Does Fathom Work in China? Meeting Recordings, PIPL & Data Residency
Fathom records, transcribes and summarizes your video meetings and stores all of it in the United States, with no mainland-China region. Recording a participant who joins from inside China, and keeping it offshore, is a PIPL cross-border transfer of personal data — and a data-residency question, not a speed one. A compliance-first look.
Does Fathom work in China?
Whether you can use Fathom for mainland China is first a personal-data and data-residency question, not a speed one. Fathom records, transcribes and summarizes your meetings — so the moment a participant joins from inside China, you are recording that person's personal data and sending it offshore.
In Fathom's own Help Center, "All Fathom data is stored in the United States," and Fathom describes itself as "HIPAA, SOC2 Type II, and GDPR-compliant" — United States and EU/UK regimes, with no mainland-China region named. A recording or transcript of a China-based participant is their personal information, and a meeting can surface sensitive details — health, finances, a person's own voice — so keeping it in the US is a cross-border transfer PIPL governs (notice, separate consent and a transfer mechanism, Articles 38–43), with an in-country storage duty for a CIIO or large-volume handler (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). The table below is Fathom's own wording and the rule each line triggers.
This is a risk map, not a verdict — what you owe turns on who your participants are, how sensitive your meetings get and your data volumes, and it's worth settling with counsel. Our China team can map your exposure with you →
Compliance snapshot
- ! Fathom records, transcribes and summarizes your video meetings — a recording of a mainland participant is that person's personal data
- ! A recording or transcript can carry sensitive personal information — health, finances, a person's own voice — where PIPL's stricter rules attach
- ✕ By Fathom's own words, "All Fathom data is stored in the United States" — it names no mainland-China region
- ! Recording mainland participants and keeping it in the US is a PIPL cross-border transfer — notice, separate consent and a mechanism fall on you
- ! For a CIIO or large-volume handler, that data must stay in the mainland — an offshore recorder can't do that
What Fathom AI Notetaker's own documentation says about China
| Fact | Primary source |
|---|---|
| Fathom's job is to record your meetings. It is an AI notetaker that records, transcribes and summarizes your video calls — capturing each participant's voice and a written transcript of what they said into a recording Fathom stores for you. A recording of a real person, and a transcript of their words, is that person's personal information under Chinese law — so the instant a participant joins from inside the mainland, you are handling their personal data and sending it to Fathom. | Fathom — product overview (fathom.video), retrieved 2026-10-08 |
| Fathom states plainly where that data lives — and it is not China. In its own Help Center, under "Where do you store data?", Fathom says "All Fathom data is stored in the United States." The same page states Fathom "is HIPAA, SOC2 Type II, and GDPR-compliant and has passed extensive security reviews by Zoom," and offers a DPA "for users located in the EU/UK" — United States and EU/UK regimes, with no mainland-China region named anywhere. So your China participants' recordings, transcripts and summaries sit offshore. | Fathom Help Center — "Is Fathom secure?", retrieved 2026-10-08 |
| Recording a mainland participant and keeping it in the US is a cross-border transfer under PIPL. The audio, video and transcript of a China-based individual are personal information, and exporting them to Fathom's United States storage is a cross-border transfer governed by PIPL: the personal-information handler — you, Fathom's customer, not Fathom — must give notice, obtain separate consent from each person recorded, and satisfy one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification), under Articles 38–43. | PIPL Chapter III, Articles 38–43 |
| Meeting recordings can carry sensitive personal information — and for some handlers the data must stay in China. What gets said in a meeting can include health, financial or other sensitive details, and a voice recording is itself a biometric trace; PIPL attaches stricter necessity and separate-consent duties to sensitive personal information wherever it appears. And where the handler is a critical information infrastructure operator or moves personal information at volume, personal information collected in China must be stored inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty a US-only recorder cannot meet, and one no setting inside Fathom changes. | PIPL Article 28 (sensitive PI), Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-08.
For a mainland-China audience, the deciding question about Fathom is not how quickly its summaries come back — it is whose voice and words have to leave the country for those notes to exist. Fathom is an AI meeting notetaker, and the way it works is by recording you: it captures the audio and video of a call, transcribes what everyone said, and stores that recording and its summary for you to revisit. Invite a colleague, customer or candidate who joins from inside China, and you are recording that person’s personal data and shipping it offshore — something China’s privacy law governs directly. Whether Fathom’s app happens to connect cleanly from a given mainland line is a delivery detail; where the recordings are stored, and what they capture, is the exposure.
