Granola Security Basics

Granola Security Basics

Overview

Granola achieved SOC 2 Type 2 certification in July 2025. It encrypts data with AES-256 at rest and TLS 1.3 in transit. Audio is transcribed server-side and not stored after processing. This skill covers security configuration, compliance posture, and organizational controls.

Prerequisites

• Granola Business or Enterprise plan (for admin/security controls)
• Understanding of your organization's compliance requirements
• Admin access for workspace-level settings

Instructions

Step 1 — Understand Granola's Data Architecture

Audio Capture (your device)
  │
  ├─→ Transmitted via TLS 1.3
  │
  ▼
Granola Cloud (transcription)
  │
  ├─→ Transcript generated (GPT-4o / Claude)
  ├─→ Audio DELETED after processing (not stored)
  │
  ▼
Encrypted Storage (AES-256 at rest)
  │
  ├─→ Meeting notes (your typed + AI enhanced)
  ├─→ Transcript text (stored, searchable)
  ├─→ Attendee metadata
  │
  ▼
Your Device (local cache: cache-v3.json)

Key security properties:

• No bot joins your meeting — audio is captured locally via system audio
• Raw audio is never stored after transcription
• Granola does not allow OpenAI or Anthropic to train on customer data
• Enterprise plan enforces org-wide AI training opt-out by default
• Local cache (cache-v3.json) contains meeting data on your device

Step 2 — Configure Account Security

Step 3 — Configure Data Controls

Sharing defaults:

Settings > Privacy:
  Default sharing: Private (recommended)
  Auto-share with attendees: Off (enable per-folder instead)
  External sharing: Disabled or Admin Approval Required
  Public links: Disabled
  Link expiration: 30 days (if external sharing enabled)

Data retention:

Settings > Data Retention:
  Meeting notes: Organization policy (1-2 years typical)
  Transcripts: 90 days (recommended for storage efficiency)
  Audio: Deleted after processing (Granola default, not configurable)

AI training opt-out:

Settings > Privacy > AI Training:
  Organization-wide opt-out: Enabled (Enterprise: enforced by default)

This ensures your meeting data is never used to train foundational models.

Step 4 — Meeting Recording Consent

Granola records audio from your device. You are responsible for informing meeting participants:

Legal requirements by jurisdiction:

• One-party consent (US federal, most US states, UK): You can record if you are a participant
• Two-party/all-party consent (California, Illinois, EU GDPR): All participants must be informed
• Always recommended: Announce recording at meeting start or include notice in calendar invites

Calendar invite consent notice:

Note: This meeting will be recorded using Granola AI for note-taking
purposes. By joining, you consent to the recording and AI processing
of the discussion. Contact [your-email] to opt out.

Step 5 — Compliance Posture

GDPR requirements you must implement:

• Right of Access: Export user's data via Settings > Data > Export
• Right to Erasure: Delete user's notes and request account deletion
• Data Processing Agreement: Request DPA from Granola (required for EU data)
• Subject Access Requests: 30-day response deadline

Step 6 — Sensitive Meeting Protocol

For confidential meetings (board discussions, HR, legal, M&A):

1. Before: Disable auto-recording for the meeting
2. During: Announce recording consent to all participants
3. After: Review and redact sensitive content before sharing
4. Sharing: Set link expiration, restrict to named recipients
5. Retention: Apply shorter retention (30 days) for sensitive workspaces

Output

• Account secured with SSO and appropriate authentication
• Sharing defaults configured per organizational policy
• Data retention policies set per data type
• Compliance posture documented and gaps identified
• Sensitive meeting protocol established

Error Handling

Local Cache Security

The local cache file (~/Library/Application Support/Granola/cache-v3.json) contains meeting data in plaintext. For sensitive environments:

• Enable FileVault (macOS) or BitLocker (Windows) for disk encryption
• Restrict file permissions: chmod 600 "$HOME/Library/Application Support/Granola/cache-v3.json"
• Be aware that MCP servers and local scripts can read this file

Examples

env=staging; integration=calendar-synthetic; secret_ref=connector-v12; consent=pass; signature=pass; retention=none; rollback=disabled records a control test without exposing a token or meeting payload.

Resources

• Granola Security Page
• Security Standards (Docs)
• Privacy & Data FAQs
• Data Processing Addendum

Next Steps

Proceed to granola-prod-checklist for production rollout preparation.