Fireflies.ai
fireflies.ai
Automated, point-in-time. Not independently reviewed or approved by TRUSTYCYBER unless expressly stated.
- A no-training commitment was found: confirm its scope in writing
- Retention terms found: confirm them in writing
See Before you sign, with what to ask for ↓
Scanned Nov 1, 2026 · Public evidence · Point-in-time
Higher scores indicate stronger, independently supported AI assurance, governance, AI systems, models, data, supply chain and third-party assurance evidence. The score and the decision are related but different: a well-scored vendor can still carry conditions.
Before you sign
Why it matters: The sources include a no-training statement ("Knowledge-base statement that meeting content (audio, video, transcripts, summaries) is never used to train AI models, internally or externally.") but do not settle the question for every model, plan and data type in scope.
What to ask for: Confirm in writing that the no-training commitment covers every model, plan and data type you will use, including any opt-in sharing or feedback.
“Your meeting content — including audio, video, transcripts, and summaries — is never used to train any AI models.”
“(ii) will not use your User Content to train, retrain, fine-tune or otherwise improve any generative artificial intelligence models.”
“You acknowledge and agree, however, that Fireflies may derive usage, statistical, and other data from your User Content and use such derived data for its internal business purposes, including analyzing and improving the Services.”
“You own your data. We don’t train on it by default unlike other AI companies.”
“We do not use personal information for AI model training and we contractually prohibit our vendors from using this information for their own model training.”
Why it matters: The sources describe retention ("Meeting content and Fireflies Talk data is not stored by any third-party vendor after processing, not accessed by vendors once the service is complete, and not used to train internal or external AI models.") but not a complete window for every data type.
What to ask for: Get retention periods in writing for inputs, outputs, logs and backups, including any provider that runs the model.
“This means that your meeting content and Fireflies Talk data is not: (1) stored by any third-party vendor after processing; (2) accessed by any third-party vendor once the service is completed; or (3) used for training internal or external AI models.”
“We store personal information associated with your account for as long as your account remains active. If you close your account, we will delete personal information related to your account within 30 days. We store other personal information for as long as necessary to carry out the purposes for which we originally collected it and for other business purposes explained in this Privacy Policy.”
“provided that if you delete your User Content from the Services, Fireflies will delete copies of such content within a reasonable timeframe,”
“Fireflies allows you to automatically delete meeting recordings, transcripts, and notes after a defined retention period (e.g., delete after 1 month)”
“we maintain a written retention schedule and guidelines for permanently destroying such information when the initial purpose for collecting or obtaining it has been satisfied or within three (3) years”
Australian Government checksdirections checked Nov 1, 2026
No vendor-specific PSPF direction names this vendor or product (checked 2026-11-01).
Not found in the sources this scan collected, which is not evidence the vendor has none. IRAP is an assessment, not a certificate, and there has been no public register since 2020. Ask the vendor for its IRAP assessment report and check its date, classification level and the services in scope.
Not found in the sources this scan collected. If the service will hold government data, ask whether it is hosted with a provider certified under the Hosting Certification Framework, and at which level.
No Australian data residency commitment was found in the sources this scan collected. Ask where inputs, outputs, logs and backups are processed and stored, and whether processing can be kept in Australia.
What your organisation still has to do
Every level of government
- Treat AI outputs, including meeting transcripts and summaries, as public records: capture or dispose of them under your records authority (the Archives Act 1983 for Commonwealth agencies, your state's records legislation for state agencies and councils). Source ↗
Commonwealth agencies
- Assess foreign ownership, control or influence risk for this technology asset, as PSPF Direction 001-2024 requires. Source ↗
- Apply the DTA Policy for the responsible use of AI in government: record the use case, assess its impact before deployment, and keep your AI transparency statement current. Source ↗
- Assess the service against the ISM controls for the highest classification of data you intend to use with it (OFFICIAL, OFFICIAL: Sensitive or PROTECTED). Source ↗
State agencies and councils
- Assess the service under your state's privacy law, which governs where residents' personal information may go: for example the PPIP Act 1998 in New South Wales, the Privacy and Data Protection Act 2014 in Victoria or the Information Privacy Act 2009 in Queensland.
