granola-security-basics

name	granola-security-basics
description	Security and privacy configuration for Granola meeting data. Use when reviewing data handling practices, configuring encryption, ensuring SOC 2/GDPR compliance, or securing meeting recordings. Trigger: "granola security", "granola privacy", "granola encryption", "granola SOC 2", "granola GDPR", "secure granola".
allowed-tools	Read, Write, Edit
version	1.13.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","granola","security","compliance","privacy"]
compatibility	Designed for Claude Code

Granola Security Basics

Overview

Granola achieved SOC 2 Type 2 certification in July 2025. It encrypts data with AES-256 at rest and TLS 1.3 in transit. Audio is transcribed server-side and not stored after processing. This skill covers security configuration, compliance posture, and organizational controls.

Prerequisites

• Granola Business or Enterprise plan (for admin/security controls)
• Understanding of your organization's compliance requirements
• Admin access for workspace-level settings

Instructions

Step 1 — Understand Granola's Data Architecture

Audio Capture (your device)
  │
  ├─→ Transmitted via TLS 1.3
  │
  ▼
Granola Cloud (transcription)
  │
  ├─→ Transcript generated (GPT-4o / Claude)
  ├─→ Audio DELETED after processing (not stored)
  │
  ▼
Encrypted Storage (AES-256 at rest)
  │
  ├─→ Meeting notes (your typed + AI enhanced)
  ├─→ Transcript text (stored, searchable)
  ├─→ Attendee metadata
  │
  ▼
Your Device (local cache: cache-v3.json)

Key security properties:

• No bot joins your meeting — audio is captured locally via system audio
• Raw audio is never stored after transcription
• Granola does not allow OpenAI or Anthropic to train on customer data
• Enterprise plan enforces org-wide AI training opt-out by default
• Local cache (cache-v3.json) contains meeting data on your device

Step 2 — Configure Account Security

Control	How to Enable	Plan Required
Google/Microsoft SSO	Default (social login)	All
Enterprise SSO (Okta, Azure AD)	Settings > Security > SSO	Enterprise
SCIM provisioning	Settings > Security > SCIM	Enterprise
Session timeout	Settings > Security	Enterprise
IP allowlisting	Contact Granola support	Enterprise

Step 3 — Configure Data Controls

Sharing defaults:

Settings > Privacy:
  Default sharing: Private (recommended)
  Auto-share with attendees: Off (enable per-folder instead)
  External sharing: Disabled or Admin Approval Required
  Public links: Disabled
  Link expiration: 30 days (if external sharing enabled)

Data retention: