Granola security and compliance for IT review: SOC 2 Type 2, GDPR, HIPAA and the EU AI Act

TL;DR: Granola is SOC 2 Type 2 certified (July 2025), complies with GDPR and UK GDPR with a standard DPA, and supports HIPAA with a BAA on Enterprise. It is aligned with the EU AI Act. Data is stored on AWS in the United States and encrypted at rest and in transit. Meeting audio isn't kept after transcription. Third-party AI providers are never allowed to train on your data. Granola may use anonymized data to improve its own models on Basic and Business until you opt out, and Enterprise has that off by default. Whichever tool you review, check for SOC 2 Type 2 (not just Type 1), a GDPR deletion process, and a clear AI training policy.

AI notetaking tools routinely clear product and engineering reviews, then stall when they reach security. The bottleneck is almost always the same question: "Where does the audio go?" The questions that follow are just as predictable: which certifications the vendor holds, where the data is stored, who can see the notes, and whether anyone trains AI models on them.

This guide covers the specific compliance standards your security team will ask about, from SOC 2 Type 2 to GDPR data deletion, HIPAA and the EU AI Act. It answers each one with what Granola has today and where to verify it, and gives you a copy-paste email template to send directly to your CISO.

Granola security and compliance at a glance

Use this table as the short answer for a vendor review. Each row is covered in more detail below.

The compliance checklist: SOC 2, GDPR, HIPAA, the EU AI Act and data residency

Granola holds SOC 2 Type 2 certification and is GDPR compliant. The Granola security page covers encryption, storage and the full data lifecycle, and Granola's Trust Center holds the SOC 2 report and the subprocessor list.

SOC 2 Type 2 vs. Type 1: Why the type matters

Many vendors advertise "SOC 2 compliant" without specifying the type. The difference matters. A Type 1 audit assesses the design of security controls at a single point in time, while a Type 2 audit tests whether those controls operate effectively over six to twelve months. Type 2 is the meaningful standard: it demonstrates that security practices are consistent, not just that a policy document was written.

Granola achieved SOC 2 Type 2 certification in July 2025. Your security team can request the full report through the Trust Center by clicking "Request Access". When they read it, the details worth checking are the observation period, the date the report was issued, and which Trust Services Criteria are in scope.

GDPR, UK GDPR and the right to be forgotten

GDPR's right to erasure matters when your meetings include people in the EU or the UK, or involve EU or UK personal data. When discussing tool selection with your security team, the relevant question is whether the architecture supports individual note deletion and avoids persistent audio storage that would create a secondary deletion burden.

Granola complies with GDPR and UK GDPR. Its standard Data Processing Addendum incorporates the EU and UK Standard Contractual Clauses. Your organization acts as the data controller and Granola acts as the data processor.

Granola does not retain meeting audio. It transcribes in real time on macOS and Windows. Your trainscript and notes remain available, and you can delete them individually or in full. This approach supports GDPR compliance by ensuring that audio recordings are not retained after transcription.

For EU-based teams, the practical test of a GDPR-compliant AI notetaker is simple: can you delete a participant's data on request, and does the tool avoid storing raw audio you would otherwise have to hunt down? Granola meets both. You can also export your notes, summaries and transcripts in a machine-readable format, which may help support data portability requests.

Data residency: Where Granola stores your data

All Granola data is stored on Amazon Web Services (AWS) servers in the United States, encrypted at rest and in transit, and backed up daily. Your notes are also cached on your device so you can open them quickly, including offline. Granola doesn't offer EU, UK or other regional data residency today. Transfers from the EU and UK are covered by the Standard Contractual Clauses in the DPA. If regional storage is a hard requirement for your organization, check current options with Granola's sales team before you deploy.

HIPAA and BAAs

Granola supports HIPAA on the Enterprise plan and can sign a Business Associate Agreement (BAA). HIPAA support isn't available on the Basic or Business plans, so those accounts shouldn't be used for protected health information. The BAA currently covers the Granola desktop apps. For what a BAA does and doesn't cover, read HIPAA compliant AI transcription. For retention windows, redaction and deletion, read Granola for regulated teams.

EU AI Act

Granola is aligned with the EU AI Act for responsible, transparent AI use. Transparency is built into the product: Granola can post a message in the meeting chat and show a watermark on your video so everyone in a Zoom, Google Meet or Microsoft Teams call knows it's transcribing, and Enterprise admins can turn these on for the whole workspace.

AI training: The question most teams forget to ask

The most overlooked compliance question is whether the vendor trains their AI models on your meeting content. Meeting transcripts often hold customer details, plans and personal data that should not feed a public model.

