Circleback vs Fireflies.ai

Circleback 77

Graded on the hosted REST API and MCP server with the hosted lines. incident.io status page at status.circleback.ai with four components, none of them the API (20). Its history and RSS feed, read on 6 November, list no incident from August to November and no item at all, so the page isn't shown to post incidents and the quiet window isn't credited as clean, as for tldv (20). Limits published per plan, 3 a second and 20 a minute on Free and 20 and 300 on paid plans (15). 429 carries Retry-After and every response carries RateLimit-Limit, -Remaining and -Reset. No idempotency key or safe-retry guidance for writes (12 of 15). No SLA found in the Terms or on the pricing page (0). The API has no beta label (10). 20+20+15+12+0+10 = 77.

Fireflies.ai 60

Graded on the hosted GraphQL API and MCP server. status.fireflies.ai answered on 8 October with a Freshservice status page (20, per the 8 October check). On 3 November 2026 its robots.txt disallows every path, so nothing else was requested, and the page drew its components and 90-day record only in a browser even then, so no part of the window has been read (5). Limits are published with numbers, Free 30 a minute and 500 a day, Pro 60 a minute and 5,000 a day, Business and Enterprise 60 a minute per paid seat pooled across the team, plus per-mutation limits (15). Since changelog 2.28.0 a 429 carries Retry-After in seconds with X-RateLimit-* headers, and the limits page says to wait that long before retrying. No idempotency keys or safe-retry guidance for writes were found (10). No SLA found in the terms or on the pricing page (0). The API and MCP server carry no beta label, though the Realtime API, audit events and two MCP tools do (10). 20 + 5 + 15 + 10 + 0 + 10 = 60.

Circleback 61

OAuth with dynamic client registration and two scopes on MCP, and API keys that are read-only or read and write, shown once (28 of 30). Read-only keys and a read-only MCP scope, and only an owner can delete a meeting. No confirmation step on the API for shares or deletes (14 of 20). Transcripts, notes and emails are participant-written text, and no prompt-injection guidance was found (0). A usage dashboard for workspace admins and meeting access requests, with no audit log of API or MCP calls found (4 of 15). SOC 2 Type II, EU-U.S. Data Privacy Framework certification, HIPAA, an external penetration test report on the security portal and a valid security.txt. No bug bounty found (15 of 20). 28+14+0+4+15 = 61.

Fireflies.ai 51

The MCP server uses OAuth with S256 PKCE, dynamic client registration and a revocation endpoint, but its scopes are only profile and email. The API takes one key per user with that user's full access, and rotation was not found in the docs (18). Access follows the user's role, and sharing or deleting needs the meeting owner or a team admin. No read-only mode and no confirmation step for writes such as sharing a transcript by email (8). Transcripts are untrusted speech and no injection guidance was found (0). An OCSF audit events query exists, in beta and on Enterprise only (9). SOC 2 Type II, GDPR, HIPAA and ISO 42001 claims, a Vanta trust centre and a HackerOne bounty by invitation, with no security.txt (16).