Does Granola sign a BAA?
Only on some plans or setups
Granola signs a BAA and enables HIPAA workspaces only for Enterprise customers through its sales team. Free/Basic, Personal and Business plans are not eligible.
- Business associate
- Granola
- Tool
- Granola
- Plans with a BAA
- Enterprise
- Checked
Some plans only
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Enterprise | Signs a BAA | Through salessales@granola.so | Not self-service: sales and compliance teams run the BAA process, then Granola turns on the HIPAA workspace designation on its side. Do not process PHI before the BAA is signed. Granola blog lists Enterprise from $35/user/month.[1],[2] |
| Basic (Free) / Personal / Business | No BAA | Not offered | Help center states HIPAA support and BAAs are not offered on Free, Personal or Business plans.[1],[2] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Granola says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| AI notes, summaries and Granola chatEnterprise | Not stated | Granola's pages do not say whether AI summaries, chat or integrations are covered, restricted or disabled in HIPAA workspaces.[2] |
Meeting note-takers that offer a BAA
- Fireflies.aiBAA on: EnterpriseSome plans only
- Krisp AI Meeting AssistantBAA on: Meeting AI Enterprise (Business tier), 100+ seatsSome plans only
- MeetGeekBAA on: Any annual planSome plans only
- Otter.aiBAA on: Enterprise (with HIPAA add-on)Some plans only
- Read AIBAA on: Enterprise+ (annual)Some plans only
- Sembly AIBAA on: Sembly EnterpriseSome plans only
All BAA-ready alternatives to Granola
Compare Granola
- Otter.ai vs GranolaOtter.ai: some plans
- Granola vs FathomFathom: signs a BAA
Sources
- Is Granola HIPAA compliant?
- Granola for regulated teams: HIPAA workspaces, retention windows, redaction and deletion
- HIPAA compliant AI transcription: What a BAA covers and what it does not
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.