← Trust Directory

ElevenLabs

elevenlabs.io · 1 assessment

ElevenLabs - organisation
Security review required
1 blocking issue to resolve before signing
Assessed Oct 21, 2026 · public evidence coverage 55% · evidence confidence medium · methodology 0.7.1

Certifications

What the vendor claims, and how far each claim has been independently corroborated. A claim is only ever as strong as the rung it reaches.

SOC 2 Type II
Claimed, scope unclear

DPA 10.1 says the audit report made available on request 'may include a SOC 2 Type II report'; the documents do not assert a report currently exists or state its scope, period or auditor.

  • ✓ Vendor claimed
  • ✓ Evidence cited
  • — Registry corroborated
  • — Scope verified
  • — Current
EU-U.S. Data Privacy Framework (incl. UK Extension and Swiss-U.S. DPF)
Vendor claimed only

Self-declared in the Privacy Policy; stated to apply only to ElevenLabs' U.S. entity. Not checked against the DPF list from these documents.

  • ✓ Vendor claimed
  • ✓ Evidence cited
  • — Registry corroborated
  • — Scope verified
  • — Current
FedRAMP 20x Class A
Claimed, scope unclear

Evidenced only by a related-article headline dated 1 October 2026; authorisation boundary, services in scope and sponsoring agency are not in the collected documents.

  • ✓ Vendor claimed
  • ✓ Evidence cited
  • — Registry corroborated
  • — Scope verified
  • — Current
ISO/IEC 42001
Not claimed

Not claimed in any public source scanned. This is the AI-management-system certification — in its absence, the vendor’s AI governance rests on its general security and privacy certifications.

  • — Vendor claimed
  • — Evidence cited
  • — Registry corroborated
  • — Scope verified
  • — Current
EU-U.S. Data Privacy Framework
Claimed & corroborated
  • ✓ Vendor claimed
  • ✓ Evidence cited
  • ✓ Registry corroborated
  • — Scope verified
  • — Current

Verified on the registry · Data Privacy Framework (dataprivacyframework.gov) · checked Oct 21, 2026

Supply chain

Third parties this vendor’s AI depends on, as disclosed in its own public material. Responsibility transfers; accountability doesn’t.

Models: Eleven v4 / v4 Turbo (ElevenLabs first-party speech models), Scribe v2 / Realtime / Medical (ElevenLabs first-party speech-to-text), GPT-6 family (gpt-6-sol, gpt-6-luna), Claude (claude-opus-5, claude-opus-5-5), DeepSeek (deepseek-v41-flash), GLM (glm-52)
AI providers: OpenAI (Sora API), ByteDance (Seedance)

How to read this

This assessment is automated and point-in-time, built only from evidence the vendor publishes publicly plus checks against official certification registries. It is not an audit, not a certification, and not an endorsement. A low score means public evidence was thin or uncorroborated - which is a finding about disclosure, not proof of a weak control environment. Where too little was found to characterise a product at all, no score or grade is published rather than a low one: absence of evidence is not a number, and a letter grade would read as a verdict on the vendor when it would only be a verdict on what we could collect. This record reflects the evidence available on Oct 21, 2026.