Granola vs MeetStream

Granola 70

API keys go in a Bearer header, carry Personal notes, Public notes or both, and can be edited and revoked. Workspace keys do not expire. Audit and legal hold keys do one job each, capped at five active keys. The MCP server uses OAuth with S256 PKCE, dynamic client registration and one scope, mcp, or enterprise-managed authorisation (25 of 30). The notes API cannot edit or delete notes, Enterprise admins can limit scopes and switch off transcripts for MCP, and webhook payloads carry no note content. A notes key can still register a webhook to any public HTTPS URL (16 of 20). Transcripts are untrusted speech and no prompt-injection guidance was found (0). The Audit API records each API key use and MCP tool call for a year, on Enterprise only (12 of 15). SOC 2 Type II, a valid security.txt, a disclosure policy with safe harbour and paid rewards, and published post-mortems. No formal bug bounty (17 of 20).

MeetStream 42

A key grants full access to its workspace's bots and data, and workspaces separate keys. MCP sign-in is OAuth, which mints a key per connection. No scopes or read-only keys found (15 of 30). delete_bot_data needs confirm: true and is marked destructive, and remove_bot keeps recordings, with no read-only mode (10 of 20). Transcripts, chat and audio come from meeting participants, and no prompt-injection guidance was found (0). A dashboard bot detail page and signed webhooks, with no audit log of API calls found (5 of 15). ISO 27001 certified (630036), SOC 2 Type 2 under audit, HIPAA with a BAA, a trust centre and HMAC-signed webhooks. No security.txt (404) or bug bounty found (12 of 20). 15+10+0+5+12 = 42.

Granola 70

Graded on the hosted REST API and MCP server. status.granola.ai is an incident.io page with five components, two of them API and webhooks and MCP (20). For August to November 2026 it shows 100 per cent uptime for API and webhooks and 99.89 per cent for MCP. Of nine incidents in its feed since 4 August, the app ones name the desktop or mobile apps or describe app functions (the 28 October "Granola app services down" marks no component and lists syncing and note generation), one names a third party only, and one on 8 October 2026 is MCP not connecting for Claude Code users, which hits one client group and reads as partial. Minor only (20). REST limits are published (burst 25, 5 requests a second), and MCP limits as about 100 a minute, subject to change (15). 429 is stated with no Retry-After or backoff guidance. Webhook retries run for four days with a stable event_id, and adding legal hold custodians is idempotent (5 of 15). No uptime SLA was found (0). The API is at v1.6.0 with no beta label (10). 20 + 20 + 15 + 5 + 0 + 10 = 70.

MeetStream 45

Graded on the hosted REST API and MCP server with the hosted lines. No public status page was found, linked or at status.meetstream.ai (0), so no incident history could be read (5). Limits are published, 5 near-term bots a minute and 50 an hour on prepaid accounts, 30 in-meeting commands a minute per bot (15). 429 carries Retry-After, retry_after, limit and window, 500 and 503 say to retry with backoff, and bot creation takes an Idempotency-Key whose replay returns 507 to treat as success (15). No SLA found in the Terms or on the pricing page (0). Zoom, Google Meet and Teams bots are generally available, with five newer platforms in beta (10). 0+5+15+15+0+10 = 45.

Granola 60

The newest API changelog entry is v1.6.0, labelled October 2026 with no day. Our 8 October check found v1.5.0 as the newest entry, so v1.6.0 was posted after 8 October, and the docs sitemap dates the changelog and the new Search notes page 27 October and the List Spaces page 9 October, all within 30 days (30). Entries in the last 90 days are v1.4.0 (August, 28 of whose 31 days fall after 4 August; the Get Transcript page it added carries a sitemap date of 11 August), v1.5.0 (September) and v1.6.0 (October) (20). A public changelog, a support address, incidents each closed with a note, and published security reports. No public issue tracker (10 of 15). No entry from Granola in the official MCP registry, where the one match is a third party's server, and no official SDK (0). No packages to assess (0). 30 + 20 + 10 + 0 + 0 = 60.

