Granola Security Basics Skill

Granola Security Basics

Overview

Granola achieved SOC 2 Type 2 certification in July 2025. It encrypts data with AES-256 at rest and TLS 1.3 in transit. Audio is transcribed server-side and not stored after processing. This skill covers security configuration, compliance posture, and organizational controls.

Prerequisites

Granola Business or Enterprise plan (for admin/security controls)
Understanding of your organization's compliance requirements
Admin access for workspace-level settings

Instructions

Step 1 — Understand Granola's Data Architecture

Audio Capture (your device)
  │
  ├─→ Transmitted via TLS 1.3
  │
  ▼
Granola Cloud (transcription)
  │
  ├─→ Transcript generated (GPT-4o / Claude)
  ├─→ Audio DELETED after processing (not stored)
  │
  ▼
Encrypted Storage (AES-256 at rest)
  │
  ├─→ Meeting notes (your typed + AI enhanced)
  ├─→ Transcript text (stored, searchable)
  ├─→ Attendee metadata
  │
  ▼
Your Device (local cache: cache-v3.json)

Key security properties:

No bot joins your meeting — audio is captured locally via system audio
Raw audio is never stored after transcription
Granola does not allow OpenAI or Anthropic to train on customer data
Enterprise plan enforces org-wide AI training opt-out by default
Local cache (cache-v3.json) contains meeting data on your device

Step 2 — Configure Account Security

| Control | How to Enable | Plan Required | |---------|--------------|---------------| | Google/Microsoft SSO | Default (social login) | All | | Enterprise SSO (Okta, Azure AD) | Settings > Security > SSO | Enterprise | | SCIM provisioning | Settings > Security > SCIM | Enterprise | | Session timeout | Settings > Security | Enterprise | | IP allowlisting | Contact Granola support | Enterprise |

Step 3 — Configure Data Controls

Sharing defaults:

Settings > Privacy:
  Default sharing: Private (recommended)
  Auto-share with attendees: Off (enable per-folder instead)
  External sharing: Disabled or Admin Approval Required
  Public links: Disabled
  Link expiration: 30 days (if external sharing enabled)

Data retention:

Settings > Data Retention:
  Meeting notes: Organization policy (1-2 years typical)
  Transcripts: 90 days (recommended for storage efficiency)
  Audio: Deleted after processing (Granola default, not configurable)

AI training opt-out:

Settings > Privacy > AI Training:
  Organization-wide opt-out: Enabled (Enterprise: enforced by default)

This ensures your meeting data is never used to train foundational models.

Step 4 — Meeting Recording Consent

Granola records audio from your device. You are responsible for informing meeting participants:

Legal requirements by jurisdiction:

One-party consent (US federal, most US states, UK): You can record if you are a participant
Two-party/all-party consent (California, Illinois, EU GDPR): All participants must be informed
Always recommended: Announce recording at meeting start or include notice in calendar invites

Calendar invite consent notice:

Note: This meeting will be recorded using Granola AI for note-taking
purposes. By joining, you consent to the recording and AI processing
of the discussion. Contact [your-email] to opt out.

Step 5 — Compliance Posture

| Framework | Granola Status | Evidence | |-----------|---------------|----------| | SOC 2 Type 2 | Certified (July 2025) | Available on request | | GDPR | Compliant | DPA available | | CCPA | Compliant | Privacy policy updated | | HIPAA | Not certified | Do not use for PHI without BAA | | ISO 27001 | Not certified | Covered by SOC 2 controls |

GDPR requirements you must implement:

Right of Access: Export user's data via Settings > Data > Export
Right to Erasure: Delete user's notes and request account deletion
Data Processing Agreement: Request DPA from Granola (required for EU data)
Subject Access Requests: 30-day response deadline

Step 6 — Sensitive Meeting Protocol

For confidential meetings (board discussions, HR, legal, M&A):

Before: Disable auto-recording for the meeting
During: Announce recording consent to all participants
After: Review and redact sensitive content before sharing
Sharing: Set link expiration, restrict to named recipients
Retention: Apply shorter retention (30 days) for sensitive workspaces

Output

Account secured with SSO and appropriate authentication
Sharing defaults configured per organizational policy
Data retention policies set per data type
Compliance posture documented and gaps identified
Sensitive meeting protocol established

Error Handling

| Error | Cause | Fix | |-------|-------|-----| | SSO login fails | SAML/OIDC misconfigured | Verify Entity ID and ACS URL with IdP | | Cannot disable external sharing | Individual override | Set workspace-level policy to override user settings | | Data export fails | Insufficient permissions | Request export access from workspace admin | | Consent notice ignored | Not in calendar template | Add to organization's default calendar template |

Local Cache Security

The local cache file (~/Library/Application Support/Granola/cache-v3.json) contains meeting data in plaintext. For sensitive environments:

Enable FileVault (macOS) or BitLocker (Windows) for disk encryption
Restrict file permissions: chmod 600 "$HOME/Library/Application Support/Granola/cache-v3.json"
Be aware that MCP servers and local scripts can read this file

Resources

Next Steps

Proceed to granola-prod-checklist for production rollout preparation.

Agent Skills: Granola Security Basics

Install this agent skill to your local

Skill Files