Where Granola runs: What happens on your device and what happens in the cloud

TL;DR: Where meeting audio ends up after a call is a compliance question most teams answer late. Granola captures audio on your device, transcribes it, then deletes the audio automatically, so the data that persists is text. Capture happens on your device. Transcription and AI summaries use secure cloud processing. Your notes and transcripts are stored encrypted in a US-hosted AWS environment. Granola is SOC 2 Type 2 certified.

Most teams spend significant time choosing AI notepads based on features and price, and far less time asking where meeting audio actually ends up after the call ends. That gap in due diligence creates compliance exposure that typically surfaces only when Legal or Security raises the question first.

Understanding where an AI notepad captures audio, where it processes it and what it keeps determines whether your meeting data is a controlled, auditable asset or a liability scattered across third-party servers that your team never explicitly approved. This guide explains what Granola does on your device, what it sends to the cloud, and what it stores.

Device capture vs. bot capture: What "local" really means

How device-level capture works

A device-level AI notepad typically captures audio directly from your computer's system audio layer. Transcription runs as audio arrives, converting speech to text, and the raw audio file is usually deleted immediately after the transcript is generated. In this architecture, no audio file is written to a vendor's cloud storage, and no recording sits on a third-party server awaiting a retention policy trigger.

Device capture is not the same as fully local processing. Some tools also run transcription and summaries on your own machine. Granola captures on the device and processes in the cloud.

Here’s how Granola's architecture works:

• It captures device audio and transcribes it using secure cloud processing, in real time on Mac and Windows.
• On iPhone and Android, transcription happens after the meeting from temporarily cached audio.
• It deletes the raw audio after transcription is complete. The resulting transcript and your enhanced notes are stored. The audio is not.

Granola runs on your laptop or phone and uses your device's audio to generate notes, so there is nothing to install into the call itself and capture does not depend on the meeting platform. Let the other participants know you are using Granola to transcribe the call. You start Granola yourself for each meeting, since it won't automatically start capturing your meeting audio, and its transparency features can post a chat message and show a video watermark so participants can see it is active.

How bot-based capture works

Many bot-based AI notetakers join your meeting as a bot participant. These tools typically capture audio continuously, send it to vendor servers for automatic speech recognition, separate speakers through diarization, run NLP models to extract summaries, and may store data on cloud infrastructure. Speaker diarization typically analyzes voice patterns to distinguish participants.

So the real difference is not simply whether the cloud is involved. Some device-level tools process audio locally, while Granola captures audio on the device and uses secure cloud processing. The key differences are how audio gets captured, where it is processed, and what is kept afterwards.

Device capture vs. bot capture: what each keeps

Where Granola processes and stores your data

Granola's data flow, step by step

Granola's data flow runs in five stages, from device capture through cloud processing and storage:

1. Capture, on your device: once you start it, Granola captures your microphone audio and your computer's meeting audio.
2. Transcription, using cloud processing: the audio is transcribed in real time on Mac and Windows, and after the meeting on mobile using temporarily cached audio.
3. Deletion: the audio is discarded once it has been transcribed. Granola doesn't retain meeting audio.
4. AI enhancement, using cloud AI services: your rough notes and the transcript are used to generate enhanced notes.
5. Storage: notes and transcripts are stored in Granola's US-hosted AWS Virtual Private Cloud, encrypted at rest and in transit and backed up daily.

The AI-enhanced notes feature takes any rough notes you jotted during the meeting and uses transcript context to expand them. Your notes stay in black. AI additions are visually distinguished. You decide what stays. This human-in-the-loop process means AI is enhancing your judgment, not replacing it.

Why audio deletion narrows what you review

Where audio files are stored on vendor infrastructure, they remain in scope for retention schedules, access reviews and breach assessments for as long as they are kept. Granola transcribes audio and then deletes the audio file, so the data that persists for review is text.

Where Granola stores data

Granola captures meeting audio on your device but does not retain audio recordings. Your transcript and enhanced notes are stored in Granola's US-hosted AWS environment, without a retained audio recording. This distinction matters for enterprise security and compliance reviews, while the US storage location matters separately for data residency requirements.

You can review Granola's security, privacy and data FAQ for specifics on storage, encryption, and subprocessor arrangements. If your organization requires data to be stored outside the US, read how AI notetaker data residency works before you start a review.

Protecting enterprise data & participant trust

Sensitive data exposure points

Research interviews routinely surface competitive intelligence, unreleased product feedback, personal health context in healthtech research, and candid stakeholder opinions.

For research involving protected health information (PHI), HIPAA-compliant workspaces and a Business Associate Agreement (BAA) are available through Granola's Enterprise plan. HIPAA support is not available on Basic or Business plans.

