An AI notetaker for consultants has to survive a document you signed before the kickoff call.

Vendors pitch an AI notetaker for consultants on time saved and follow-ups drafted. Your client’s counsel reads a different document. The confidentiality clause you signed decides which notetakers you can run on client calls, and for most cloud tools the answer is already no.

The clause you signed, read literally

Nearly every consulting NDA and MSA contains a version of the same sentence: the Receiving Party shall not disclose Confidential Information to any third party without the Disclosing Party’s prior written consent. Some versions carve out employees and agents with a need to know, bound by equivalent obligations. Almost none carve out “SaaS tools the consultant finds useful.”

Now trace what a cloud notetaker does with a client call. Audio streams from your machine to the vendor. The vendor typically passes it to a speech-to-text provider, then to an LLM API for summarization, then stores audio, transcript, and summary in its cloud, often replicated across backups. That is not one disclosure. It is a chain of them, to parties your client has never heard of, none of whom signed anything with your client.

The vendor’s SOC 2 report does not change this analysis. SOC 2 speaks to whether the vendor follows its own controls. Your NDA speaks to whether the information reaches a third party at all. A well-secured disclosure is still a disclosure.

By 2026, the contracts say it out loud

For years this was an argument by implication from general confidentiality language. It no longer needs to be. Since the first wave of generative AI adoption, enterprise legal teams have been adding explicit AI clauses to MSAs, vendor agreements, and outside-counsel guidelines. The common formulations:

• Contractor shall not input Client Confidential Information into any generative AI tool without prior written approval.
• Contractor shall not use tools that record or transcribe Client communications without consent.
• Contractor shall disclose all subprocessors that will access Client data, and shall not add subprocessors without notice.

Procurement and security questionnaires ask the matching questions: which AI tools does your firm use, what client data do they touch, where is it processed. If you run a cloud notetaker on that client’s calls, you either disclose it and invite the follow-up questions, or you answer inaccurately. Neither is a position a consultant wants to occupy mid-engagement.

There is also the meeting itself. A bot participant labeled “Notetaker” in a client workshop announces the disclosure to everyone in the room (see An AI Notetaker Should Not Be a Participant in Your Call). The botless cloud tools remove the visible participant but not the disclosure; the audio still streams out (see Bot-Free Is Not the Same as Private).

The return-or-destroy clause is the one that bites later

Standard NDAs end with a cleanup duty: on termination or on request, the Receiving Party shall return or destroy all Confidential Information, including copies, and certify destruction in writing.

Consider certifying that with a cloud notetaker in the stack. The engagement’s calls exist as audio files, verbatim transcripts, and summaries in a vendor’s production database, in the vendor’s backups on their own retention cycle, in the speech-to-text subprocessor’s logs under its own policy, and in whatever synced copies reached email recaps or a CRM. You can click delete in the vendor UI. You cannot certify, of your own knowledge, that every copy is gone; the honest version of that certification letter has footnotes (see How to Delete Everything an AI Notetaker Knows About You).

Compare the posture where the engagement’s record is a folder of Markdown files on your own Mac:

rm -rf ~/Vault/Calls/AcmeCo/

One command, verifiable by inspection, certifiable without footnotes. Destruction you can perform is a feature of where the data lives, not of the vendor’s goodwill.

One vendor account, every client’s secrets

Consultants concentrate risk in a way single-employer users do not. A strategy consultant’s notetaker account holds calls from every active engagement: pricing discussions from one client, a pre-announcement acquisition from another, sometimes two clients who compete with each other, all in one vendor tenancy behind one login.

That concentration turns any vendor incident into a multi-client event. One breach, one compromised password, one over-permissive integration, and the blast radius is your entire client list, each client owed its own notification under whatever the relevant contract and privacy law require, each one a conversation that ends engagements. The transcript archive is also a discoverable record of every engagement in one place if you are ever subpoenaed (see The AI Notetaker Legal Risk Nobody Priced In).

The way to make that scenario impossible is not a stronger password. It is an architecture where no such archive exists.

The architecture that satisfies the clause

This is the posture Fazit was built around, and it maps onto NDA language directly:

• Audio is captured into a fixed-size ring buffer in RAM, never written to disk, never uploaded, continuously overwritten during the call. Persisting it would require a deliberate code change, which is why we call it an invariant, not a setting (see Why “Never Records” Is Not Marketing).
• Transcription and summarization run on-device on Apple Silicon. No audio, no transcript, and no summary reaches any vendor, so there is no third party in the chain and no subprocessor to disclose on a questionnaire (see On-Device vs. Cloud AI Notetakers).
• What survives the call is one Markdown note in your Obsidian vault, stamped audio_retained: false, filed per client, plain text you can grep across an engagement and delete in one command when the return-or-destroy letter arrives (see Files, Not Rows).

Read against the clause: no Confidential Information is disclosed to a third party, because no third party ever receives it.

THE DISCLOSURE CHAIN, ONE CLIENT CALL

Cloud notetaker:  your Mac
                    -> vendor cloud
                    -> speech-to-text subprocessor
                    -> LLM summarization API
                    -> backups, CRM, email recap

Fazit:            your Mac
                    -> your vault

Every arrow is a party your client never approved.
Fazit has one arrow, and it stays on your machine.

Processing happens on hardware you control, under the same roof as your other engagement files. The consent question the cloud tools force you to ask never comes up, because there is nothing to consent to. What remains is your own work product, a note, governed by the same NDA duties as every other note you have ever taken by hand.

Answers for the security questionnaire, before it arrives

When a client’s security team asks about AI tooling, these are Fazit’s answers, one line each:

• Which third parties receive our data? None. Audio is processed in RAM on the consultant’s Mac; nothing is transmitted.
• Where are recordings stored, and for how long? There are no recordings. Audio is never persisted, by architecture.
• Is our data used to train models? No. Nothing leaves the machine to train on.
• Can you destroy all engagement data on request and certify it? Yes. Notes are local files; destruction is a file deletion you can verify.
• What is your subprocessor list for this tool? Empty.

The full security posture is documented at getfazit.com/security.

FAQ

Can consultants use AI notetakers on client calls?

Only within what the engagement’s contracts allow. Standard confidentiality clauses bar disclosing client information to third parties without consent, and a cloud notetaker transmits call audio to at least one third party and usually several. The clean options are written client consent for a specific tool, or an on-device tool that transmits nothing.

Does a cloud AI notetaker violate an NDA?

It depends on the clause, but the mechanics are uncomfortable: audio and transcripts of the client’s confidential information land on systems belonging to parties outside the agreement. Broad “no third-party disclosure” language reaches that easily, and post-2023 MSAs increasingly prohibit it explicitly by naming AI tools. The safe reading is that consent is required, in writing, before the first call.

What should consultants look for in a private AI notetaker?

Ask where the audio goes, whether anything is persisted, who the subprocessors are, and whether you can destroy all engagement data yourself and certify it. An on-device tool answers all four in one move: audio processed in RAM on your machine, nothing persisted, no subprocessors, and notes that are local files you can delete (see On-Device vs. Cloud AI Notetakers).

Do I still need to tell the client I’m taking notes?

Taking notes has never required consent; it is what consultants are hired to do. Recording is the act that trips consent statutes and contract clauses. A tool that never records keeps you on the note-taking side of that line, though disclosure is still good practice in sensitive settings, and some engagements contractually require it regardless of tooling (see Is It Legal to Record Client Calls?).