- New South Wales agencies: complete the NSW AI Assessment Framework self-assessment, which Circular DCS-2024-04 makes mandatory. Source ↗
- Victorian public sector: follow Administrative Guideline 2024/07 on the safe and responsible use of generative AI. Source ↗
Buyer questionsanswered only from the public evidence scanned, click a row for the answer
!Will they train on your data?Ask the vendor
Knowledge-base statement that meeting content (audio, video, transcripts, summaries) is never used to train AI models, internally or externally.
Requires written confirmation, see Before you sign ↓
“Your meeting content — including audio, video, transcripts, and summaries — is never used to train any AI models.”
“(ii) will not use your User Content to train, retrain, fine-tune or otherwise improve any generative artificial intelligence models.”
“You acknowledge and agree, however, that Fireflies may derive usage, statistical, and other data from your User Content and use such derived data for its internal business purposes, including analyzing and improving the Services.”
“You own your data. We don’t train on it by default unlike other AI companies.”
“We do not use personal information for AI model training and we contractually prohibit our vendors from using this information for their own model training.”
!How long do they keep your data?Ask the vendor
Meeting content and Fireflies Talk data is not stored by any third-party vendor after processing, not accessed by vendors once the service is complete, and not used to train internal or external AI models.
Requires written confirmation, see Before you sign ↓
“This means that your meeting content and Fireflies Talk data is not: (1) stored by any third-party vendor after processing; (2) accessed by any third-party vendor once the service is completed; or (3) used for training internal or external AI models.”
“We store personal information associated with your account for as long as your account remains active. If you close your account, we will delete personal information related to your account within 30 days. We store other personal information for as long as necessary to carry out the purposes for which we originally collected it and for other business purposes explained in this Privacy Policy.”
“provided that if you delete your User Content from the Services, Fireflies will delete copies of such content within a reasonable timeframe,”
“Fireflies allows you to automatically delete meeting recordings, transcripts, and notes after a defined retention period (e.g., delete after 1 month)”
“we maintain a written retention schedule and guidelines for permanently destroying such information when the initial purpose for collecting or obtaining it has been satisfied or within three (3) years”
✓Who else can access your data?Clear
Fireflies names OpenAI and Anthropic (and unnamed transcription providers) as partners covered by Zero Day Retention vendor agreements under which no customer data is stored, accessed after delivery, or used for training.
“This commitment extends to all our trusted partners, including transcription providers and services like OpenAI and Anthropic. Our Zero Day Retention vendor agreements strictly uphold these standards.”
“More information about our subprocessors is available at https://trust.fireflies.ai/subprocessors .”
“transcribing and formatting Fireflies Talk dictations (speech-to-text providers receive dictation audio; text-formatting providers receive the transcribed text and Screen Context),”
!Where is your data processed?Ask the vendor
Fireflies is US-based and, with its service providers, processes and stores personal information on servers in the United States and other countries; no default regional residency is offered.
Confirm in writing: Ask the vendor to state this in writing before signing.
“Fireflies.ai is based in the United States, and we and our service providers process and store personal information on servers located in the United States and other countries.”
“Need a more secure setup for compliance? Enterprise users can store data in their own region using Private Storage”
“For personal information about EEA, Swiss, and UK individuals, Fireflies.ai complies with the EU-U.S. and Swiss-U.S. Data Privacy Frameworks and the UK Extension to the EU-U.S. Data Privacy Framework”
!What happens in a security incident?Ask the vendor
The only incident-related statement in the public documents is a generic processing purpose to detect and respond to security incidents; no breach notification commitment, timeline or incident response process is published.
Confirm in writing: Ask the vendor to state this in writing before signing.
