Granola: the notetaker that doesn't join your call

Most AI notetakers announce themselves. A bot slides into the call as a participant, your client watches “Notetaker has joined the meeting” appear on screen, and the first thirty seconds of the conversation are about the robot rather than the deal.

Granola doesn’t do that. It captures audio at the device level, so nothing joins the call and the person on the other end sees a normal meeting. That single design decision is most of why people like it, and it’s worth understanding what it does and doesn’t buy you.

What it actually does

Granola records from your machine, transcribes, and merges the transcript with whatever you typed during the call. The output is closer to the notes you would have written if you’d had time, rather than a wall of transcript with a summary bolted on top.

The company states SOC 2 Type 2 certification as of July 2025, GDPR compliance, that meeting audio is deleted immediately after transcription, and that its third-party AI providers are contractually prohibited from training on customer data.

Pricing runs from a free tier, through roughly $14 per user per month for Business, to $35 and up for Enterprise.

The distinction people get wrong

Local capture does not mean local processing.

“No bot in the call” and “nothing leaves your laptop” are different claims, and only the first one is being made here.

Nothing joins your meeting, which is a genuine privacy and etiquette win. But the audio or transcript still travels to a cloud model to be summarised. “No bot in the call” and “nothing leaves your laptop” are different claims, and only the first one is being made here.

That matters because the second claim is the one procurement asks about.

The gap

Granola does not claim EU data residency. Its own security material describes notes stored in a US-hosted AWS virtual private cloud, and as of mid-2026 there is no EU residency option on the shelf, EU arrangements route through a sales conversation.

For a lot of DACH companies recording customer conversations, that ends the evaluation regardless of how good the product is. GDPR compliance and EU data residency are different things: the first is a posture you can hold while storing data in the US under Standard Contractual Clauses, the second is a commitment about which continent your recordings physically sit on. If your answer to “where is this stored” has to be “in the EU”, this isn’t your tool yet.

The second gap, which is the one people miss

The absence of a bot is a privacy feature and a legal liability at the same time, and in Germany the liability side is criminal rather than regulatory.

§ 201 StGB, Verletzung der Vertraulichkeit des Wortes, makes it an offence to record the non-publicly spoken word of another person without authorisation. The penalty is up to three years’ imprisonment or a fine. It attaches to the person who pressed record, not to the employer, and no data processing agreement touches it.

A visible bot is, awkwardly, a consent mechanism. Everyone on the call sees “Notetaker has joined”, and continuing the conversation is a defensible basis for inferring agreement. Device-level capture removes that signal entirely. The thing that makes Granola pleasant to use is the same thing that removes your evidence that anyone knew.

This does not make the tool unusable in DACH. It makes one workflow step mandatory rather than polite: say at the top of the call that you are recording, wait for the answer, and note it in the record. Teams that build that line into their meeting opener stop having the problem. Teams that put a sentence in the calendar invite have not solved it, because the person who joins from a forwarded link never read it.

There is a second, quieter obligation for teams rolling this out across a sales floor. Recording and evaluating employee conversations is generally co-determined under § 87 BetrVG, which makes a company-wide rollout a topic for the works council before it is a topic for procurement.

What the AI Act changes here, and what it doesn’t

Since 2 August 2026 the Article 50 transparency obligations apply to AI systems that interact with people or generate content, independent of risk class.

For a notetaker the practical reading is narrow. Summarising a meeting for internal use is not an AI system talking to your customer, so the disclosure duty for AI interaction does not bite. It does bite the moment the output leaves the building automatically, a follow-up email drafted by the tool and sent without a person in the loop is a different thing from notes in your own workspace.

Meeting-summarisation tools are also not high-risk under Annex III, which means the obligations deferred to December 2027 by the Digital Omnibus are not the ones to plan around. We separated what actually came into force from what movedDE (auf Deutsch), because most current vendor material has the two the wrong way round.

How it sits against the alternatives

The category splits along one line, and it is not price.

	Granola	Bot-based US tools	EU-hosted tools
Joins the call	No	Yes, visibly	Usually yes
Storage	US (AWS VPC)	US by default	EU
Processing	Cloud	Cloud	EU cloud
Consent signal	None: you provide it	Built in	Built in

The middle column is where most evaluations go wrong. Several bot-based tools advertise EU storage on enterprise plans while continuing to process in the US. Storage residency without processing residency answers a different question from the one procurement asked, and we pulled that distinction apart across five tools.

Granola is at least unambiguous about where it stands, which is worth something. A vendor that says “US, with SCCs” is easier to make a decision about than one that says “EU-ready”.

Who should use it

Teams where residency isn’t a binding requirement and meeting hygiene is. It’s the least intrusive capture experience in the category, the notes are genuinely good, and the no-training commitment extends to sub-processors, which is more than several competitors put in writing.

Teams under a hard EU-residency requirement should look at EU-hosted alternatives instead, and should ask for the residency commitment in the data processing agreement rather than on a marketing page.

What to verify before you buy

Ask in writing, and keep the answers: in which country is audio stored and in which country is it processed by the models; will they sign an Article 28 DPA naming every sub-processor including the model providers; is your content excluded from training contractually rather than editorially; and how long deletion actually takes, since “deleted immediately” and “removed from backups within 90 days” are both true statements about the same system.

If you want the transcripts to actually do something afterwards, updating deal records, triggering follow-ups, feeding your CRM without anyone copying and pasting, book a strategy call.

Frequently asked questions about Granola