Granola: security & AI-training scorecard
granola.ai ↗ · AI notetaker · Last checked Oct 16, 2026
Does Granola train AI on customer data?
Opt-out“Granola trains on your anonymized data so we can keep making Granola better. You can opt out of this in your Settings. Enterprise users have model training turned off by default.”
SOC 2
Independent audit of security controls. Type II covers operating effectiveness over a period.
Type II
“We've shown independent auditors that our security practices meet SOC 2 Type 2 standards”
ISO/IEC 27001
Certified information security management system.
Not verified from vendor-owned sources
Note: Not listed in trust center compliance section.
No vendor source found as of check date.
HIPAA / BAA
Whether the vendor will sign a Business Associate Agreement for PHI.
BAA available (Enterprise; desktop apps only)
“At this time, our BAA only covers the Granola desktop and laptop applications.”
GDPR DPA
Data Processing Agreement/Addendum for personal data.
DPA available on request
“We're committed to GDPR compliance and have a Data Processing Agreement available upon request”
Trains AI on customer data
Whether the vendor says it uses customer data to train AI models.
Opt-out
“Granola trains on your anonymized data so we can keep making Granola better. You can opt out of this in your Settings. Enterprise users have model training turned off by default.”
Data retention
What the vendor publishes about how long customer data is kept.
Audio not stored; account data retained while account active
“We do not retain or store such recordings once the transcription is created.”
Subprocessor list
Where the vendor lists third parties that process customer data.
All sources checked (3)
Fetched on Oct 16, 2026. Vendor pages can change after this date.
Is this wrong? / Claim this listing
Vendors and readers can send evidence links. Nothing is published without a source.
Informational only, not legal advice or an audit. Summaries reflect Granola's published pages as of Oct 16, 2026; verify with the vendor. Methodology & disclaimer.