Not legal advice · Summaries of vendors' public pages, which change often. Verify with the vendor and your contract before relying on anything here.

Does Granola train on your data? (Business plans)

Business plan Granola · Meeting notes · Last verified

Depends on plan

Training default depends on plan or how you bought it.

Short answer: Depends on plan

Granola trains its own models on anonymized data by default on Free and Business; Enterprise is opted out by default. Third-party AI providers can't train on it.

Why this matters: "De-identified" removes names, not the substance of what was said or written. What "de-identified" covers →

2/7 assurances found·7 of 9 fields confirmed from vendor pages

Below, check how long Granola keeps your data and what it says about security and AI-management standards (SOC 2, ISO 27001 and ISO 42001). We also cover data processing agreements (DPAs), business associate agreements (BAAs) and HIPAA support, where data can be stored or processed, and zero data retention. Each answer links to Granola's own page.

Summary of Granola's public pages as of Nov 9, 2026. Not legal advice: terms vary by plan and contract and can change. Confirm with Granola before relying on it.

Trains on your data by default

Depends on plan

Granola trains its own models on anonymized data by default on Free and Business; Enterprise is opted out by default. Third-party AI providers can't train on it.

Source:

Data retention

Indefinite unless deleted or auto-deletion is set

Audio is deleted after transcription. Any plan can set a transcript auto-deletion period (Enterprise admins set it workspace-wide in the app); changes start a one-week cooldown.

Source:

SOC 2 Type II

Yes
Source:

ISO/IEC 27001

No
Source:

ISO/IEC 42001

Unknown

Not stated on any vendor page we checked.

DPA available

Yes
Source:

BAA / HIPAA

Partial

Not on Free or Business plans; desktop apps only.

Source:

Data residency options

No

US (AWS) only.

Source:

Zero-retention option

Unknown

Not stated on any vendor page we checked.

Vendor pages we monitor for this tool

We calculate a code from the page’s visible text each time we check it (a SHA-256 fingerprint). Changes to that code help us spot edits to the vendor’s terms.