Retention, access and deletion policies for that material are what your security team will want documented, and Granola's Enterprise plan gives administrators configurable org-wide retention periods for transcripts.

Because transcription and summaries run in the cloud, subprocessor arrangements and access controls form part of what your security team reviews. Granola's security, privacy and data documentation sets out its subprocessor arrangements, encryption and retention controls for that review.

Vendor AI training data risks

Ask every vendor two questions: can third parties train their models on your meeting data, and does the vendor train its own models on it?

Granola does not allow third parties AI providers to use use your data to train their AI models. Granola may use aggregated and de-identified data derived from customer data to improve, test, train, and operate its products and services. Users can opt out in Settings, while Enterprise users have model training turned off by default.

Compliance requirements: SOC 2, GDPR, and HIPAA

What SOC 2 covers for an AI notepad

When your security team evaluates a new AI tool, they need to understand what data the vendor processes and retains, how that data is protected, and what security controls govern access to it. SOC 2 Type 2 evaluates whether a vendor's relevant security controls are suitably designed and operating effectively over time.

Data minimization still matters. When a tool does not retain meeting audio, there is less sensitive meeting content stored in the vendor's environment and less retained data for your security and compliance teams to govern. That can reduce the risks associated with audio retention, access, deletion, and potential exposure, even though the audio may still be processed temporarily.

Granola is SOC 2 Type 2 certified and GDPR compliant. Its current SOC 2 Type 2 report and security documentation are available through the Granola Trust Center.

GDPR data minimization for AI notepads

Security teams reviewing AI tools for research use will ask about GDPR data minimization. The question they're really asking is: does this tool collect more personal data than the research workflow requires?

GDPR requires organizations to collect only the personal data they need and not retain it for longer than necessary. In practice, that means your security reviewer will want to know what the tool stores, where, and for how long before they approve it.

Tools that store full audio recordings of research participants may create data retention obligations under GDPR. A tool that transcribes and deletes audio immediately does not retain the audio recording, leaving the transcript and notes as the meeting records that need to be governed under storage limitation requirements.

Granola's Enterprise plan includes org-wide auto-deletion periods, giving administrators a documented, configurable policy for transcript retention. That means when your security team asks "what's the retention policy," you have a specific, configurable answer rather than a vendor's blanket promise.

Organizations can contact Granola to ask about a Data Processing Agreement (DPA). Users who want their data deleted should consult Granola's current privacy documentation or contact support for information about available deletion options and applicable terms.

Securing HIPAA research data

Granola supports HIPAA-compliant workspaces on Enterprise, with a Business Associate Agreement (BAA) available through sales. HIPAA support and BAAs are not available on Basic or Business plans. You can review Granola's current HIPAA status in its HIPAA help article.

Why device capture helps protect your research data

Protecting confidential research data

Research interviews turn on details that are easy to lose: the offhand comment about a competitor, the hesitation before answering a pricing question, the admission that a workflow "sort of works but not really." Granola generates notes from your device's audio so you can stay in the conversation and follow up on those moments rather than writing them down, and you should tell participants you are using Granola to transcribe the call.

Other organizations weigh the same considerations beyond research contexts. Daversa Partners adopted Granola across 136 of 150 employees, with president Laura Kinder citing the firm's requirements around how data from confidential searches is stored and accessed.

Whether the conversation is a CEO search or a product discovery interview, the value is the same: a reliable record afterwards, so you can give the conversation your full attention while it is happening.

Granola's security documentation describes how it handles meeting audio and stored transcripts. Granola transcribes meeting audio and deletes it after transcription, while retaining transcripts and notes. For details of the certification and the controls covered, consult the current report available through the Granola Trust Center.

Safeguarding interview data privacy

Research teams running discovery interviews for product roadmaps need a repository that persists beyond individual tenures, surfaces patterns across dozens of sessions, and gives stakeholders searchable access to underlying evidence.

Granola's folder-level query capability lets you ask "What are the top UX friction points our enterprise customers mentioned this quarter?" and get citations from specific conversations, not just keyword hits.

"Granola nails exactly what I need: clean, reliable meeting transcripts and smart follow-up summaries without any fluff. I use it for nearly every call to stay focused on the conversation instead of scribbling notes." - Verified user on G2

Informing your AI notepad choice

Do privacy-focused AI notepads offer enterprise features?

The objection that "secure tools lack collaboration features" does not hold for Granola's current product. Business and Enterprise plans add integrations with Notion, HubSpot, Affinity, Attio, and Zapier, while Enterprise adds additional admin and API controls. Slack integration is available on every plan, including Basic. The Granola pricing overview details what each tier includes.

