How to Configure Fireflies.ai Join Settings and Privacy Controls to Protect Sensitive Calls

When organizations roll out Fireflies.ai at scale, the primary security breakdown rarely stems from infrastructure flaws. Instead, it occurs because employees connect their Google or Outlook calendars without adjusting default automation settings. The AI assistant (fred@fireflies.ai) then begins auto-joining executive strategy sessions, quarterly performance reviews, board deliberations, and confidential M&A negotiations. Once the call finishes, an open sharing configuration can blast recap emails or full verbatim transcripts across the entire workspace.

Preventing unauthorized meeting capture requires IT administrators and compliance officers to move beyond individual user habits and establish defense-in-depth governance. Fireflies provides four coordinated layers of control: global workspace join guardrails, calendar-level restriction rules, access tiering with the Enterprise Rules Engine, and conferencing-level host protections.

Here is how IT administrators can configure these settings to ensure sensitive internal conversations remain strictly off the record.

1. Lock Down Workspace-Wide Auto-Join Guardrails

The root cause of unwanted recording is the workspace default setting. In an unconfigured workspace, Fireflies defaults to allowing individual teammates to decide whether the bot joins their meetings. Employees routinely select convenient options like joining every calendar event with a video link, unintentionally dragging the notetaker into private one-on-ones and executive briefings.

Admins must override individual autonomy and enforce baseline join behavior at the team level:

1. Sign in to the Fireflies web application with administrator credentials.
2. Open Settings from the left-hand navigation menu.
3. Switch to the Team tab at the top of the interface.
4. Select Recording & Privacy on the left menu panel.
5. Under the Recording section, locate the Auto-record meetings dropdown.

Fireflies offers six team-level modes for this setting:

For enterprise-wide deployments where internal calls contain sensitive IP or personnel information, administrators should set the baseline policy to Record meetings with external participants or enforce Only when invited across sensitive user departments.

2. Deploy Global Restriction Rules to Blacklist Sensitive Calls

Even if team members retain partial scheduling flexibility, administrators and users can deploy Restriction Rules (also referred to as Bar Rules). In the Fireflies processing hierarchy, Restriction Rules always override global join preferences. If a calendar invite matches a restriction keyword or email domain, Fireflies will automatically skip the session even if auto-record is globally enabled.

Blacklisting Keywords in Meeting Titles

To prevent the bot from joining confidential calls, configure title-based keyword filtering:

1. Navigate to Settings -> Recording & Privacy -> scroll down to Recording Rules.
2. Click + Restriction Rules to launch the configuration dialog.
3. In the Title keywords field, enter case-insensitive strings representing restricted discussions. Press Enter after each keyword:
   • 1:1 and 1-on-1
   • Confidential
   • Performance Review
   • Compensation and Salary
   • Executive Committee and Board
   • M&A and Acquisition
   • Legal Counsel and Privileged
   • Disciplinary and Grievance
4. Click Save. Fireflies scans synchronized calendar events and will automatically bypass any meeting matching these terms.

Domain and Email Blacklists

Keyword matching should be paired with participant restrictions to prevent recording meetings involving designated individuals or partner companies:

• In the same + Restriction Rules dialog, add designated email addresses into the Email id or domains field (for example, counsel@externalfirm.com, board-director@advisory.com, or internal aliases like hr-private@company.com).
• Add specific partner or acquisition target domains (such as @competitor.com or @targetcorp.com) during active transaction periods.
• Once saved, any calendar event listing these email addresses or domains will be automatically skipped by the bot.

3. Configure Privacy Tiers and Restrict Recap Email Distribution

A meeting recording can still create a data exposure incident after the call concludes if notification emails and transcript permissions are set too permissively. Fireflies separates post-meeting distribution into two independent mechanisms: Email Delivery (who receives the email recap) and Privacy Settings (who can view the full transcript and recording in Fireflies).

Restricting Meeting Recap Emails

By default, Fireflies may email recaps to every person on the calendar invite, including external attendees who may not have signed non-disclosure agreements:

1. Navigate to Settings -> Team tab -> Recording & Privacy.
2. Scroll to the Email Notification section.
3. Under Meeting recap email, change the selection from Everyone on the invite to:
   • Only participants from my Fireflies team: Restricts delivery strictly to internal workspace members listed on the invitation.
   • Only me: Sends the recap solely to the meeting owner, requiring deliberate manual dissemination.
4. Under What to include, select whether the email contains action items, shorthand notes, or comprehensive overviews to minimize sensitive snippet leakage in inbox previews.

Setting Workspace Meeting Privacy Defaults

To protect the transcript and audio recording stored inside the Fireflies notebook:

1. Under Recording & Privacy, locate the Privacy & Access section.
2. Change the default Meeting privacy setting away from Teammates & Anyone with Link.
3. Choose the appropriate enterprise visibility tier:
   • Only Owner: Highest level of platform confidentiality. Only the host who initiated the recording can view the transcript, audio, and AI recap. Crucial for HR business partners, legal counsels, and C-level executives.
   • Participants: Permits access exclusively to individuals listed on the original calendar invite who attended the call. Workspace teammates not invited to the call cannot browse or search the transcript.
   • Teammates: Allows anyone in your Fireflies workspace to search and view the transcript. Suitable for open engineering standups, but dangerous for sensitive operational syncs.
   • Teammates & Anyone with Link: Generates a publicly accessible URL. Administrators should actively discourage or prohibit this tier for internal communications.
4. Prompt the system to apply this preference across historical meetings if an audit reveals past recordings were left exposed.

4. Automate Access and Retention via the Enterprise Rules Engine

On Enterprise subscriptions, administrators can leverage the Rules Engine to systematically enforce compliance across users without depending on manual user compliance. The Rules Engine acts as an automated governance layer that monitors metadata (organizer, attendee list, meeting title, meeting classification) and executes policy actions.

Automated Routing and Privacy Overrides

Administrators can configure conditional workflows that automatically lock down confidential conversations:

1. Go to Settings -> Team tab -> Rules on the left menu.
2. Click Create Rule and provide a descriptive name (e.g., HR & Exec Auto-Isolation).
3. Set your filters using Boolean logic:
   • Filter 1 (Meeting Type): Select Meeting Type Equals Internal.
   • Filter 2 (Host / Participants): Select Meeting Host Is any of [Executive Group, Legal Team] or Meeting Participants Is any of [HR Group].
   • Filter 3 (Title Keywords): Combine using OR logic to capture terms like Strategy, Compensation, or Audit.
4. Select the corresponding enforcement actions:
   • Enforce Meeting Privacy: Set to Only Owner or Participants, which overrides any lax permissions chosen by individual users.
   • Auto-route to Channels: Automatically move the session into a restricted Private Channel accessible only to certified personnel.
5. Test the rule using Test Rule against your workspace's last 10 meetings to verify matching accuracy without applying modifications, then click Save.

Automated Data Retention and Deletion Schedules

Indefinite storage of audio recordings and transcripts is a major corporate liability under GDPR data minimization mandates and legal discovery exposure. The Rules Engine allows admins to attach automated purge timers:

• In the rule builder action menu, select Auto-Delete Meetings.
• Choose a retention window: preset intervals of 24 hours, 7 days, 14 days, 30 days, or define a Custom retention schedule in hours or days.
• For high-risk calls (such as routine recruiter screening interviews or internal quarterly reviews), set an automated 30-day purge schedule. Once the window expires, Fireflies permanently deletes the raw recording, audio file, and transcript.

For regulated industries (such as healthcare under HIPAA or education under FERPA), organizations on Enterprise plans should execute a Business Associate Agreement (BAA) or Data Sharing Agreement (DSA) and configure Private Storage (dedicated AWS S3 storage buckets in designated geographic regions).

5. In-Meeting Controls and Video Platform Defenses

Administrative software settings inside Fireflies represent only one side of the security posture. IT teams must also configure the underlying conferencing infrastructure (Zoom, Microsoft Teams, Google Meet) to ensure hosts can identify and block automated recording bots before audio capture begins.

The Waiting Room Barrier

Fireflies follows a strict technical constraint: joining a meeting does not equal capturing it. Even if a calendar integration dispatches Fred to a video call, the notetaker must be admitted past the meeting lobby or waiting room before audio ingestion begins:

• Enforce Waiting Rooms Globally: Configure your Zoom, Teams, or Google Meet admin tenant to enforce waiting rooms for all internal meetings.
• Instruct Hosts on Vetting: Train personnel that if Fireflies Notetaker or an unrecognized attendee appears in the waiting room during an unscheduled or private discussion, the host must deny entry or leave the bot in the lobby.

Platform-Level Domain Blocking (Zoom Admin)

For executive offices or legal units where Fireflies should never record under any circumstances, administrators can block bot access at the conferencing gateway:

1. Log in to the Zoom Web Portal as an account administrator.
2. Navigate to Account Management -> Account Settings -> Security.
3. Locate the setting Block users in specific domains from joining meetings.
4. Add fireflies.ai to the blocklist.
5. This technical control prevents any Fireflies bot from entering meetings hosted under the organization's Zoom tenant, irrespective of calendar configurations.

Emergency In-Meeting Ejection

If an employee mistakenly admits Fireflies into a confidential call, meeting participants can expel the bot instantly using three methods:

1. In-Meeting Chat Command: Type /ff leave into the meeting public text chat. The bot recognizes the text command and immediately disconnects from the session.
2. Conferencing Participant Panel: The host or co-host can open the participant roster, click the three dots (...) next to Fireflies Notetaker, and select Remove / Remove from call. If the bot is ejected within the first three minutes of the call, Fireflies drops the session without generating a transcript.
3. Dashboard Live Banner: The meeting owner can open their Fireflies dashboard and click the red Stop icon on the live meeting status banner.

Summary Implementation Checklist for IT Administrators

To achieve a defensible, privacy-first Fireflies deployment, execute this administrative rollout sequence:

1. Lock Team Join Defaults: Set Team Settings -> Recording & Privacy -> Auto-record meetings to Record meetings with external participants or Only when invited.
2. Restrict Email Recaps: Set Meeting recap email to Only participants from my Fireflies team or Only me.
3. Harden Default Visibility: Change workspace Meeting privacy from Teammates & Anyone with Link to Only Owner or Participants.
4. Deploy Title and Domain Blacklists: Add standard sensitive keywords (1:1, Confidential, Board, Compensation) and internal legal/HR domains into Restriction Rules.
5. Configure Enterprise Rules: Build automated routing rules in the Rules Engine to isolate internal executive meetings into Private Channels and set auto-delete retention limits (e.g., 30-day purge).
6. Activate Platform Defenses: Mandate video waiting rooms and educate teams on the /ff leave ejection command.

By combining centralized workspace policies with proactive calendar filtering and automated retention lifecycles, enterprise IT teams can harness the productivity gains of AI transcription while guaranteeing that sensitive corporate discussions remain confidential.

References

• Why Is Fireflies Joining or Skipping My Meetings? Fix Auto-Join Settings | Fireflies Knowledge Base
• How to Use Recording Rules to Make Fireflies Record or Skip Specific Meetings | Fireflies Knowledge Base
• How to Control Autojoin and Email Settings for Teammates | Fireflies Knowledge Base
• How to control who gets meeting recaps (Email Settings) and who can view them on Fireflies (Privacy Settings) | Fireflies Knowledge Base
• Fireflies Rules Engine: Automatically route, share, and control meeting visibility | Fireflies Knowledge Base
• Learn About Post-Meeting Admin Controls for Team Meetings | Fireflies Knowledge Base
• How Fireflies.ai keeps your information safe | Fireflies Knowledge Base
• Fireflies Trust Center
• Privacy Policy | Fireflies.ai