Fathom in China at a glance
| What decides it | In Fathom's own terms |
|---|---|
| What it records | Fathom records, transcribes and summarizes your video meetings — the audio and video of a call, plus a written transcript of what each participant said, stored as a recording you revisit. A recording of a real person is their personal data. |
| What it can contain | Because it captures whatever is discussed, a recording or transcript can hold sensitive personal information — a health or financial detail, or a person's own voice as a biometric trace. PIPL attaches stricter necessity and separate-consent duties to sensitive personal information. |
| Where it's stored | In Fathom's own Help Center, “All Fathom data is stored in the United States.” No mainland-China region is named, so your China participants' recordings sit offshore. |
| Which regimes it names | Fathom states it is “HIPAA, SOC2 Type II, and GDPR-compliant” and will sign a DPA “for users located in the EU/UK” — United States and EU/UK rules. China's PIPL is named nowhere. |
| The residency rule | Recording China participants and storing it in the US is a cross-border transfer under PIPL (notice, separate consent, a transfer mechanism); CIIOs and large-volume handlers must store it in the mainland — which a US-only Fathom cannot do. |
A meeting recording is personal data — and it can be sensitive
Fathom doesn’t wait for you to write anything up — the recording is the data collection. It captures a call’s audio and video and turns it into a transcript and summary, so what it stores is a reconstruction of who was in the meeting and exactly what each person said. A recording of a real individual, and a transcript of their words, is personal information under China’s law — and because a meeting can wander into anything, that record can carry sensitive personal information: a health update, a salary or bank detail, a person’s own voice captured as a biometric trace. PIPL singles sensitive personal information out for stricter treatment — a necessity test and separate, specific consent — wherever it appears. So the moment a mainland participant is recorded, you are handling their personal data, sometimes at its most sensitive, and handling it by sending it to Fathom.
The recordings are stored in the United States — outside the mainland
Asked plainly where it keeps this data, Fathom answers in its Help Center: “All Fathom data is stored in the United States.” The same page describes Fathom as “HIPAA, SOC2 Type II, and GDPR-compliant” and offers to sign a DPA “for users located in the EU/UK” — it is built around United States and European rules, and it names no region inside mainland China. So your China participants’ recordings, transcripts and summaries live on United States infrastructure. Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — you, not Fathom — must give notice, obtain separate consent from each person recorded, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification, under Articles 38–43. For a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty a United States-only service cannot meet, and one no account setting inside Fathom changes. A public-facing presence actually served from inside China would separately need an ICP filing bound to a mainland host.
US and EU audits are real — but they aren’t a China answer
Fathom’s compliance posture is genuine and worth stating: HIPAA, SOC 2 Type II and GDPR are serious regimes, and passing Zoom’s security reviews is not nothing. But each of those names a jurisdiction that is not China. SOC 2 is a United States auditing standard; HIPAA is United States health-privacy law; GDPR is the EU and UK regime Fathom will sign a DPA for. None of them speaks to PIPL’s transfer, separate-consent and data-residency rules, and a US or EU attestation does not stand in for them. This is the half of the question an offshore tool cannot certify its way out of: where the recordings live, and under whose law they crossed the border.
Whether the app connects is not what decides it
Fathom runs as an offshore service your meeting joins and your recordings stream back to. Whether its app and stored recordings load cleanly from any given mainland line is a delivery question — real for a team that leans on it day to day, but not the one that decides whether you may use it. Even on the calls where everything connects perfectly, it connects in order to carry your participants’ recordings out of the country; a steadier path would only export that data more reliably, not make the transfer lawful. The half that settles whether Fathom is usable for China is the legal one — what the recordings capture, where they are stored, and under what mechanism they leave the mainland — not the network one.
This is a risk map, not a verdict: whether you owe separate consent, a transfer mechanism, in-country storage, stricter handling for sensitive data, or all of them turns on who your participants are, how sensitive your meetings get, your data volumes and your role as handler — worth settling with counsel before you rely on it.
Where 21YunBox fits — a compliant overlay, not a migration
You keep using Fathom exactly as you do now. What we add is the piece Fathom leaves to you: a clear read of where your mainland participants’ recordings travel today, and — where the law requires your China users’ data to stay onshore — the ICP-filed, in-country delivery and storage a United States-only recorder cannot provide, set in front of the rest of your stack with no rebuild and no second codebase. Our China team weighs your PIPL cross-border and data-residency duties against your entity and your data volumes, then stands up the lawful, in-mainland foundation a compliant China presence needs, while Fathom and the rest of your tools keep running where they already are.
Related reading:
Frequently Asked Questions
Does Fathom store mainland-China meeting recordings in China?
No. By Fathom's own Help Center, "All Fathom data is stored in the United States." A recording or transcript of a participant who joined from the mainland, held in the US, is a cross-border transfer of personal information under PIPL — so the handler (you, not Fathom) owes notice, separate consent from each person recorded, and a transfer mechanism. Fathom names no mainland-China region to keep that data onshore.
Fathom is SOC 2 Type II and HIPAA compliant — isn't that enough for China?
Those are a US auditing standard (SOC 2), a US health-privacy law (HIPAA) and the EU/UK regime (GDPR) — Fathom names all three, and China's PIPL is not among them. Compliance in China turns on where the data lives and on the transfer, consent and residency rules, not on a US or EU attestation. The certifications are real and worth having; they just don't answer the China question. Treat it as a risk to work through with counsel.
Can 21YunBox help make our Fathom setup work in China?
Yes. Our China team can map your exposure — the PIPL cross-border and data-residency obligations that attach to recording mainland participants, for your entity, data volumes and how sensitive your meetings get — and, where the law requires your China users' data to stay onshore, stand up the ICP-filed, in-country delivery and storage an offshore recorder can't provide, in front of the rest of your stack. Get in touch to work through your specific case.
