- Deployment
- hosted
- Hq Country
- United States
- Hq City
- New York
- Ownership
- private
- Founded
- 2023
- Training Default
- trains-deidentified
- Residency Options
- United States (AWS VPC)
- Gov Access Exposure
- us-cloud-act
- Eu Ai Act Role
- provider
- Certs
- SOC 2 Type II
- DPA available
- yes
- Retention Default
- "Notes are stored in our US-hosted AWS Virtual Private Cloud." Granola does not store meeting audio — it transcribes in real time on desktop, or from temporarily cached audio on mobile — and keeps the transcript and notes. It does not add a bot to the call and does not auto-record.
- Retention Exceptions
- The training position needs both halves quoted to be understood. "We do not allow third parties (like OpenAI or Anthropic) to use your data to train their AI models" is followed by "Granola trains on your anonymized data so we can keep making Granola better. You can opt out of this in your Settings." Enterprise accounts have training off by default; everyone else is opted in. The privacy policy adds that once de-identified data is incorporated into a model it will not be removed, because removal "may not be technically feasible without complete model retraining".
- Subprocessors
- Amazon Web Services (US, VPC), Deepgram (US, transcription), AssemblyAI (US, transcription), OpenAI (US), Anthropic (US)
- Subprocessor Count
- 5
- Transfer Mechanism
- none-stated
- Eu Procurement Ready
- fail
- Eu Procurement Reason
- Granola is the batch's clearest case of the sentence that does two jobs. It says it does not let OpenAI or Anthropic train on customer data, which is true, and immediately afterwards that it trains on anonymised customer data itself, with an opt-out in Settings and enterprise accounts off by default. Its own privacy policy then notes the contribution cannot be pulled back out of a trained model. That combination is what methodology v1.3 added trains-deidentified for. The rest of the row is a US-hosted AWS VPC with no EU option and no Chapter V mechanism named. Two design choices deserve credit and do not affect the score: it stores no meeting audio at all, and it never joins the call as a bot, so it does not record participants who never installed it.
- Training Claim Basis
- stated
- Training Confidence
- high
- Residency Claim Basis
- stated
- Residency Confidence
- high
- Retention Claim Basis
- stated
- Retention Confidence
- high
- Subprocessors Claim Basis
- stated
- Subprocessors Confidence
- medium
- Residency Class
- non-eu-only
- Portability / Exit Path
- proprietary-only
- Subprocessor Jurisdiction
- non-eu
- Underlying model providers
- Deepgram and AssemblyAI (transcription), OpenAI and Anthropic (summarisation)
