Hugging Face
huggingface.co
Automated, point-in-time. Not independently reviewed or approved by TRUSTYCYBER unless expressly stated.
- Vendor discloses an unfavourable answer: Who else can access your data?
- Inference Providers routes requests to 18 partner providers that do not appear on the subprocessor list
- No clear commitment that your data will not train their models
+1 more
See Before you sign, with what to ask for ↓
Scanned Oct 25, 2026 · Public evidence · Point-in-time
Higher scores indicate stronger, independently supported AI assurance, governance, AI systems, models, data, supply chain and third-party assurance evidence. The score and the decision are related but different: a well-scored vendor can still carry conditions.
Before you sign
Why it matters: With the default automatic provider selection, requests are routed to the fastest available provider and automatically re-routed to alternative providers if the primary is flagged unavailable; the customer can pin a specific provider instead.
What to ask for: Resolve this directly with the vendor before proceeding — this is a confirmed disclosure, not a gap to fill in.
“The Inference Providers API acts as a unified proxy layer that sits between your application and multiple AI providers. Understanding how provider selection works is crucial for optimizing performance, cost, and reliability in your applications.”
“Automatic Failover : When using automatic provider selection ( provider="auto" ), requests are automatically routed to alternative providers if the primary provider is flagged as unavailable by our validation system”
“Zero Vendor Lock-in : Unlike being tied to a single provider’s model catalog, you get access to models from Cerebras, Groq, Together AI, Replicate, and more — all through one consistent interface.”
“We may share your information with Third-Party Service Providers, and when we do, we ensure that they access your information in compliance with applicable data protection laws. The following list respects the format Subprocessor | Description of Subprocessing | Location of Subprocessing .”
“Subcontracting. We may subcontract all or part of our obligations under these Terms at our own discretion, and without notifying you.”
Why it matters: Inference Providers is a proxy that, by default, routes each request to the fastest available of 18 named third-party inference providers and fails over automatically. None of those providers is on the Privacy Policy's subprocessor list, and the Terms allow subcontracting without notice. Customers can pin a single provider in the model id.
What to ask for: Provide the data-processing terms (retention, training exclusion, processing region) agreed with each Inference Providers partner, confirm whether inference inputs and outputs are logged by Hugging Face or the partner, and confirm whether partners are covered by the Enterprise DPA.
“The Inference Providers API acts as a unified proxy layer that sits between your application and multiple AI providers. Understanding how provider selection works is crucial for optimizing performance, cost, and reliability in your applications.”
“Automatic Failover : When using automatic provider selection ( provider="auto" ), requests are automatically routed to alternative providers if the primary provider is flagged as unavailable by our validation system”
“Zero Vendor Lock-in : Unlike being tied to a single provider’s model catalog, you get access to models from Cerebras, Groq, Together AI, Replicate, and more — all through one consistent interface.”
“We may share your information with Third-Party Service Providers, and when we do, we ensure that they access your information in compliance with applicable data protection laws. The following list respects the format Subprocessor | Description of Subprocessing | Location of Subprocessing .”
“Subcontracting. We may subcontract all or part of our obligations under these Terms at our own discretion, and without notifying you.”
Why it matters: The public sources scanned do not clearly state that customer prompts, files, and outputs are excluded from training or fine-tuning of first- or third-party models.
What to ask for: Get a no-training clause covering first- and third-party models into the DPA/order form.
“In addition and subject to our Privacy Policy, we may aggregate , anonymize, or otherwise learn from data relating to your use of the Services, and use the foregoing to improve those Services.”
Why it matters: The public sources scanned do not give a retention period for customer data or prompts/outputs.
What to ask for: Get retention windows, in days, in writing.
“We retain your Information for as long as necessary to deliver the Services, to comply with any applicable legal requirements, to maintain security and prevent incidents and, in general, to pursue our legitimate interests.”
“Upon cancellation of your Account, we will use commercially reasonable efforts to delete your information and Content of your own Repositories, whether public or private, within 90 days. We will not delete the Content that you contributed to other Users' Repositories, or copies made by us or other Users.”
Buyer questionsanswered only from the public evidence scanned, click a row for the answer
!Will they train on your data?Ask the vendor
The Terms of Service permit Hugging Face to aggregate, anonymise or otherwise learn from data relating to use of the Services to improve them; the collected documents contain no explicit statement on whether customer content or inference inputs are used to train models.
Requires written confirmation, see Before you sign ↓
“In addition and subject to our Privacy Policy, we may aggregate , anonymize, or otherwise learn from data relating to your use of the Services, and use the foregoing to improve those Services.”
!How long do they keep your data?Ask the vendor
Hugging Face retains information for as long as necessary to deliver the Services, meet legal requirements, maintain security and pursue legitimate interests; no fixed retention period is stated.
Requires written confirmation, see Before you sign ↓
“We retain your Information for as long as necessary to deliver the Services, to comply with any applicable legal requirements, to maintain security and prevent incidents and, in general, to pursue our legitimate interests.”
“Upon cancellation of your Account, we will use commercially reasonable efforts to delete your information and Content of your own Repositories, whether public or private, within 90 days. We will not delete the Content that you contributed to other Users' Repositories, or copies made by us or other Users.”
✗Who else can access your data?Concern / gap
With the default automatic provider selection, requests are routed to the fastest available provider and automatically re-routed to alternative providers if the primary is flagged unavailable; the customer can pin a specific provider instead.
Requires written confirmation, see Before you sign ↓
“The Inference Providers API acts as a unified proxy layer that sits between your application and multiple AI providers. Understanding how provider selection works is crucial for optimizing performance, cost, and reliability in your applications.”
“Automatic Failover : When using automatic provider selection ( provider="auto" ), requests are automatically routed to alternative providers if the primary provider is flagged as unavailable by our validation system”
“Zero Vendor Lock-in : Unlike being tied to a single provider’s model catalog, you get access to models from Cerebras, Groq, Together AI, Replicate, and more — all through one consistent interface.”
“We may share your information with Third-Party Service Providers, and when we do, we ensure that they access your information in compliance with applicable data protection laws. The following list respects the format Subprocessor | Description of Subprocessing | Location of Subprocessing .”
“Subcontracting. We may subcontract all or part of our obligations under these Terms at our own discretion, and without notifying you.”
!Where is your data processed?Ask the vendor
Hugging Face states that the company and its servers are located in the United States.
Confirm in writing: Ask the vendor to state this in writing before signing.
“The Company and its servers are located in the United States.”
“Personal Information collected by the Services may be stored and processed in the United States or any other country in which the Company or its affiliates, subsidiaries or agents maintain facilities. By using the Services, you consent to any such transfer of information outside of your country.”
“Data residency ❌ ✅ ✅ ✅”
!What happens in a security incident?Ask the vendor
The Privacy Policy commits Hugging Face to act promptly to identify and address incidents affecting personal information and to notify affected users, without a stated timeframe.
Confirm in writing: Ask the vendor to state this in writing before signing.
“In the event of an incident affecting your Personal Information, we will act promptly acceptable means to identify and address the incident, and to notify you.”
Email to send the vendor9 items to confirm in writing
Hello Hugging Face team, We are assessing Hugging Face as part of our supplier review. Before we proceed, please confirm the following in writing: 1. Please provide your current, dated subprocessor list and explain how you notify customers of changes. 2. Please address the following: Inference Providers routes requests to 18 partner providers that do not appear on the subprocessor list. 3. Do you use our data (inputs, outputs or uploaded files) to train or improve your models? Please confirm in writing, including any opt-out and whether it applies to every plan. 4. How long do you retain our data, in days, for each type (inputs, outputs, logs and backups), and how is it deleted? 5. In which countries and regions is our data processed and stored, and can processing be limited to a region we choose? 6. What is your commitment to notify customers of a security incident affecting our data, including the timeframe? 7. Provide the current SOC 2 Type 2 report (period, auditor, system description and in-scope services) under NDA. 8. Stripe appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data. 9. Microsoft appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data. A written reply to each point, or a link to where it is documented, is enough. Where a point is covered by a certification or independent report, please include the certificate number or the report and its date. Thank you,
Key findingsclick a row for the evidence
✓Published subprocessor list with locations, EU establishment under CNIL, and DPAs on EnterpriseStrong
The Privacy Policy lists infrastructure and service subprocessors with function and country, names Hugging Face SAS (Paris) as the EU main establishment under CNIL, and the Security page offers GDPR DPAs and BAAs on an Enterprise plan. Paid organisation plans add SSO, enforced 2FA, audit logs, resource groups and data residency.
These disclosures give a buyer a concrete starting point for a transfer-impact and subprocessor assessment of the Hub and account-level processing, and a contractual route (Enterprise) to a DPA.
“We may share your information with Third-Party Service Providers, and when we do, we ensure that they access your information in compliance with applicable data protection laws. The following list respects the format Subprocessor | Description of Subprocessing | Location of Subprocessing .”
“The designation of this main establishment in the European Union gives full authority to the French Data Protection Agency, la Commission Nationale de l'Informatique et des Libertés (CNIL) per the General Data Protection Regulation (GDPR).”
“Hugging Face can also offer Business Associate Addendums or GDPR data processing agreements through an Enterprise Plan .”
“Data residency ❌ ✅ ✅ ✅”
“Team & Enterprise organization plans add advanced capabilities to organizations, enabling safe, compliant and managed collaboration for companies and teams on Hugging Face.”
✗Inference Providers routes requests to 18 partner providers that do not appear on the subprocessor listGap
Inference Providers is a proxy that, by default, routes each request to the fastest available of 18 named third-party inference providers and fails over automatically. None of those providers is on the Privacy Policy's subprocessor list, and the Terms allow subcontracting without notice. Customers can pin a single provider in the model id.
Prompts and inputs sent through Inference Providers reach third parties chosen at runtime; without provider-level data terms the buyer cannot establish where inference data is processed, how long it is retained, or whether a provider may use it. Pinning a provider limits but does not document this.
Question for vendor: Provide the data-processing terms (retention, training exclusion, processing region) agreed with each Inference Providers partner, confirm whether inference inputs and outputs are logged by Hugging Face or the partner, and confirm whether partners are covered by the Enterprise DPA.
“The Inference Providers API acts as a unified proxy layer that sits between your application and multiple AI providers. Understanding how provider selection works is crucial for optimizing performance, cost, and reliability in your applications.”
“Automatic Failover : When using automatic provider selection ( provider="auto" ), requests are automatically routed to alternative providers if the primary provider is flagged as unavailable by our validation system”
“Zero Vendor Lock-in : Unlike being tied to a single provider’s model catalog, you get access to models from Cerebras, Groq, Together AI, Replicate, and more — all through one consistent interface.”
“We may share your information with Third-Party Service Providers, and when we do, we ensure that they access your information in compliance with applicable data protection laws. The following list respects the format Subprocessor | Description of Subprocessing | Location of Subprocessing .”
“Subcontracting. We may subcontract all or part of our obligations under these Terms at our own discretion, and without notifying you.”
!No explicit statement on training with customer content or inference inputsGap
The collected Terms and Privacy Policy do not state whether private repository content, prompts or inference inputs are used to train models. The Terms grant Hugging Face a broad content licence 'to provide Services', permit learning from aggregated usage data, and commit only to 'reasonable and appropriate measures' for private repository confidentiality.
A buyer hosting proprietary models or datasets, or sending sensitive prompts through Inference Providers, needs an explicit training exclusion in writing; the public documents leave this open.
Question for vendor: Confirm in writing that customer content in private repositories and inputs/outputs of Inference Providers and Inference Endpoints are not used to train or fine-tune any Hugging Face or partner model.
“In addition and subject to our Privacy Policy, we may aggregate , anonymize, or otherwise learn from data relating to your use of the Services, and use the foregoing to improve those Services.”
“You hereby grant us a worldwide, royalty-free and non-exclusive license to use, display, publish, reproduce, distribute, and make derivative works of such Content to provide Services and as otherwise permitted under these Terms and our Privacy Policy;”
“If you decide to set your Repository private , we will use reasonable and appropriate measures designed to keep your Content confidential , and protected from any unauthorized access or disclosure. However, we may access or share your private information pursuant to the terms set forth in our Privacy Policy.”
!SOC 2 Type 2 asserted as a 'certification' without scope, period or report; GDPR compliance self-assertedGap
The Hub Security page states Hugging Face is 'SOC2 Type 2 certified' and 'GDPR compliant'. SOC 2 is an attestation report, not a certification, and the collected documents do not give the audit period, service auditor or which services are in scope. No ISO/IEC 27001 or ISO/IEC 42001 claim was found.
Without the report a buyer cannot tell whether Inference Providers, Inference Endpoints or only the Hub are within the audited system, or whether the period is current.
Question for vendor: Provide the current SOC 2 Type 2 report (period, auditor, system description and in-scope services) under NDA.
“Hugging Face is also SOC2 Type 2 certified , meaning we provide security certification to our customers and actively monitor and patch any security weaknesses.”
“Hugging Face is GDPR compliant. If a contract or specific data storage is something you’ll need, we recommend taking a look at our Team & Enterprise Support .”
!Legal documents predate the current product set and permit change without noticeGap
The Terms of Service are effective 15 September 2022 and the Privacy Policy 28 March 2023, before Inference Providers took its current multi-partner form. Retention is criteria-based with no fixed period, and the Terms allow services to be modified or discontinued with or without notice. Testing evidence covers artefact scanning on the Hub, not evaluation of served models.
Buyers relying on the public Terms for inference workloads are relying on documents that do not describe those workloads; supplemental terms or the Enterprise contract must be obtained and reviewed.
Question for vendor: Provide the Supplemental Terms that apply to Inference Providers and Inference Endpoints, the retention period for inference logs, and the notice period for deprecating a provider or model.
“Effective Date: September 15, 2022”
“We retain your Information for as long as necessary to deliver the Services, to comply with any applicable legal requirements, to maintain security and prevent incidents and, in general, to pursue our legitimate interests.”
“We may at any time modify , suspend , or discontinue , temporarily or permanently, the Services (or any part thereof) with or without notice. You agree that we will not be liable to you or to any third party for any modification, suspension or discontinuance of the Services.”
“Beyond offering private repositories for models, datasets, and Spaces, the Hub supports access tokens, resource groups, MFA, commit signatures, malware scanning, and more.”
?Technical dependency observed: StripeObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Stripe as a service provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — Stripe appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.
“Automatic Failover : When using automatic provider selection ( provider="auto" ), requests are automatically routed to alternative providers if the primary provider is flagged as unavailable by our validation system”
“Zero Vendor Lock-in : Unlike being tied to a single provider’s model catalog, you get access to models from Cerebras, Groq, Together AI, Replicate, and more — all through one consistent interface.”
“We may share your information with Third-Party Service Providers, and when we do, we ensure that they access your information in compliance with applicable data protection laws. The following list respects the format Subprocessor | Description of Subprocessing | Location of Subprocessing .”
“Subcontracting. We may subcontract all or part of our obligations under these Terms at our own discretion, and without notifying you.”
“By default, our system automatically selects the fastest available provider for the specified model (equivalent to the :fastest policy — highest throughput in tokens per second).”
?Technical dependency observed: MicrosoftObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Microsoft as a service provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — Microsoft appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.
“Automatic Failover : When using automatic provider selection ( provider="auto" ), requests are automatically routed to alternative providers if the primary provider is flagged as unavailable by our validation system”
“Zero Vendor Lock-in : Unlike being tied to a single provider’s model catalog, you get access to models from Cerebras, Groq, Together AI, Replicate, and more — all through one consistent interface.”
“We may share your information with Third-Party Service Providers, and when we do, we ensure that they access your information in compliance with applicable data protection laws. The following list respects the format Subprocessor | Description of Subprocessing | Location of Subprocessing .”
“Subcontracting. We may subcontract all or part of our obligations under these Terms at our own discretion, and without notifying you.”
“By default, our system automatically selects the fastest available provider for the specified model (equivalent to the :fastest policy — highest throughput in tokens per second).”
Assurance dimensionsweighted components of one score, not eight separate ratings
Organisation & AI governance15% of the score40
Who owns AI risk: policies, responsible-AI principles, human oversight and administrative controls.
Assessed against ISO 42001 · NIST AI RMF · AIUC-1
“The designation of this main establishment in the European Union gives full authority to the French Data Protection Agency, la Commission Nationale de l'Informatique et des Libertés (CNIL) per the General Data Protection Regulation (GDPR).”
“Team & Enterprise organization plans add advanced capabilities to organizations, enabling safe, compliant and managed collaboration for companies and teams on Hugging Face.”
AI system15% of the score47
What AI the vendor actually runs and where it sits in the product, the map everything else is judged against.
Assessed against ISO 42001 · NIST AI RMF
“Hugging Face’s Inference Providers give developers access to hundreds of machine learning models, powered by world-class inference providers. They are also integrated into our client SDKs (for JS and Python), making it easy to explore serverless inference of models on your favorite providers.”
“The Inference Providers API acts as a unified proxy layer that sits between your application and multiple AI providers. Understanding how provider selection works is crucial for optimizing performance, cost, and reliability in your applications.”
How AI features are evaluated before and after release, evals, red-teaming, monitoring.
Assessed against NIST GenAI · NIST AI RMF · ISO 42001
“Beyond offering private repositories for models, datasets, and Spaces, the Hub supports access tokens, resource groups, MFA, commit signatures, malware scanning, and more.”
How changes to models and AI features are controlled and communicated: versioning, notice, rollback.
Assessed against ISO 27001 · ISO 42001
“Organization admins can now invite external collaborators directly from a private repository's settings page. Invitees get read or write access to that repository's Resource Group only.”
“We may at any time modify , suspend , or discontinue , temporarily or permanently, the Services (or any part thereof) with or without notice. You agree that we will not be liable to you or to any third party for any modification, suspension or discontinuance of the Services.”
AI system description: vendor-evidenced, not yet independently corroborated.
Model10% of the score40
Which model providers and versions process customer data, and how changes to them are disclosed.
Assessed against NIST GenAI · ISO 42001
“By default, our system automatically selects the fastest available provider for the specified model (equivalent to the :fastest policy — highest throughput in tokens per second).”
“Zero Vendor Lock-in : Unlike being tied to a single provider’s model catalog, you get access to models from Cerebras, Groq, Together AI, Replicate, and more — all through one consistent interface.”
Customer data15% of the score40
Whether customer data trains models, how long it is retained, where it is processed, and how it is protected.
Assessed against ISO 27018 · OAIC APPs · EU AI Act
“The Company and its servers are located in the United States.”
“Personal Information collected by the Services may be stored and processed in the United States or any other country in which the Company or its affiliates, subsidiaries or agents maintain facilities. By using the Services, you consent to any such transfer of information outside of your country.”
“Data residency ❌ ✅ ✅ ✅”
“We retain your Information for as long as necessary to deliver the Services, to comply with any applicable legal requirements, to maintain security and prevent incidents and, in general, to pursue our legitimate interests.”
“Upon cancellation of your Account, we will use commercially reasonable efforts to delete your information and Content of your own Repositories, whether public or private, within 90 days. We will not delete the Content that you contributed to other Users' Repositories, or copies made by us or other Users.”
“In addition and subject to our Privacy Policy, we may aggregate , anonymize, or otherwise learn from data relating to your use of the Services, and use the foregoing to improve those Services.”
“If you decide to set your Repository private , we will use reasonable and appropriate measures designed to keep your Content confidential , and protected from any unauthorized access or disclosure. However, we may access or share your private information pursuant to the terms set forth in our Privacy Policy.”
AI supply chain10% of the score40
The named chain of AI and infrastructure providers behind the product, and how it is disclosed.
Assessed against ISO 27001 · ISO 27017
“Automatic Failover : When using automatic provider selection ( provider="auto" ), requests are automatically routed to alternative providers if the primary provider is flagged as unavailable by our validation system”
“Zero Vendor Lock-in : Unlike being tied to a single provider’s model catalog, you get access to models from Cerebras, Groq, Together AI, Replicate, and more — all through one consistent interface.”