Granola does not allow any third-party providers to train models on your data. For Enterprise accounts, Granola's own model training is turned off by default for everyone in the organization. On the Basic and Business plans, Granola may use anonymized data to improve its models until you opt out. Individual users on all plans can opt out in Settings. Granola's Security, Privacy and Data FAQs cover retention, deletion, encryption in transit and at rest, and subprocessor details.

How Granola protects your data

These are the controls security teams ask about most, as Granola documents them on its security page and in its Help Center.

• Encryption: Data is encrypted at rest, and all communications use TLS encryption (HTTPS).
• Infrastructure: Firewalls and virtual private cloud (VPC) configurations, with audit logging across the infrastructure. Data is backed up daily.
• Penetration testing: Granola runs penetration tests on a regular basis. Your security team can request the latest reports through the sales team.
• Vulnerability disclosure: Granola maintains a public Vulnerability Disclosure Policy and publishes post-mortems of resolved security vulnerabilities. Researchers report issues to security@granola.so.
• Employee devices: Full disk encryption and anti-malware protection on all internal employee devices to ensure no internal systems are compromised.
• Who can see notes: Notes are private by default. Admins can't see your private notes, and Enterprise admins can set the maximum sharing level, for example by turning off public links.
• Deletion and export: Delete individual notes at any time. If you delete your account, all your data is removed from Granola's systems within 30 days.

Enterprise controls for IT

On the Enterprise plan, IT gets single sing-on (SSO) through SAML 2.0 or OIDC and SCIM provisioning. Both require at least 50 active workspace members or an Enterprise subscription with a minimum commitment of 50 seats. Supported identity providers include Okta, Miscrosoft Entra ID, and JumpCloud, with Google Workspace also available for SAML-based SSO.

Enterprise features also include domain management to bring free accounts under the company workspace, an admin dashboard, an audit API that sends workspace events to your security and compliance tools, and org-wide automatic transcript deletion policies. For details on how each control works, read Granola's admin controls or see the Enterprise plan.

How Granola supports consent in meetings

Granola helps here by keeping you in the conversation: because you are not writing everything down, you can listen closely, follow up on what participants say, and rely on the transcript and notes afterwards for accurate recall. Tell participants at the start that you are using Granola to transcribe the call.

Granola can also tell people for you. An automated chat message and a watermark on your video notify everyone in a Zoom, Google Meet or Microsoft Teams call that Granola is transcribing. Any user can turn them on, and Enterprise admins can turn them on for the whole workspace. For scripts and what to do when someone says no, read meeting consent and transparency with Granola.

How Granola handles compliance

Granola is an AI notepad. It runs on your laptop or phone and uses your device's audio to generate notes, which shapes how it handles data and what your security team will need to review.

You start Granola for each meeting yourself, and it won't auto-join or start transcribing on its own. Transcription and AI summaries use secure cloud processing, while your notes and meeting history are also cached on your device for fast, offline access.

This architecture matters for compliance in three ways:

• Consent control: You decide when Granola starts transcribing, so you can get explicit participant consent before triggering the tool.
• No audio retention: Granola transcribes in real time and discards the audio file. Your AI-enhanced notes are built from the transcript, not a stored recording.
• GDPR deletion: Because there is no audio file to locate and delete, responding to a right-to-be-forgotten request means deleting the transcript and notes, which you can delete directly.

The Granola security documentation covers encryption in transit and at rest, subprocessors, and the full data lifecycle. If you want the broader vetting angle, our buyer's safety checklist for recording meetings with AI tools walks through the same questions for any meeting.

"With Granola I don't have to worry anymore about taking meeting notes, I can just write down things I really care about and let Granola take care of the rest." - Jess M. on G2

Questions to ask any SOC 2 and GDPR compliant AI notetaker vendor

Ask every vendor the same questions and compare the answers in writing. Granola's answers are in the right-hand column.

Ask each vendor how long audio is retained, whether model training is on by default, and what their deletion process looks like, then bring those answers to your security team.

"I use it for nearly every call to stay focused on the conversation instead of scribbling notes. The follow-up action items are especially useful." - Verified user on G2

Template: How to pitch a compliant AI notepad to your security team

Send this email after you have tested Granola yourself and confirmed it fits your workflow, typically before requesting budget approval or rolling out to your team. Copy and adapt the following:

Subject: Security review: Granola AI notepad for our team (SOC 2 Type 2, GDPR, HIPAA and EU AI Act)

Hi [Name],

I'd like to request a security review for Granola, an AI notepad I'm evaluating for our team. Below are the key data points I anticipate you'll need.

What it does: Granola runs on my laptop or phone and uses the device's audio to generate notes. It captures what I hear through my computer's audio output, then generates enhanced notes from the transcript. Transcription and summaries are processed in the cloud, and data is stored on AWS in the United States, encrypted at rest and in transit. I tell participants at the start of each call that I am using Granola to transcribe the call.