MeetStream 82

Changelog entries on 27 October 2026 (camera streaming and prepaid creation limits) (30). Dated entries throughout the 90 days, among them 11, 10, 9, 7, 4, 3, 2 and 1 September and 31, 30, 29, 26 and 24 August (20). A public changelog, support@meetstream.ai and Slack support, with no evidence read of reply times (10 of 15). In the official MCP registry as io.github.meetstream-ai/meetstream-mcp 0.3.0, and official SDKs 1.0.0 since 26 August 2026 (15). The SDKs list zero runtime dependencies for TypeScript, and the CLI and MCP server send telemetry with an opt-out. The repositories weren't cloned (7 of 10). 30+20+10+15+7 = 82.

Granola 76

Closed service with published Platform Terms and User Terms, both dated 19 December 2025, which count related APIs as part of the Services (15 of 30). The privacy policy (effective 8 September 2026), the DPA (17 July 2026) and the help centre agree that data sits on AWS in the United States, audio is deleted after transcription, third parties may not train on customer data and Granola trains on de-identified data unless the user opts out. Notes and transcripts are kept indefinitely unless a retention period is set (24 of 30). No deprecation policy was found. The Audit API page says existing fields will not change without a new API version (5 of 20). Storage location is disclosed and the security page names Deepgram, AssemblyAI, OpenAI and Anthropic. The full sub-processor list is on a trust centre we could not read, with ten days' notice of changes per the DPA (14 of 20).

MeetStream 57

Closed service with clear terms of 7 August 2026 naming MeetStream Corp. (15 of 30). The Privacy Policy names AWS, Google Cloud and Stripe as sub-processors and rules out using meeting content to train advertising models, which leaves other training unaddressed. Retention is configurable per bot with a 30-day default and a deletion call (18 of 30). Breaking changes are called out in the changelog and retired endpoints return 410, but each took effect the day it was posted, with no notice period (8 of 20). Sub-processors named, data locations not stated (10 of 20). 15+18+8+10 = 51.

Granola 71

The MCP server has nine tools per the docs, and the definitions themselves need a sign-in to read. On REST the transcript is returned only with include=transcript, and large ones move to a paged endpoint (21 of 25). Cursor pagination with page_size up to 30 for notes and 100 for transcript items, filters for created and updated dates, folder and space, and since v1.6.0 POST /v1/notes/search over titles and shared summaries with participant, folder, space, meeting date and update time filters (20). Errors return a JSON body with an error name and message, and a few codes are documented, with no error catalogue or schema (11 of 20). The notes endpoints are read-only and webhook deliveries can be deduplicated by event_id. No idempotency key on webhook or legal hold creation, and MCP annotations could not be read (11 of 20). Few required parameters. No official SDK was found (8 of 15). 21 + 20 + 11 + 11 + 8 = 71.

MeetStream 88

19 MCP tools (15), plus 2 because media come back as links rather than inline files (17 of 25). Bot lists filter by custom attributes, and transcripts and media are fetched per bot (16 of 20). Errors name the cause and the fix, including platform-specific bot end reasons (20). Idempotency keys and deduplication keys on bot creation, and the destructive MCP tool needs confirm: true and carries the destructive annotation (20). Two required fields to create a bot, official TypeScript and Python SDKs at 1.x and a CLI (15). 17+16+20+20+15 = 88.

Granola 25

No x402, MPP or L402 (0). Plan prices are public, $0, $14 and $35 a user a month, with nothing priced per call (10). The free Basic plan includes MCP for personal notes from the last 30 days with some tools withheld, while the REST API and webhooks need a paid plan or a time-limited trial (15 of 20). A person installs the app, signs in with Google or Microsoft and creates a key or approves OAuth (0).

MeetStream 40

No x402, MPP or L402 (0). Per-hour prices are public, $0.35 per bot hour, $0.10 for transcription and $0.05 per GB a month of storage past 30 days (20). $5 free credit with no card required (20). Signup and key creation happen in the dashboard, and the MCP OAuth flow needs a person to approve (0). 0+20+20+0 = 40.