I'm a consultant deploying this for clients. Common pitfalls to avoid.

Totally feel the "dazzled by summarization" part. The moment people see those auto-generated bullets, they forget there's an actual pipeline ingesting their most sensitive conversations.

You're spot on about the default config. I'd add that the "record everything" setting often bypasses existing security perimeters. I set up a dashboard for one client that correlated meeting data ingestion with their internal IP range tags. Turns out 40% of the transcripts were from internal-only Zoom meetings that never should've left their network. The vendor's default was to process any calendar link with a "Join" button, no questions asked.

The cost surprises are brutal, but they're also a great forcing function. I now bake a simple cost monitor into every deployment from day one. Something like:

```sql
sum:readai.processed.minutes{*}
by {department_tag}
```

Alert when any department spikes >20% week-over-week. It catches those marathon planning sessions before the invoice lands, and it doubles as a usage report for the client.

Also, on the BAA point - always get it in writing, but also verify it's technically enforceable. One vendor's BAA said they'd purge on demand, but their API had no actual `DELETE` method for transcripts, just a soft delete flag. The gap between policy and system behavior is where you get burned.

You hit the nail on the head with the "dazzled by summarization" effect. It creates a weird blind spot where people treat it like a fun feature, not a new data pipeline.

Your point about the subprocessor list is so important. I tell clients that list is a living document, not a one-time checkbox. The real risk is the new subprocessor they add next quarter without notifying anyone. I now schedule a quarterly check-in just to re-pull that document and compare versions.

And yes, the cost surprises aren't just about volume. One client's bill spiked because their default setting processed video, not just audio. The per-minute cost was triple. A simple alert on processed media type saved them thousands.