Quick answers
Is Grain SOC 2 Type II certified?
Grain says so on its security page and in its help centre (article dated 6 July 2026), and says the report is available through its Trust Center. No audit period is given.
Is Grain ISO 27001 certified?
We found no ISO 27001 claim on the Grain pages we reviewed.
Does Grain train AI on customer data?
Grain says meeting data is not used to train OpenAI’s GPT models, citing OpenAI’s API policy, and that it uses meeting data only to create summaries and related content. Grain also says AI features cannot currently be disabled.
Where does Grain host data?
Grain says it hosts on AWS facilities in the USA and lists no other regions.
Summary
Grain is a meeting recorder built around highlight clips and shareable call summaries, and its AI summaries are generated through OpenAI’s API. For a regulated firm the main points are US-only hosting, AI features that cannot currently be turned off, and an auto-deletion setting that admins can use to match a records schedule.
What Grain states
| Area | What the vendor states | Source and date |
|---|---|---|
| SOC 2 | Grain says it is SOC 2 Type II certified, with a clean Type II report available through its Trust Center. The help centre also says Grain complies with GDPR, HIPAA and SOC 2 “where applicable”, without further detail. No report period is given. | S1, S2 · undated; 6 Jul 2026 |
| ISO 27001 | Not claimed on the Grain pages we reviewed. ISO 27001 appears only where Grain describes its hosting provider’s assurances. | S1, S2 · undated; 6 Jul 2026 |
| Training on customer data | Grain says meeting data is not used to train OpenAI’s GPT models, citing OpenAI’s API policy, and that it uses meeting data only to create summaries and related content for users and their teams. | S3 · undated, shown as updated “over 3 months ago” |
| AI provider | OpenAI GPT models (the help centre names “GPT 4-o Mini”) through the OpenAI API, not the consumer ChatGPT product. Grain says OpenAI retains API data for up to 30 days solely for abuse prevention and monitoring. A separate Grain help article says “No customer data is retained in this process.” Grain also says AI features cannot currently be disabled. | S3, S2 · undated; 6 Jul 2026 |
| Where data is hosted | AWS facilities in the USA, with no other regions listed. Grain says customer data, including recordings and transcripts, is encrypted at rest and in transit. | S1 · undated |
| Retention and deletion | Workspace admins can set auto-deletion policies that delete recordings after a defined period, and users can delete individual recordings. No default retention period is stated. | S2 · 6 Jul 2026 |
| Admin controls and sign-on | Single sign-on is available to Enterprise customers, who can require it. SCIM and audit logs are not mentioned on the pages we reviewed. | S1 · undated |
| Sub-processors | Grain points to a published sub-processor list at grain.com/grain-subprocessors, which we did not review for this page. | S2 · 6 Jul 2026 |
Grain’s Trust Center (trust.grain.com) did not load as readable text when we checked, so it is not used as a source here. Dates are the page’s own where it shows one; otherwise we say “undated”.
Archiving and recordkeeping
The Grain pages we reviewed do not describe a connector to a compliance archive such as Global Relay, Smarsh or Proofpoint. That does not mean none exists, only that we found none documented. If your firm needs these records in its archive, ask Grain how transcripts and summaries can be exported or delivered, and test that route before relying on it. Our guide to archiving AI meeting notes covers what to ask for.
For the rules that decide whether AI meeting notes are records, see Archiving AI meeting notes: what regulated firms need to check.
Questions to ask before rollout
- Ask for the SOC 2 Type II report from the Trust Center and check the audit period. Grain’s pages give no date.
- If ISO 27001 matters to your vendor review, ask Grain directly. We found no claim to it.
- Grain sends content to OpenAI for AI summaries and says AI cannot be switched off. Confirm in writing that this fits your client-confidentiality policy.
- Two statements need reconciling: OpenAI keeps API data for up to 30 days for abuse monitoring, while another Grain article says no customer data is retained. Ask Grain to explain how both are true.
- Hosting is in the USA only. UK and EU firms should confirm the transfer mechanism and sub-processor terms.
- Set the auto-deletion policy to match your records schedule, and confirm that deleting in Grain does not remove the only copy of a record.
- Ask how recordings, transcripts and summaries reach your archive.
Who it fits
Grain’s strength is recording and highlight clipping, so it is built more for sales and customer-call highlight reels than for advisory documentation. Check fit against your actual workflow before comparing its security posture with tools designed around advisers.
Sources
- S1: Grain security page, undated, page footer 2026; read 12 October 2026.
- S2: Grain Help Center: Security, article dated 6 July 2026.
- S3: Grain Help Center: Does Grain share my data with 3rd parties like OpenAI?, undated, shown as updated “over 3 months ago”; read 12 October 2026.
All sources read on 12 October 2026.
Visit Grain
Check the vendor’s current pages, then compare it with the other meeting notes tools in the directory.
Go to GrainCompare all meeting notes tools · Fellow review · Avoma review