“Detect, investigate, respond to, prosecute, and help protect against security incidents and other malicious, deceptive, fraudulent, or illegal activity, and help protect the rights and property of Fireflies.ai and others;”
Email to send the vendor5 items to confirm in writing
Hello Fireflies.ai team, We are assessing Fireflies.ai as part of our supplier review. Before we proceed, please confirm the following in writing: 1. Do you use our data (inputs, outputs or uploaded files) to train or improve your models? Please confirm in writing, including any opt-out and whether it applies to every plan. 2. How long do you retain our data, in days, for each type (inputs, outputs, logs and backups), and how is it deleted? 3. In which countries and regions is our data processed and stored, and can processing be limited to a region we choose? 4. What is your commitment to notify customers of a security incident affecting our data, including the timeframe? 5. Please provide the current SOC 2 Type II report, the ISO/IEC 42001 certificate (body, scope, expiry) and confirm which plans include the BAA. A written reply to each point, or a link to where it is documented, is enough. Where a point is covered by a certification or independent report, please include the certificate number or the report and its date. Thank you,
Key findingsclick a row for the evidence
✓Consistent no-training commitment backed by contract and named ZDR partnersStrong
The knowledge base, Privacy Policy and Terms of Service all state customer content is not used to train AI models. The Terms make this a contractual commitment (s.5(c)(ii)), and Fireflies names OpenAI and Anthropic as partners bound by Zero Day Retention agreements under which vendors neither store nor access content after processing.
A contractual no-training clause plus named model providers under zero-retention terms is stronger than a marketing statement alone and gives a buyer something enforceable to point to.
“This commitment extends to all our trusted partners, including transcription providers and services like OpenAI and Anthropic. Our Zero Day Retention vendor agreements strictly uphold these standards.”
“Your meeting content — including audio, video, transcripts, and summaries — is never used to train any AI models.”
“(ii) will not use your User Content to train, retrain, fine-tune or otherwise improve any generative artificial intelligence models.”
“We do not use personal information for AI model training and we contractually prohibit our vendors from using this information for their own model training.”
“This means that your meeting content and Fireflies Talk data is not: (1) stored by any third-party vendor after processing; (2) accessed by any third-party vendor once the service is completed; or (3) used for training internal or external AI models.”
!Training commitment is hedged in two placesGap
The security page says Fireflies does not train on customer data 'by default', while the knowledge base says 'never'. Separately, the Terms allow Fireflies to derive usage, statistical and other data from User Content to analyse and improve the Services, and grant a perpetual, irrevocable, sublicensable licence over User Content (constrained to providing the Services).
'By default' implies a non-default state exists, and the derived-data carve-out plus broad licence sit uneasily with the 'you own your data, we are only a custodian' framing. These should be confirmed in writing, ideally in the Business Terms or DPA.
Question for vendor: Does any setting, plan or feature permit training or fine-tuning on customer content, and what 'derived data' is extracted from User Content and for what purposes?
“You acknowledge and agree, however, that Fireflies may derive usage, statistical, and other data from your User Content and use such derived data for its internal business purposes, including analyzing and improving the Services.”
“You own your data. We don’t train on it by default unlike other AI companies.”
“You grant Fireflies a nonexclusive, royalty-free, worldwide, fully paid, and sublicensable (through multiple tiers) license to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, publicly or otherwise perform and display, and exploit your User Content in all media formats and channels now known or later developed without compensation to you or any third party”
!No published incident response or breach notification commitmentGap
Vulnerability management is disclosed (continuous scanning, HackerOne bug bounty, disclosure channel), but nothing in the public documents describes how security incidents are handled or when customers would be notified of a breach. The only incident mention is a generic processing-purpose line in the Privacy Policy. The Terms also prohibit customers from running their own security tests.
Buyers in regulated sectors need a breach notification timeline and incident process; its absence here means it must be obtained via the DPA or Business Terms, neither of which is in the evidence set. vulnerability_and_incident_handling is assessed partial for this reason.
Question for vendor: What is the contractual breach notification window and incident response process, and is a penetration test summary available under NDA?
“Continuous automated scanning and a HackerOne-powered bug bounty program”
“Conduct security or vulnerability tests of the Services;”
“Detect, investigate, respond to, prosecute, and help protect against security incidents and other malicious, deceptive, fraudulent, or illegal activity, and help protect the rights and property of Fireflies.ai and others;”
!Certifications are self-asserted; GDPR 'certification' and Enterprise-only HIPAA gatingGap
SOC 2 Type II, ISO/IEC 42001 and DPF adherence are all vendor statements with no auditor, certification body, scope or date given; the referenced Trust Center is not in the evidence set. The security page describes Fireflies as 'Certified for GDPR', which is not a recognised certification. HIPAA BAAs and FERPA DSAs are only available on Enterprise with Private Storage, and PHI is contractually prohibited without a BAA.