“We may share your information with Third-Party Service Providers, and when we do, we ensure that they access your information in compliance with applicable data protection laws. The following list respects the format Subprocessor | Description of Subprocessing | Location of Subprocessing .”
“Subcontracting. We may subcontract all or part of our obligations under these Terms at our own discretion, and without notifying you.”
Security foundation15% of the score45
How security problems are found, reported and handled: disclosure channels, bug bounty, incident response.
Assessed against ISO 27001 · NIST AI RMF
“For any other security questions, please feel free to send us an email at [email protected] .”
“In the event of an incident affecting your Personal Information, we will act promptly acceptable means to identify and address the incident, and to notify you.”
Independent assurance evidence10% of the score35
Whether claimed certifications and attestations are independently corroborated, checked against official registries and issuing bodies. Which certifications, and what each one does and does not establish, is stated per certificate.
Assessed against ISO 17021-1 · ISO 42006 · ISO 27006-1 · ISO 27008
“Hugging Face is also SOC2 Type 2 certified , meaning we provide security certification to our customers and actively monitor and patch any security weaknesses.”
None of the corroborated certifications is AI-specific (ISO/IEC 42001 or AIUC-class) — this assurance is security and data-transfer attestation, not AI-management-system assurance.
Legal & contractual10% of the score60
The contractual backbone a buyer can rely on, terms, DPAs, privacy commitments and regulatory posture.
Assessed against EU AI Act · OAIC APPs
“You hereby grant us a worldwide, royalty-free and non-exclusive license to use, display, publish, reproduce, distribute, and make derivative works of such Content to provide Services and as otherwise permitted under these Terms and our Privacy Policy;”
“Hugging Face can also offer Business Associate Addendums or GDPR data processing agreements through an Enterprise Plan .”
“Hugging Face is GDPR compliant. If a contract or specific data storage is something you’ll need, we recommend taking a look at our Team & Enterprise Support .”
“Effective Date: September 15, 2022”
“These Terms and all matters regarding their interpretation and/or enforcement are governed by the Law of the State of New York, excluding its choice of law rules.”
Legal & contractual transparency: vendor-evidenced, not yet independently corroborated.
Not graded: Agent, not applicable to this scan.
What would strengthen assuranceeach figure is from today's score, resolving one changes the others
Resolving an evidence gap strengthens the dimension it belongs to, and with it the score: 43 → up to 66 with every identified gap resolved.
AI supply chainclick a node to focus it · drag to pan · zoom with the controls
View as list
What you inheritTrustyCyber's AI Shared Responsibility Matrix v1.0
This scan names the vendor’s AI supply chain without assessing the responsibility split, that depends on how you consume the product. Under the common managed models, a deployer inherits 16 of the matrix’s 41 responsibilities from providers, each with named evidence owed.
Map your inherited responsibilitiesAssurance evidence: certifications 2, registry checks and verification ladders, click to view
Stated on the Hub Security documentation page as 'SOC2 Type 2 certified'. No audit period, service auditor or in-scope services are given in the collected documents; whether Inference Providers and Inference Endpoints are within the audited system is not stated.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Not claimed in any public source scanned. This is the AI-management-system certification — in its absence, the vendor’s AI governance rests on its general security and privacy certifications.
Sources 17, click to view
Appendix: standards landscape 8, click to view
Where each standard behind this assessment stands today, from TrustyCyber’s continuously maintained standards radar.
Want to go further?
This scan assesses Hugging Face at an organisational level. Assurance can vary significantly between products, models and agents, enter the product you’re evaluating to run a deeper AI System Assurance Scan.
Scan a specific product →This automated result is based on publicly available information at the time of scanning. It is not an audit, certification, legal opinion or assurance engagement. Publicly unavailable evidence may materially change the conclusion.
Monitor for changes
Get an email if its TRUSTYCYBER Score, grade or certifications change. One credit per refresh; reading the report always stays free.