Know the bot-free email rules. On bot-free capture, a Mac beta, consent emails go only to external, scheduled meetings with Auto Request Recording Consent switched on and host privileges. Same-day calls, impromptu calls and Slack Huddles get none.
• Use the team-level consent switch. Team admins can enforce a consent message in the meeting chat for bot-free meetings, or block bot-free capture for the whole organization.
• Decide auto-share before the first call. When it is on, the summary, and the recording link if you choose that option, goes to every invitee on the calendar event, including people who never showed up.
• Fix the link default. On Free and individual plans, the link sent to attendees opens for anyone who has it by default, and you change that recording by recording. A shared recording cannot be unsent; the owner can only revoke access later.
• Brief users on the scratch pad. Tagging an outside person there by email gives that person access to the call.

Where recordings live, who owns them, and how they get deleted

Everything Fathom stores, including recordings, transcripts and account records, sits in the United States. There is no regional hosting. For EU buyers that weighs more than any badge, although Fathom says it is certified under the EU-US Data Privacy Framework and its UK and Swiss extensions, with standard contractual clauses as the fallback. Deletion is a best-efforts promise, not a deadline. The Privacy Policy says Fathom makes commercially reasonable efforts to delete recordings and personal data within 30 days of a request ^[2], and the Terms let backup copies persist for up to 30 days.

• Ownership moves when someone joins a team. After joining a Team account, a user's account and content belong to that team and its admins. Content is tied to one email address and cannot be moved or merged into another account.
• Members cannot delete themselves. On Team, Business and Enterprise, members never see the Delete button; they ask the admin, and Fathom deletes their data only when the customer administrator requests it.
• Plan for leavers. Deactivating a former employee keeps their recordings available to the team. Removing them from the team pulls their shared recordings away from everyone else.
• Settle AI training. Fathom may use de-identified meeting data to improve its own models unless you opt out, and a Team organization can opt out every user at once. Its AI providers (Anthropic, OpenAI and Google) are not permitted to train on your content.
• Pull the subprocessor list. Fathom's Terms point to its Trust Center for subprocessors, and the help center sends security questions there too.

Compliance answers your security reviewer will ask for

Start with the certificates. Fathom says it holds SOC 2 Type II, and it states plainly that it lacks ISO 27001. For health-care and other regulated teams, the exact HIPAA wording matters: Fathom says it complies with HIPAA; its pricing lists a standard BAA on Team and Business and eligibility for a custom BAA on Enterprise ^[3]. Negotiated BAA terms are an Enterprise conversation. On GDPR, for Team, Business and Enterprise accounts Fathom acts as processor, with the customer as controller under a data processing agreement. EU and UK users request it from trust@fathom.video.

Then read the Terms with a lawyer's eye. Free users get no indemnities or warranties, and Fathom can end free use at any time. Liability is capped at the greater of US$100 or the fees paid in the previous 12 months. Disputes go to binding individual arbitration with a class-action waiver unless you opt out by letter within 30 days of accepting. The Terms also give no assurance that the service suits use outside the United States. None of this is unusual. It still belongs in your vendor file.

Admin controls: what Team covers and what waits for Enterprise

Team is the first plan with organization-wide security controls, and most of them deal with capture rather than access. Admins can allow a single bot per meeting, block bot-free capture, enforce the consent chat message, set auto-capture separately for external, internal and unscheduled meetings, choose visibility defaults and keep a shared transcription dictionary. Several controls a compliance lead may expect from a team plan, though, sit only on the top tier. Check the table against your policy.

Read the bottom rows as gaps on the lower plans. A Team or Business admin cannot stop a member from downloading a recording or deleting one, and cannot open any meeting at will. Retention on Enterprise is not self-serve: one policy per team, custom periods need approval from Fathom's engineers, and recordings older than the window are permanently deleted. SAML is switched on by Fathom's success manager or support team and applies to every user at once. Enterprise is listed at $35 per user per month, billed annually only, and sold through sales.

CRM and automation caps that decide the plan

Integrations rarely come up in a security review. They often decide the plan. CRM sync with HubSpot, Salesforce and Close works on every plan, Free included, but for at most 3 users per email domain below Business. CRM field sync, Deal view, coaching metrics and AI Scorecards are Business features too. Zapier and Make (the automation platform) work on every plan, in limited form on Free and Premium and in full from Team. The public API, webhooks and the MCP connectors for ChatGPT and Claude are on every plan, and keys are per user: an admin cannot revoke another user's key.

• Count CRM users per domain. Four or more people who need their calls logged means Business.
• Check who holds the admin roles. HubSpot field sync needs a Fathom Account Admin who is also a HubSpot Super Admin; Salesforce needs a team-level connection set up by an admin.
• Price the step honestly. Business adds $10 per user per month on annual billing, $120 more per user a year billed annually by our arithmetic, so five users billed annually pay $1,500 a year in total instead of $900 ($300 instead of $180 per user a year).

Money terms to settle before anyone signs

Team costs $15 per user per month billed annually or $19 billed monthly, with a 2-user minimum. Business costs $25 per user per month billed annually or $34 billed monthly, with the same minimum. Team is $1 per user per month cheaper than Premium on either billing term, yet one person on Team pays for two seats. Premium stays the cheapest paid plan for one person. The toggle promises a quarter off for annual billing; the real saving is about 21% on Team and about 26.5% on Business. Fathom advertises a 90-day money-back guarantee on paid plans but does not publish its conditions; its Terms of Service say fees are non-refundable ^[4]. Get it in writing.

• Team cancellation is not self-serve. It goes by email to Fathom's success team, and billing changes need Account Admin access.
• Cancelling does not stop the bot. An individual account drops to Free, which still records; our guide to removing Fathom covers switching it off for good.
• Watch the trial end. Fathom does not publish the Team trial length. If it ends without a purchase, the Team account goes inactive and Team Calls are disabled for everyone.
• Compare totals first. Seat-by-seat figures for every plan are in our Fathom pricing breakdown, and the full Fathom review judges the product itself.

The bottom line

Fathom passes the paperwork checks a small team should run: a SOC 2 Type II claim, a processor role under a data processing agreement on team plans, and a standard BAA that its pricing lists on Team and Business. Its weak spots are defaults and plan gates. Before rollout, set the auto-record scope, switch off auto-share or tighten link access, opt out of model training, and count CRM users per domain. Pick Team for a group that needs shared controls, Business once four or more people sync to the CRM, and Enterprise only when SSO, retention or download locks are hard requirements.