| name | granola-security-basics |
| description | Security and privacy configuration for Granola meeting data.
Use when reviewing data handling practices, configuring encryption,
ensuring SOC 2/GDPR compliance, or securing meeting recordings.
Trigger: "granola security", "granola privacy", "granola encryption",
"granola SOC 2", "granola GDPR", "secure granola".
|
| allowed-tools | Read, Write, Edit |
| version | 1.13.0 |
| license | MIT |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| tags | ["saas","granola","security","compliance","privacy"] |
| compatibility | Designed for Claude Code, also compatible with Codex and OpenClaw |
Granola Security Basics
Overview
Granola achieved SOC 2 Type 2 certification in July 2025. It encrypts data with AES-256 at rest and TLS 1.3 in transit. Audio is transcribed server-side and not stored after processing. This skill covers security configuration, compliance posture, and organizational controls.
Prerequisites
- Granola Business or Enterprise plan (for admin/security controls)
- Understanding of your organization's compliance requirements
- Admin access for workspace-level settings
Instructions
Step 1 — Understand Granola's Data Architecture
Audio Capture (your device)
│
├─→ Transmitted via TLS 1.3
│
▼
Granola Cloud (transcription)
│
├─→ Transcript generated (GPT-4o / Claude)
├─→ Audio DELETED after processing (not stored)
│
▼
Encrypted Storage (AES-256 at rest)
│
├─→ Meeting notes (your typed + AI enhanced)
├─→ Transcript text (stored, searchable)
├─→ Attendee metadata
│
▼
Your Device (local cache: cache-v3.json)
Key security properties:
- No bot joins your meeting — audio is captured locally via system audio
- Raw audio is never stored after transcription
- Granola does not allow OpenAI or Anthropic to train on customer data
- Enterprise plan enforces org-wide AI training opt-out by default
- Local cache (
cache-v3.json) contains meeting data on your device
Step 2 — Configure Account Security
| Control | How to Enable | Plan Required |
|---|
| Google/Microsoft SSO | Default (social login) | All |
| Enterprise SSO (Okta, Azure AD) | Settings > Security > SSO | Enterprise |
| SCIM provisioning | Settings > Security > SCIM | Enterprise |
| Session timeout | Settings > Security | Enterprise |
| IP allowlisting | Contact Granola support | Enterprise |
Step 3 — Configure Data Controls
Sharing defaults:
Settings > Privacy:
Default sharing: Private (recommended)
Auto-share with attendees: Off (enable per-folder instead)
External sharing: Disabled or Admin Approval Required
Public links: Disabled
Link expiration: 30 days (if external sharing enabled)
Data retention:
