Granola AI security review — meeting notes under the microscope

Granola is a desktop application (macOS and Windows) and a mobile app (iOS, Android) that records meeting audio, transcribes it, and uses LLMs to generate structured notes. The key architectural facts:

• Local audio capture. Granola captures audio from your microphone and system audio output directly on the device. No bot joins the video call. Other participants do not see an additional attendee.
• Manual activation. Recording must be started manually by the user for each meeting. There is no auto-join or auto-record behaviour.
• Platform agnostic. Works with Zoom, Google Meet, Microsoft Teams, and any other meeting platform on desktop. Mobile is for in-person meetings.
• AI-enhanced notes. The user writes their own notes during the meeting. Granola uses the transcript to fill in context around the user's notes — a “notepad” model rather than a fully automated summariser.
• Granola Chat. A conversational interface that can query across all of a user's meeting history.

The “no bot” architecture is a meaningful security and trust differentiator — it eliminates the meeting-disruption concern — but it does not eliminate the data handling questions. Audio still leaves the device for transcription. Transcripts and notes still live in cloud infrastructure.

The most important question for any AI meeting tool is: what data is captured, where does it go, how long does it stay there, and who can access it? Here is what Granola's public documentation states:

Audio

On desktop (macOS/Windows), Granola transcribes audio in real time and states that it does not store the audio after transcription. On mobile, audio is “temporarily cached” and transcribed after the meeting ends, then deleted.

Transcripts

Transcripts are retained indefinitely by default. Enterprise plans offer configurable auto-deletion retention periods. On non-Enterprise plans, transcripts persist until the user manually deletes them or deletes their account.

Notes

Notes are stored in Granola's US-hosted AWS Virtual Private Cloud, encrypted at rest and in transit, with daily backups. Notes are also cached locally on the device for offline access.

Data residency

All data is stored in AWS US regions. Granola explicitly states they do not offer EU, UK, or other regional data residency options at this time. For organisations subject to data localisation requirements (Schrems II, sector-specific regulation), this is a hard constraint to evaluate against your data classification policy.

Granola's security page names four categories of third-party AI provider:

• Transcription: Deepgram and AssemblyAI are named as transcription providers.
• Summarisation / note enhancement: OpenAI and Anthropic are named as AI providers for generating structured notes.

Granola states that third-party providers (OpenAI, Anthropic) are contractually prohibited from using customer data to train their models. This is a contractual control, not a technical one — it depends on the terms of Granola's enterprise agreements with those providers.

Granola's docs mention the ability to “bring your own models” as a FAQ question on their security page, suggesting this may be available or planned for enterprise deployments. This is worth confirming — if your organisation requires that meeting content never leaves your own Azure OpenAI or AWS Bedrock deployment, BYOK is the only architecture that satisfies that requirement.

Model training

On Free and Business plans, anonymised data may be used for Granola's own model improvements by default. Users can opt out individually in settings. On Enterprise plans, admins can configure org-wide opt-out. Enterprise has model training turned off by default.

The key nuance: opting out is not retroactive. Granola states they “cannot guarantee that anonymised data wasn't used before you changed the setting.” For highly sensitive deployments, this means the Enterprise plan (training off by default) is the only clean-slate option.

Granola's access control model centres on workspaces, notes privacy, and sharing permissions:

Authentication

• Authentication is delegated to identity providers: Google OAuth or Microsoft authentication on all plans.
• SSO (SAML) is available on Enterprise plans for organisations with 50+ seats.
• No built-in 2FA/MFA — Granola relies on whatever MFA your identity provider enforces.
• No password management — authentication is fully delegated.

Note privacy

• Notes are private by default. Only the creator can see them until they choose to share.
• Admins cannot see individual users' private notes.
• Enterprise admins can set maximum sharing permissions (e.g., restrict public links) but cannot view private note content.

Sharing controls

• Users can share notes with specific colleagues or add them to team spaces/folders.
• Public links can be generated (and restricted by enterprise admins).
• An MCP integration with Claude and Cursor uses browser-based OAuth and only accesses notes the authenticated user has permission to view.

Meeting content is inherently PII-rich. A typical meeting transcript contains:

• Full names of all participants (via speaker attribution)
• Job titles, team names, and organisational structure
• Customer names, deal values, and business context
• Action items assigned to named individuals
• Potentially: health information, HR discussions, legal strategy, M&A details

Granola captures all of this by design — it is a meeting notes tool. The security question is not whether PII is captured (it is), but what controls exist around its lifecycle:

• Retention: Indefinite by default. Configurable auto-deletion only on Enterprise.
• Minimisation: Audio is deleted after transcription (good). But transcripts retain full verbatim content indefinitely (less good for minimisation).
• Subject access: GDPR Article 20 data portability is supported via email request.
• Third-party participant rights: Granola captures audio of all meeting participants, not just the Granola user. The other participants' data is processed based on the Granola user's account. This creates a data controller responsibility for your organisation regarding third-party participant data.

Here is what Granola's public documentation states about their compliance position:

SOC 2 Type II is a strong baseline — it means an independent auditor has verified that Granola's security controls operated effectively over a period of time, not just at a point-in-time snapshot. However, SOC 2 is not AI-specific assurance. It covers infrastructure security controls but does not assess model governance, AI-specific risks (hallucination, prompt injection), or the adequacy of AI training data handling.

Every vendor review surfaces questions that cannot be answered from public documentation alone. For Granola, these are the gaps a procurement team should close during the vendor conversation:

These gaps are not failures — Granola is a well-documented vendor by startup standards. But “well-documented for a startup” and “sufficient for enterprise procurement” are different bars. The Trust Center access request is the first step to closing most of these.

If you are evaluating Granola for enterprise deployment, here is the structured assessment path:

1. Request Trust Center access. Get the full SOC 2 Type II report and sub-processor list. Verify the observation period covers recent months, not a stale report from 12+ months ago.
2. Map the data flow. Trace meeting audio from capture → transcription provider → Granola servers → AI provider → stored note. Identify every hop where data leaves your organisational boundary.
3. Classify your meeting content. Not all meetings are equal. Board meetings, HR discussions, and M&A calls have different data classification than team standups. Define which meeting types are in scope for Granola and which require exclusion.
4. Evaluate the consent model. Since Granola has no visible bot, define your organisation's policy for informing participants. Consider jurisdiction-specific recording consent requirements (two-party consent states, GDPR lawful basis).
5. Confirm Enterprise controls. SSO enforcement, org-wide training opt-out, transcript retention policies, sharing restrictions. These are only available on the Enterprise plan — confirm pricing and minimum seat count (currently 50).
6. Assess data residency fit. US-only storage is a hard constraint. If you have EU data localisation requirements, evaluate whether the DPA with SCCs is sufficient for your risk appetite, or whether you need to wait for regional hosting.
7. Define re-assessment triggers. What changes would require you to re-review? Model provider change, new sub-processor, expansion of AI training scope, or a move from US-only to multi-region hosting.