Buyers should obtain the SOC 2 report and ISO/IEC 42001 certificate to confirm scope and currency, and must note that regulated-data use is effectively Enterprise-only.
Question for vendor: Please provide the current SOC 2 Type II report, the ISO/IEC 42001 certificate (body, scope, expiry) and confirm which plans include the BAA.
“SOC 2 Type II : Independently audited annually to validate our security, privacy, and data integrity controls”
“Responsible AI: Fireflies is ISO/IEC 42001 certified for responsible AI governance.”
“BAA for healthcare and DSA for education, available on Enterprise with Private Storage.”
“Certified for GDPR, SOC 2 Type II, and HIPAA compliance, ensuring top security and privacy standards.”
“For personal information about EEA, Swiss, and UK individuals, Fireflies.ai complies with the EU-U.S. and Swiss-U.S. Data Privacy Frameworks and the UK Extension to the EU-U.S. Data Privacy Framework”
“unless you have entered into a business associate agreement (“BAA”) with Fireflies. Upon mutual execution of a BAA, the BAA will be incorporated by reference into and subject to these Terms.”
!No AI evaluation disclosure and limited model-to-feature mapping; US-default processingGap
testing_and_evaluation is marked not_evidenced (not not_applicable): a hosted transcription and summarisation product can publish accuracy, bias or evaluation results, and Fireflies publishes only a disclaimer that Outputs may be inaccurate. OpenAI and Anthropic are named as partners but not mapped to features or models, and transcription providers are unnamed; the subprocessor list lives on a separate trust portal. Processing defaults to the US 'and other countries', with regional residency only via Enterprise Private Storage.
Without evaluation data or a model-to-feature mapping a buyer cannot judge output risk or which provider sees which data; non-US buyers without Enterprise have no residency control.
Question for vendor: Which models and providers power transcription, summarisation and AskFred respectively, what evaluation or accuracy testing is performed, and what regions are available for Private Storage?
“Because AI Services rely on emerging technology and your specific Inputs, Outputs may be biased, inaccurate or offensive”
“This commitment extends to all our trusted partners, including transcription providers and services like OpenAI and Anthropic. Our Zero Day Retention vendor agreements strictly uphold these standards.”
“Fireflies.ai is based in the United States, and we and our service providers process and store personal information on servers located in the United States and other countries.”
“Need a more secure setup for compliance? Enterprise users can store data in their own region using Private Storage”
“More information about our subprocessors is available at https://trust.fireflies.ai/subprocessors .”
“transcribing and formatting Fireflies Talk dictations (speech-to-text providers receive dictation audio; text-formatting providers receive the transcribed text and Screen Context),”
Assurance dimensionsweighted components of one score, not eight separate ratings
Organisation & AI governance15% of the score65
Who owns AI risk: policies, responsible-AI principles, human oversight and administrative controls.
Assessed against ISO 42001 · NIST AI RMF · AIUC-1
“Internally, our teams do not have access to your meeting content by default. Any access requires your explicit permission, typically granted for support-related purposes only.”
“Opt-out Options : Participants can opt-out, and if even one participant opts out, Fireflies will not join the meeting.”
“Your responsibility: Use the available consent and notification options to keep participants informed when capturing a meeting. You are responsible for following applicable recording and consent requirements.”
“Rules Engine (Enterprise) : Automate data governance with policies for recording, transcription, and retention across your organization”
“Responsible AI: Fireflies is ISO/IEC 42001 certified for responsible AI governance.”
Governance & accountability: vendor-evidenced, not yet independently corroborated.
AI system15% of the score33
What AI the vendor actually runs and where it sits in the product, the map everything else is judged against.
Assessed against ISO 42001 · NIST AI RMF
“As part of the Services, Fireflies makes available artificial intelligence-powered features and tools ( “AI Services” ), including Services that enable you to provide User Content, including the content of meetings or recordings you grant our Services access to ( “Inputs” ) for the purpose of generating transcriptions, summaries and other responses ( “Outputs” ). Your Inputs and Outputs are your User Content.”
