Granola deletes the audio. It still receives it.
By Fazit
If someone has asked you to name every third party that will touch a client conversation, “the vendor deletes it afterwards” is not an answer to the question. This is what Granola publishes, what it keeps behind a request form, and how to read the gap.
Two notes before the facts. First, everything below is quoted or paraphrased from Granola’s own public documentation, checked on 1 August 2026, and linked so you can verify it yourself. Vendor terms change; if you are reading this months later, re-check the source rather than trusting this page. Second, this is not a claim that Granola is careless. It is a well-built product with a real security posture, and on several of these points it is more forthcoming than most of the category. The point is narrower: what is disclosed, and what a disclosed deletion still implies.
What is public and what is gated
Granola’s Security, Privacy & Data FAQ is the primary source. Here is the disclosure surface as of today:
PUBLIC? WHERE Standard DPA yes go.granola.so/dpa Named AI providers partial FAQ names OpenAI, Anthropic Full subprocessor list no Trust Center, on request SOC 2 Type II report no Trust Center, on request Storage region yes AWS, United States only Transcript retention yes indefinite unless configured Audio retention yes deleted after transcription Training on your data yes anonymised, opt-out, on by default
The standard DPA being public is genuinely good practice and more than several competitors offer. The full subprocessor list and the SOC 2 report both sit behind a Trust Center access request, which is normal for the category but means neither this page nor a prospective buyer can enumerate the chain without asking. We did not request access, so we have not seen the list and are not going to guess at its contents. If your procurement process needs it, request it directly. Granola’s FAQ does name OpenAI and Anthropic, stating that they are “never allowed to train on your data” under enterprise agreements.
The four facts that matter to a reviewer
All data is stored in the United States. The FAQ is direct about this: all data sits on AWS servers in the US, and Granola does not offer EU, UK, or other regional data residency at this time. For a German or EU practice, that is not a footnote. It means every client conversation processed through the product involves an international transfer, and your Article 30 record and your client disclosures have to say so.
Transcripts are retained indefinitely by default. Notes and transcripts persist until you or an administrator configures a retention policy. The default is keep, not expire. If you have a document retention schedule, it does not apply here until someone configures it to.
Anonymised data may be used for model improvement on Free and Business plans by default. There is an opt-out in settings, and Enterprise administrators can enforce it organisation-wide. But the default on the plans most individuals use is on, which means the burden is on the user to find the setting.
The audio reaches Granola’s systems before it is deleted. This is the one worth reading twice. The FAQ says audio is “temporarily cached during the meeting for transcription only” and that once transcription completes, the audio is deleted “from our systems and any third-party services.” That sentence is a disclosure, not a contradiction: you cannot delete something from third-party services it never reached.
How to read the local-first claim
Granola now describes itself as local-first, on the basis that it captures device audio so no recording persists on any server. Read precisely, that claim is about persistence, and it appears to be accurate. It is not a claim that the audio stays on your Mac, and the security FAQ makes clear that it does not.
This distinction is the whole argument, so it is worth stating plainly rather than scoring points with it. Never created and created, sent, then deleted are different security postures, and they fail differently. A deletion policy is a promise about future behaviour, enforced by process, auditable only through a report you have to request. It depends on the vendor doing what it says, on its subprocessors doing what they have agreed, and on nothing going wrong in the window where the data exists. That window is short here, which is a real design choice in the user’s favour. It is still a window, and a subpoena, a breach, or a change of terms only has to find it once.
We have made this argument about the category generally in bot-free is not the same as private. Granola is the strongest version of the botless-but-cloud architecture, which is exactly why it is the useful one to read carefully.
If you are the one being asked
Client procurement teams, DPO questionnaires, and law firm outside-counsel guidelines increasingly ask for a subprocessor list by name. If you run client calls through any cloud notetaker, three things are true at once, and you should know them before the question arrives rather than after:
- You are the controller. The tool is a processor, and its providers are subprocessors of yours.
- You need the list to answer accurately, which means requesting it and keeping a copy against the date you requested it.
- Storage region and retention default are answers you must give in your own words, not link out for.
The broader compliance version of this is in a GDPR-compliant AI notetaker is one that never creates the data, and the practical deletion mechanics are in how to delete your AI notetaker data.
Where Fazit sits, stated honestly
Fazit has no subprocessor list for call content, because there is no third party in that path. Capture is bot-free, transcription runs on-device, and the summary is generated by a local model on localhost rather than a provider API, so neither the audio nor the transcript leaves the Mac. The audio is never written to disk at all: it lives in a RAM ring buffer with no write API and is destroyed on every exit path, which is why each note carries audio_retained: false in its frontmatter. The output is a Markdown file in your own Obsidian vault, so there is no vendor database holding a copy either.
The honest caveats, because this page is about disclosure: Fazit downloads its models once from public CDNs on first run, so there is network traffic at setup even though there is none during a call. Account, licensing and payment are a separate lane from call content and do involve third parties, which is disclosed on the security page. The product is young. And none of this is legal advice, or a guarantee about your obligations. What it is, is an architecture where the question “who else touched this conversation?” has a structural answer instead of a policy one.
If you are actively comparing, the Granola alternatives comparison ranks the field by audio path, and the Granola to Obsidian sync guide covers getting your existing notes out.
FAQ
Does Granola publish its subprocessor list?
Not publicly. The security FAQ says the list is available in the Trust Center, which requires an access request. The standard DPA is public at go.granola.so/dpa. The FAQ names OpenAI and Anthropic as third parties under enterprise agreements that prevent training on customer data.
Does Granola store data in the EU?
No. The FAQ states all data is stored on AWS servers in the United States, and that EU, UK and other regional data residency are not offered at this time.
Does Granola keep a recording of my meeting?
Granola states audio is cached during the meeting for transcription only and then deleted from its systems and any third-party services. Transcripts and notes are retained indefinitely unless a retention policy is configured.
Is Granola local-first?
Granola describes itself that way on the basis that no recording persists on a server. Its own FAQ also states the audio is cached for transcription and then deleted from its systems and third-party services, so the audio does reach them. Local capture and local processing are different claims, and only the first is being made.