Otter.ai

1. 011 signup email show people creating Otter.ai accounts with their work address. Those accounts live outside Entra, so leaving the company does not close them. Move users to the enterprise tier with SSO, or add a mail flow rule that flags vendor signups to the security team.
2. 021 billing email mean someone is paying for Otter.ai personally and expensing or absorbing it. Consolidate onto a company license where data terms are negotiated.
3. 03Meeting bots capture every participant, including external parties. Confirm consent and recording policy allow it.

Metadata only: sender, recipient, subject, and time from Defender for Office 365. No mailbox content is read.

• ●Medium48Otter.aiNetwork4 people
• ●Medium37Otter.aiAudit log1 person
• ▲Critical85Otter.aiEntra consent3 people
• ●Medium29Otter.aiOkta (demo)4 people
• ◆High55Otter.aiGoogle Workspace (demo)3 people

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

1. vendor_email · Aug 18, 2026
   2 vendor emails from otter.ai to 1 person in 30 days: 1 signup, 0 login, 1 billing
   Detail

   {
     "byKind": {
       "login": 0,
       "other": 0,
       "signup": 1,
       "billing": 1
     },
     "subjects": [
       "Welcome to Otter.ai! Get started with OtterPilot",
       "Your Otter.ai Pro receipt"
     ],
     "senderDomains": [
       {
         "count": 2,
         "domain": "otter.ai"
       }
     ]
   }

2. mail_signup · Aug 17, 2026
   Signup: 'Welcome to Otter.ai! Get started with OtterPilot' to [email protected]
   Detail

   {
     "sender": "[email protected]",
     "messageId": "mail-0013"
   }

3. mail_billing · Aug 18, 2026
   Billing: 'Your Otter.ai Pro receipt' to [email protected]
   Detail

   {
     "sender": "[email protected]",
     "messageId": "mail-0014"
   }

4. corroboration
   Also found by another lane (consent:aaaa0001-0000-4000-8000-000000000001)
   Detail

   {
     "findingKey": "consent:aaaa0001-0000-4000-8000-000000000001"
   }

5. corroboration
   Also found by another lane (mdca:25017)
   Detail

   {
     "findingKey": "mdca:25017"
   }

6. corroboration
   Also found by another lane (ual:teams:f2f5d4b1-1c2a-4e7b-9a10-otterteams001)
   Detail

   {
     "findingKey": "ual:teams:f2f5d4b1-1c2a-4e7b-9a10-otterteams001"
   }