“Because AI Services rely on emerging technology and your specific Inputs, Outputs may be biased, inaccurate or offensive”
“If you turn on Fireflies Talk, our desktop dictation feature, we collect your voice while a dictation is active. When you stop dictating, we also collect limited information from the application you are using”
“Our service providers do not use Voice Data to identify or authenticate individuals, and we never receive or process this information on our own servers.”
“Our API covers various functionalities, including queries for fetching data as well as uploading meeting audio.”
How AI features are evaluated before and after release, evals, red-teaming, monitoring.
Assessed against NIST GenAI · NIST AI RMF · ISO 42001
How changes to models and AI features are controlled and communicated: versioning, notice, rollback.
Assessed against ISO 27001 · ISO 42001
“Development, staging, and production, with peer-reviewed code to protect your data.”
“Unless we say otherwise in our notice, the amended Terms will be effective immediately, and your continued use of our Services after we provide you notice will confirm your acceptance of the changes.”
AI system description: vendor-evidenced, not yet independently corroborated.
Testing & evaluation: not publicly evidenced.
Model10% of the score40
Which model providers and versions process customer data, and how changes to them are disclosed.
Assessed against NIST GenAI · ISO 42001
“This commitment extends to all our trusted partners, including transcription providers and services like OpenAI and Anthropic. Our Zero Day Retention vendor agreements strictly uphold these standards.”
Customer data15% of the score65
Whether customer data trains models, how long it is retained, where it is processed, and how it is protected.
Assessed against ISO 27018 · OAIC APPs · EU AI Act
“Your meeting content — including audio, video, transcripts, and summaries — is never used to train any AI models.”
“You acknowledge and agree, however, that Fireflies may derive usage, statistical, and other data from your User Content and use such derived data for its internal business purposes, including analyzing and improving the Services.”
“You own your data. We don’t train on it by default unlike other AI companies.”
“We do not use personal information for AI model training and we contractually prohibit our vendors from using this information for their own model training.”
“This means that your meeting content and Fireflies Talk data is not: (1) stored by any third-party vendor after processing; (2) accessed by any third-party vendor once the service is completed; or (3) used for training internal or external AI models.”
“We store personal information associated with your account for as long as your account remains active. If you close your account, we will delete personal information related to your account within 30 days. We store other personal information for as long as necessary to carry out the purposes for which we originally collected it and for other business purposes explained in this Privacy Policy.”
“provided that if you delete your User Content from the Services, Fireflies will delete copies of such content within a reasonable timeframe,”
“Fireflies allows you to automatically delete meeting recordings, transcripts, and notes after a defined retention period (e.g., delete after 1 month)”
“we maintain a written retention schedule and guidelines for permanently destroying such information when the initial purpose for collecting or obtaining it has been satisfied or within three (3) years”
“Fireflies.ai is based in the United States, and we and our service providers process and store personal information on servers located in the United States and other countries.”
“Need a more secure setup for compliance? Enterprise users can store data in their own region using Private Storage”
“Internally, our teams do not have access to your meeting content by default. Any access requires your explicit permission, typically granted for support-related purposes only.”
“AES 256-bit encryption for data at rest and TLS 1.2+ for data in transit”
Customer data treatment: vendor-evidenced, not yet independently corroborated.
AI supply chain10% of the score40
The named chain of AI and infrastructure providers behind the product, and how it is disclosed.
Assessed against ISO 27001 · ISO 27017
“This commitment extends to all our trusted partners, including transcription providers and services like OpenAI and Anthropic. Our Zero Day Retention vendor agreements strictly uphold these standards.”
“More information about our subprocessors is available at https://trust.fireflies.ai/subprocessors .”
“transcribing and formatting Fireflies Talk dictations (speech-to-text providers receive dictation audio; text-formatting providers receive the transcribed text and Screen Context),”
Security foundation15% of the score45
How security problems are found, reported and handled: disclosure channels, bug bounty, incident response.
Assessed against ISO 27001 · NIST AI RMF
“Continuous automated scanning and a HackerOne-powered bug bounty program”
“Conduct security or vulnerability tests of the Services;”
“Detect, investigate, respond to, prosecute, and help protect against security incidents and other malicious, deceptive, fraudulent, or illegal activity, and help protect the rights and property of Fireflies.ai and others;”
Independent assurance evidence10% of the score44
Whether claimed certifications and attestations are independently corroborated, checked against official registries and issuing bodies. Which certifications, and what each one does and does not establish, is stated per certificate.
