Data processing agreement (dpa) — Fathom AI Notetaker

Cited by

Facts read from this source

• DPA provider entity Report an error

  “by and between Fathom Video Inc., a Delaware corporation ("Fathom" or "Provider")”

• DPA standard terms version Report an error

  “the Common Paper DPA Standard Terms Version 1.1 posted at commonpaper.com/standards/data-processing-agreement/1.1 ("DPA Standard Terms"), which are incorporated by reference”

• SOC 2 Report an error

  “Provider will maintain annually updated reports or annual certifications of compliance with the following: SOC 2 Type II; HIPAA; Penetration Testing.”

• HIPAA Report an error

  “Provider will maintain annually updated reports or annual certifications of compliance with the following: SOC 2 Type II; HIPAA; Penetration Testing.”

• Penetration testing Report an error

  “Provider will maintain annually updated reports or annual certifications of compliance with the following: SOC 2 Type II; HIPAA; Penetration Testing.”

• Dpf certification Report an error

  “Provider is certified under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework”

• Special category data Report an error

  “Is special category data (as defined in Article 9 of the GDPR) Processed? Yes”

• Encryption in transit Report an error

  “Protecting Customer Personal Data during transmission (in transit): All data is encrypted in transit”

• Encryption at rest Report an error

  “Protecting Customer Personal Data during storage (at rest): All data is encrypted at rest”

• Security policy URL Report an error

  “Security Policy available at: https://trust.fathom.video.”

• Audit records retention Report an error

  “Provider will maintain records of its compliance with this DPA for 3 years after the DPA ends.”

• Breach notification Report an error

  “notify Customer without undue delay when feasible, but no later than 72 hours after becoming aware of the Security Incident”

• Governing member state Report an error

  “EEA Transfers: Netherlands UK Transfers: England”

• List URL Report an error

  “View a list of Fathom subprocessors at https://trust.fathom.video”

• Change notice days Report an error

  “Provider will inform Customer at least 10 business days in advance and in writing of any intended changes to the Approved Subprocessors”

• Objection window days Report an error

  “Customer has 30 days after notice of a change to the Approved Subprocessors to object, otherwise Customer will be deemed to accept the changes.”

• Categories Report an error

  “Fathom collects meeting recording data (audio, video, transcript), calendar data (meeting titles, times, attendee emails), and personal information (name, email, IP, role, job title).”

• Deletion on request Report an error

  “Provider will enable Customer to delete Customer Personal Data in a manner consistent with the functionality of the Services.”

• Deletion at DPA expiration Report an error

  “After the DPA expires, Provider will return or delete Customer Personal Data at Customer’s instruction unless further storage of Customer Personal Data is required or authorized by Applicable Law.”

• Frequency of transfer Report an error

  “Frequency of Transfer Continuous”

• Due diligence frequency Report an error

  “All such requests must be in writing and made to the Provider Security Contact and may only be made once a year.”

• Security reports on request Report an error

  “Upon written request, Provider will give Customer, on a confidential basis, a summary copy of its then-current Report”

• Service description Report an error

  “Fathom provides an audiovisual recording service that integrates with Zoom, Microsoft Outlook, and Google Calendar.”

• Capabilities Report an error

  “People use Fathom’s Services to record, transcribe, and get summaries of their video conferencing meetings.”

• Nature of processing Report an error

  “generation of meeting recordings, transcription and AI summarization of meeting recordings, secure storage and organization of meeting recordings, export of content (transcript, recordings, summaries) to third-party platforms integrated by Customer and Authorized Users (for example, CRMs and task management systems)”

• DPA last updated Report an error

  “Last Updated: May 5, 2026”

• Provider address Report an error

  “Address: 2261 Market Street #4156, San Francisco, California 94114, USA”

• Audit rights Report an error

  “Provider will give Customer all information reasonably necessary to demonstrate its compliance with this DPA and Provider will allow for and contribute to audits, including inspections by Customer”

• Dpia assistance Report an error

  “Provider will reasonably assist Customer in conducting any mandated data protection impact assessments or data transfer impact assessments”

• Liability cap reference Report an error

  “each party’s total cumulative liability to the other party arising out of or related to this DPA will be subject to the waivers, exclusions, and limitations of liability stated in the Agreement.”

• Attribution Report an error

  “Common Paper DPA Standard Terms Version 1.1 are available at commonpaper.com/standards/data-processing-agreement/1.1 and are used under CC BY 4.0.”

3 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Management Consultant Recording, transcription & languages
• The Management Consultant Consent, participant rights & works council
• The Management Consultant Retention, AI training & administration
• The Management Consultant European sovereignty
• The Data Protection Officer Recording, transcription & languages
• The Data Protection Officer Consent, participant rights & works council
• The Data Protection Officer Retention, AI training & administration
• The Data Protection Officer European sovereignty
• The IT Lead Consent, participant rights & works council
• The IT Lead Retention, AI training & administration
• The IT Lead European sovereignty
• The Sales Team Lead Consent, participant rights & works council
• The Sales Team Lead Retention, AI training & administration
• The Sales Team Lead European sovereignty
• The Skeptic Consent, participant rights & works council
• The Skeptic Retention, AI training & administration
• The Skeptic European sovereignty
• The Works Council Chair Consent, participant rights & works council
• The Works Council Chair Retention, AI training & administration
• The Works Council Chair European sovereignty