Model Context Protocol (MCP) support for connecting meeting notes to compatible AI tools and coding assistants is available on all plans, including Basic. Basic access is limited to the last 30 days and does not include transcript access. On Enterprise, MCP is turned off by default and an admin must enable it in Granola settings.

"With Granola I don't have to worry anymore about taking meeting notes, I can just write down things I really care about and let Granola take care of the rest. Love that I can easily share my notes with my colleagues as well, and that we can all chat with the meeting transcript so everyone can see the full context of the meeting, even if they weren't there." - Jess M. on G2

Feature constraints to weigh honestly

The device-level trade-off is audio playback. Granola deletes raw audio after transcription, so you cannot replay the recording. You have a full transcript, enhanced notes, and chat-based query capability across both. Teams requiring audio for legal verification or tone analysis should weigh this limitation before committing. Granola also needs an internet connection to transcribe meetings and generate notes, so transcription and note generation are not available fully offline or entirely on your device.

What Granola costs for teams

Granola's Business plan is $14 per user per month. Enterprise is $35 per user per month and adds SSO, SCIM, HIPAA-compliant workspaces, org-wide model training opt-out, priority support, and usage analytics.

Running 10 research interviews per week means roughly 40 sessions per month. For Business plan pricing, that is $0.35 per captured session. For teams where a single compliance finding costs more than a year of tooling, the trade-off is worth modeling.

Run your next customer interview with device-level capture. Download Granola for Mac, Windows, iPhone or Android, connect your calendar, and see how device-level capture works. Share the Granola security page with your compliance team to evaluate Granola's SOC 2 Type II controls.

FAQs

Does Granola work locally?

Partly. Granola captures audio on your device and keeps a local copy of your notes and meeting history for faster access and offline viewing. Transcription and AI summaries use secure cloud processing, so Granola needs an internet connection to generate notes.

Does Granola record audio?

Granola temporarily captures and transcribes your meeting audio, then discards it. It doesn't retain audio recordings. What persists is the transcript and your notes.

Where does Granola store data?

In Granola's US-hosted AWS Virtual Private Cloud, encrypted at rest and in transit and backed up daily. A local copy of your notes and meeting history is also kept on your device for faster access and offline viewing.

Is Granola HIPAA compliant?

Enterprise supports HIPAA-compliant workspaces with a signed Business Associate Agreement (BAA) available through sales. HIPAA workspaces and BAAs are not available on Basic or Business plans.

What is a local-first AI notepad?

A local-first AI notepad generally refers to a tool that performs significant processing, such as transcription and AI summaries, on your own device instead of relying primarily on cloud processing.

Some tools capture audio on the device but still use cloud services for transcription or summaries, so it is worth checking each vendor's published processing, retention, encryption and subprocessor details. Granola captures audio on the device but uses secure cloud processing for transcription and AI enhancement.

How does Granola capture audio?

Granola runs on your laptop or phone and uses your device's audio to generate notes, so it works the same way across meeting platforms and in-person conversations. Let the other people on the call know you are using Granola to transcribe it.

Is Granola SOC 2 Type 2 certified?

Yes. Granola achieved SOC 2 Type 2 certification in July 2025.

Does Granola store my meeting recordings?

No. Granola transcribes audio in real time on Mac and Windows, or after the meeting on mobile, and deletes the audio file automatically after transcription. The audio is not retained, while the transcript and your enhanced notes remain available according to Granola's retention settings.

Key terms glossary

Device-level audio capture: Audio capture that occurs at the operating system layer on your device rather than via a bot joining your meeting as a participant.

Cloud processing: Transcription and AI summarization that run on the vendor's servers rather than on your device. Granola captures on the device and processes in the cloud.

Zero-audio-retention: An architecture in which raw audio files are deleted immediately after transcription, leaving only text-based data in storage.

SOC 2 Type 2: A security certification from the AICPA that verifies an organization's controls over security, availability, processing integrity, confidentiality, and privacy across a defined audit period.

GDPR data minimization: A core GDPR principle requiring that personal data be limited to what is necessary for the stated processing purpose. In practice: collect only what you need and delete it when it is no longer needed.

Speaker diarization: The process of identifying which speaker said what in a multi-person recording.

Human-in-the-loop enhancement: A workflow in which a user jots rough notes during a meeting, and an AI model enhances them using transcript context, preserving the user's judgment about what matters rather than generating a fully automated summary.

Model training opt-out: A contractual or settings-based control that prevents a vendor or its AI subprocessors from using your data to train or fine-tune AI models.