Compliance status:

• SOC 2 Type 2 certified (July 2025). The full report and subprocessor list are available through the Trust Center at trust.granola.ai.
• GDPR and UK GDPR compliant with data deletion capability on request. Standard DPA with EU and UK Standard Contractual Clauses
• HIPAA supported on the Enterprise plan with a signed BAA.
• Aligned with the EU AI Act.
• No audio retention: audio is discarded after transcription. Only the transcript and notes persist.

AI training: Granola does not allow any third-party providers to train models on customer data. On Basic and Business, Granola may use anonymized data to improve its own models until the user opts out. Enterprise accounts have model training off by default, enforced organization-wide.

Consent: I control when transcription starts. I can obtain explicit participant consent before triggering the tool, which is our standard practice for all meetings. Granola can also post a chat message and show a watermark so everyone in the call knows it's transcribing.

Access to documentation: Security FAQ: docs.granola.ai/help-center/consent-security-privacy/security-privacy-data-faqs. DPA: go.granola.so/dpa. Security overview: granola.ai/security.

"Their team has made themselves available via Slack or email and are incredibly responsive, proactive and engaging with their user base." - Andy C. on G2

The compliance conversation with Legal becomes simpler when you can answer four questions upfront: where does the audio go (it is discarded), where is the data stored (AWS in the United States), who trains on the data (third parties never, and Granola's own training is off by default on Enterprise), and what happens if a participant requests deletion (transcript and notes are deleted on request).

Take Granola through your security review

Send the email template above after you have tested the tool yourself. Download the Mac, Windows, iPhone or Android app, connect your calendar, and run your next meeting. Stay focused on the conversation, and your notes are enhanced the moment the call ends. If Granola fits your workflow, you will have the compliance answers your security team needs already prepared. For SSO, SCIM, HIPAA and org-wide controls, talk to the team about Granola for Enterprise.

Frequently asked questions

Is Granola SOC 2 compliant?

Yes. Granola is SOC 2 Type 2 certified as of July 2025. The full report is available through Granola's Trust Center, where your security team can request access. The Granola security page covers the rest of its security practices.

Is Granola GDPR compliant?

Yes. Granola is GDPR and UK GDPR compliant and offers a Data Processing Addendum that incorporates the EU and UK Standard Contractual Clauses. Because Granola discards meeting audio after transcription, a right-to-be-forgotten request is handled by deleting the transcript and notes, with no stored recording to locate.

Is Granola secure and safe to use?

Yes. Granola is SOC 2 Type 2 certified, encrypts data at rest and in transit, and doesn't keep meeting audio after transcription. Notes are private by default. Third-party AI providers are never allowed to train on your data, and you can opt out of Granola's own model training at any time. Enterprise has it off by default. Let participants know you're using Granola, and turn on its chat message or watermark to notify them.

Does Granola train AI on your meeting data?

It depends on the plan. On Basic and Business, Granola may use anonymized data to improve its own models until you opt out, and individual users can opt out in Settings. On Enterprise, model training is off by default for everyone in the organization. Third-party AI providers are never allowed to train on your data on any plan.

Can EU and UK teams use Granola?

Yes. Granola is GDPR and UK GDPR compliant and supports individual note and transcript deletion on request. Data is stored in the United States, and transfers are covered by the Standard Contractual Clauses in Granola's DPA. Confirming participant consent before you start transcribing remains your responsibility, which Granola makes straightforward because you control when transcription begins.

Is Granola HIPAA compliant?

Yes, on the Enterprise plan. Granola can sign a Business Associate Agreement (BAA), which currently covers the desktop apps. HIPAA isn't available on the Basic or Business plans, and those accounts shouldn't be used for protected health information.

Where does Granola store my data?

On AWS servers in the United States, encrypted at rest and in transit. Granola doesn't offer EU or UK data residency today. Your notes are also cached on your device for quick, offline access, and meeting audio isn't kept after transcription.

Can my employer or admin see my Granola notes?

Notes are private by default and admins can't see your private notes. Others see a note only if you share it or add it to a team folder. Enterprise admins can limit how notes are shared, for example by turning off public links.

Does Granola have ISO 27001 certification?

Not yet. Granola holds SOC 2 Type 2, and its Trust Center lists all current certifications.

Key terms

Temporary speech-to-text data: Microsoft's term for the transcript Teams generates internally during a meeting to support Copilot real-time assistance. It is deleted when the meeting ends and is never saved to OneDrive or accessible after the call in "Only during the meeting" mode without transcription.

Device audio capture: The method Granola uses to transcribe meetings. Captures audio directly from your device's microphone (your voice) and system audio (other participants) and transcribes in real time, then deletes the audio.

SOC 2 Type 2: An independent security audit certification covering how a software company manages customer data over time.