Assessed against ISO 17021-1 · ISO 42006 · ISO 27006-1 · ISO 27008
“SOC 2 Type II : Independently audited annually to validate our security, privacy, and data integrity controls”
“Responsible AI: Fireflies is ISO/IEC 42001 certified for responsible AI governance.”
“BAA for healthcare and DSA for education, available on Enterprise with Private Storage.”
“Certified for GDPR, SOC 2 Type II, and HIPAA compliance, ensuring top security and privacy standards.”
“For personal information about EEA, Swiss, and UK individuals, Fireflies.ai complies with the EU-U.S. and Swiss-U.S. Data Privacy Frameworks and the UK Extension to the EU-U.S. Data Privacy Framework”
Independent assurance: vendor-evidenced, not yet independently corroborated.
None of the corroborated certifications is AI-specific (ISO/IEC 42001 or AIUC-class) — this assurance is security and data-transfer attestation, not AI-management-system assurance.
Legal & contractual10% of the score60
The contractual backbone a buyer can rely on, terms, DPAs, privacy commitments and regulatory posture.
Assessed against EU AI Act · OAIC APPs
“(ii) will not use your User Content to train, retrain, fine-tune or otherwise improve any generative artificial intelligence models.”
“This Privacy Policy does not apply to User Content we process on behalf of our business customers, which is governed by our Terms of Service , Data Processing Agreement , and other applicable agreements”
“You grant Fireflies a nonexclusive, royalty-free, worldwide, fully paid, and sublicensable (through multiple tiers) license to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, publicly or otherwise perform and display, and exploit your User Content in all media formats and channels now known or later developed without compensation to you or any third party”
“If you are an organization, company, legal entity, or authorized user acting on behalf of such entity, these Terms incorporate by reference Fireflies' Data Processing Addendum”
“If there is any conflict or inconsistency between these Terms and the Business Terms, the Business Terms will control with respect to your use of the Services as a Business User.”
“unless you have entered into a business associate agreement (“BAA”) with Fireflies. Upon mutual execution of a BAA, the BAA will be incorporated by reference into and subject to these Terms.”
“is limited to the greater of $100, or the total fees paid by you to Fireflies to use our Services in the six months preceding the date on which the first claim giving rise to liability arose”
Legal & contractual transparency: vendor-evidenced, not yet independently corroborated.
Not graded: Agent, not applicable to this scan.
What would strengthen assuranceeach figure is from today's score, resolving one changes the others
Resolving an evidence gap strengthens the dimension it belongs to, and with it the score: 50 → up to 73 with every identified gap resolved.
AI supply chainclick a node to focus it · drag to pan · zoom with the controls
View as list
What you inheritTrustyCyber's AI Shared Responsibility Matrix v1.0
This scan names the vendor’s AI supply chain without assessing the responsibility split, that depends on how you consume the product. Under the common managed models, a deployer inherits 16 of the matrix’s 41 responsibilities from providers, each with named evidence owed.
Map your inherited responsibilitiesAssurance evidence: certifications 4, registry checks and verification ladders, click to view
Stated as independently audited annually; auditor, system scope and report date not published in the evidence set.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Stated as independently certified for responsible AI governance; certification body, scope and validity not published.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Self-asserted compliance; BAA available only on Enterprise with Private Storage. HIPAA is a regulatory regime, not an audited certification.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Includes Swiss-U.S. DPF and UK Extension; self-certification to the U.S. Department of Commerce, listing not verified in this evidence set.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Sources 12, click to view
Appendix: standards landscape 8, click to view
Where each standard behind this assessment stands today, from TrustyCyber’s continuously maintained standards radar.
Want to go further?
This scan assesses Fireflies.ai at an organisational level. Assurance can vary significantly between products, models and agents, enter the product you’re evaluating to run a deeper AI System Assurance Scan.
Scan a specific product →This automated result is based on publicly available information at the time of scanning. It is not an audit, certification, legal opinion or assurance engagement. Publicly unavailable evidence may materially change the conclusion.
Monitor for changes
Get an email if its TRUSTYCYBER Score, grade or certifications change. One credit per refresh; reading the report always stays free.