Network troubleshooting and allowlist guide

If Granola works on one network but not another, or stops working when your company VPN, proxy, firewall, or web filtering software is enabled, the issue may be network filtering rather than audio permissions or app settings. This guide is useful for IT teams configuring tools like Zscaler, proxy appliances, SSL inspection, or other network security software.

​

What to ask your IT team to allow

Granola relies on secure HTTPS and WebSocket connections. If your organization filters traffic, ask your IT team to allow connections to the domains below and avoid rewriting or redirecting them. For ordinary HTTPS domains, TLS/SSL inspection may remain enabled if the inspection CA is trusted on managed devices and the proxy passes requests and responses unchanged. The streaming endpoint (stream.api.granola.ai) must deliver response bodies incrementally. Disable response buffering or content scanning for this host. If your security product cannot inspect it while preserving incremental delivery, exclude it from TLS/SSL inspection. The transcription endpoints (api.deepgram.com, *.api.deepgram.com, and streaming.assemblyai.com) require direct outbound WSS over TCP 443. Allow WebSocket upgrades and long-lived connections. Granola’s native transcription sockets do not use the operating system’s explicit HTTP proxy. If your security product cannot inspect this traffic without altering or closing it, exclude these hosts from TLS/SSL inspection. For real-time in-app notifications, allow HTTPS and WSS over TCP 443 to api.knock.app. Not every customer needs every domain below. The exact list depends on which Granola features you use.

​

Core Granola app access

These are the most important domains for signing in, loading notes, and connecting the desktop app to Granola services.

​

App downloads and updates

Allow these if users need to download Granola, reinstall it, or receive in-app updates.

​

Transcription and voice features

Allow these if users need live transcription or voice dictation to work.

​

Sign-in, SSO, and calendar sync

Allow the providers your organization uses. Calendar data syncs through Granola’s servers, so the Google Calendar and Microsoft Graph APIs don’t need to be reachable from your network — connecting a calendar only uses the sign-in domains below.

​

Notifications

​

Documentation and help center

​

Diagnostics and support logs

Optional. Granola works without these, but blocking them prevents the app from sending diagnostic logs that Granola support uses to debug issues on your users’ machines.

​

DNS CNAME targets for SASE and advanced DNS filtering

Most organizations do not need this section. If your network security solution inspects DNS CNAME chains (common with SASE products such as Zscaler, Netskope, and Palo Alto Prisma Access), you may also need to allow the underlying DNS targets that Granola domains resolve to.

​

What blocked or redirected requests can look like

When network security software blocks, redirects, or inspects these requests, Granola may fail in ways that do not obviously look like a networking problem. Common symptoms include:

• Sign-in never completes — the Google, Microsoft, or SSO browser flow loops, stalls, or fails to return to Granola.
• Calendar sync fails — meetings do not appear in Coming up, or calendars do not stay connected.
• Transcription never starts — the live transcript stays empty even when audio permissions and devices are correct.
• Transcription starts, then disconnects — Granola connects briefly and then drops or repeatedly retries.
• Notes or shared links do not load — shared note pages, desktop notes, or note content stay stuck loading.
• Updates or reinstalls fail — the app cannot download an update, or the installer download is blocked.
• Granola only fails on one network — the app works on a home network or hotspot but not on your office network, VPN, or filtered Wi-Fi.
• Certificate or secure connection errors — TLS inspection, untrusted certificates, or HTTPS rewriting can prevent Granola from opening secure API or WebSocket connections.
• Unexpected login or warning pages appear — some filtering products redirect blocked requests to an HTML warning page or captive portal, which breaks sign-in, downloads, and real-time connections.

​

Common things to try

If you’re not sure whether the issue is network-related, these checks usually help narrow it down quickly:

1. Try another network — for example, a mobile hotspot or home Wi-Fi. If Granola works there, the issue is likely your company network, VPN, proxy, or filter.
2. Temporarily disable VPN or proxy software — if allowed by your organization, test Granola without it.
3. Check WebSocket and streaming handling — allow direct WSS over TCP 443 to the transcription hosts, and disable response buffering for stream.api.granola.ai. Bypass TLS inspection where the security product cannot preserve WebSocket upgrades, long-lived connections, or incremental response delivery.
4. Check whether blocked traffic is being redirected — if your security tool replaces requests with a warning page or login page, Granola may show blank pages, loading states, or failed sign-in.
5. Test DNS resolution — ask IT to compare the managed resolver’s result with an organization-approved external resolver. Do not change managed DNS settings without approval.
6. Check the inspection certificate is trusted — if your network inspects HTTPS traffic but the inspection CA isn’t trusted by the operating system, Granola can’t open secure connections. Deploy the inspection CA to managed devices, or exclude Granola’s domains from inspection.

​

When to use this guide vs other troubleshooting articles

• If Granola is not capturing audio correctly, see Transcription issues.
• If events are missing from Coming up, also see Calendar sync troubleshooting.
• If the app itself is blocked from installing or updating, see Reinstalling Granola for macOS and Windows.

If you’ve already confirmed that audio settings and permissions are correct, and Granola still only fails on certain networks, send this article to your IT team along with the domains above.