NVIDIA
nvidia.com
Automated, point-in-time. Not independently reviewed or approved by TRUSTYCYBER unless expressly stated.
- No disclosure found on training, retention or location for enterprise AI workload data
- No clear commitment that your data will not train their models
- Data retention window not stated
See Before you sign, with what to ask for ↓
Scanned Oct 21, 2026 · Public evidence · Point-in-time
Higher scores indicate stronger, independently supported AI assurance, governance, AI systems, models, data, supply chain and third-party assurance evidence. The score and the decision are related but different: a well-scored vendor can still carry conditions.
Before you sign
Why it matters: The only data-handling disclosures collected are in the corporate privacy policy and concern personal data: telemetry from NVIDIA software (including enterprise software) is used to improve products and services, website chatbot messages are used to improve products and services, personal data is retained while engagement continues and erased after five years of inactivity, and data is generally stored in the United States under SCCs. Nothing collected states whether prompts, outputs, fine-tuning data or other workload data submitted to NVIDIA-hosted services (for example NVIDIA-hosted NIM endpoints or DGX Cloud) are used to train or improve NVIDIA models, how long they are kept, or where they are processed. The unfavorable training tag on c8 is scoped to website and app chatbots, not to enterprise AI products, and should not be read as a statement about NIM or AI Enterprise. For self-hosted NIM on the customer's own cloud or data center NVIDIA may sit outside the request path, but the hosted variants were not evidenced either way.
What to ask for: For NVIDIA-hosted AI services (NVIDIA-hosted NIM endpoints, DGX Cloud and similar), are customer prompts, outputs and fine-tuning data used to train or improve NVIDIA models; how long are they retained; and in which regions are they processed? Please provide the product-specific terms or DPA that govern this.
“We collect your information when you use NVIDIA software, including GeForce Experience, GeForce NOW, Graphics Delivery Network, software for NVIDIA SHIELD, and enterprise software for our cloud, data center, networking, and embedded systems products.This helps us optimize your experience, improve our products and services, and better communicate with you.”
“When you interact with any of our chatbots on our web site or mobile apps we collect your messages, including the personal information included in the messages, such as your name and email address (if provided), along with the web page you are on. We use this data to improve our products and services, and to support our customer service efforts.”
“We retain your personal data for as long as our engagement with you continues (e.g., emails, website visits, logins, or event attendance). We erase customer and enterprise personal data if there has been no engagement with you for more than five years.”
“NVIDIA is located in California, and in most cases we need to securely transfer and store your information in the United States. Transfers of personal data to the United States, and to or from NVIDIA, are made subject to the Standard Contractual Clauses which have been pre-approved by the European Commission and ensure appropriate data protection safeguards.”
“This data is used exclusively for the purposes of AV and AI projects and is not used or connected to personal data for our other products and services. This data is never used to uniquely identify or profile individuals.”
“Part of NVIDIA AI Enterprise, NVIDIA NIM microservices are a set of easy-to-use microservices for accelerating the deployment of foundation models on any cloud or data center and helps keep your data secure.”
Why it matters: The public sources scanned do not clearly state that customer prompts, files, and outputs are excluded from training or fine-tuning of first- or third-party models.
What to ask for: Get a no-training clause covering first- and third-party models into the DPA/order form.
“When you interact with any of our chatbots on our web site or mobile apps we collect your messages, including the personal information included in the messages, such as your name and email address (if provided), along with the web page you are on. We use this data to improve our products and services, and to support our customer service efforts.”
“This data is used exclusively for the purposes of AV and AI projects and is not used or connected to personal data for our other products and services. This data is never used to uniquely identify or profile individuals.”
Why it matters: The public sources scanned do not give a retention period for customer data or prompts/outputs.
What to ask for: Get retention windows, in days, in writing.
“We retain your personal data for as long as our engagement with you continues (e.g., emails, website visits, logins, or event attendance). We erase customer and enterprise personal data if there has been no engagement with you for more than five years.”
Buyer questionsanswered only from the public evidence scanned, click a row for the answer
!Will they train on your data?Ask the vendor
Messages submitted to NVIDIA chatbots on its website and mobile apps, including any personal information in them, are collected with consent and used to improve NVIDIA's products and services and to support customer service, and are stored for record keeping.
Requires written confirmation, see Before you sign ↓
“When you interact with any of our chatbots on our web site or mobile apps we collect your messages, including the personal information included in the messages, such as your name and email address (if provided), along with the web page you are on. We use this data to improve our products and services, and to support our customer service efforts.”
“This data is used exclusively for the purposes of AV and AI projects and is not used or connected to personal data for our other products and services. This data is never used to uniquely identify or profile individuals.”
!How long do they keep your data?Ask the vendor
NVIDIA retains personal data for as long as the engagement continues and erases customer and enterprise personal data after more than five years without engagement.
Requires written confirmation, see Before you sign ↓
“We retain your personal data for as long as our engagement with you continues (e.g., emails, website visits, logins, or event attendance). We erase customer and enterprise personal data if there has been no engagement with you for more than five years.”
!Who else can access your data?Ask the vendor
NVIDIA discloses that its website and app chatbots may be supported by third-party vendors such as Drift, which process chatbot messages and any personal information as a data processor under NVIDIA's instructions; the list is illustrative ('such as') rather than exhaustive.
Confirm in writing: Ask the vendor to state this in writing before signing.
“If the chatbot platforms are supported by third-party vendors such as Drift, such vendors will collect and process this data, including your personal information if provided, as part of the provision of the chatbot services. These vendors will process your personal information as a data processor, and under our instructions.”
!Where is your data processed?Ask the vendor
NVIDIA states that in most cases personal data is transferred to and stored in the United States, with transfers made subject to the EU Standard Contractual Clauses.
Confirm in writing: Ask the vendor to state this in writing before signing.
“NVIDIA is located in California, and in most cases we need to securely transfer and store your information in the United States. Transfers of personal data to the United States, and to or from NVIDIA, are made subject to the Standard Contractual Clauses which have been pre-approved by the European Commission and ensure appropriate data protection safeguards.”
✓What happens in a security incident?Clear
NVIDIA commits that reported security concerns are evaluated and addressed promptly, with resources assigned to analyse, validate and provide corrective actions.
“NVIDIA takes security concerns seriously and works to quickly evaluate and address them. Once a security concern is reported, NVIDIA commits the appropriate resources to analyze, validate and provide corrective actions to address the issue.”
Email to send the vendor9 items to confirm in writing
Hello NVIDIA team, We are assessing NVIDIA as part of our supplier review. Before we proceed, please confirm the following in writing: 1. What is your commitment to notify customers of a security incident affecting our data, including the timeframe? 2. Do you use our data (inputs, outputs or uploaded files) to train or improve your models? Please confirm in writing, including any opt-out and whether it applies to every plan. 3. How long do you retain our data, in days, for each type (inputs, outputs, logs and backups), and how is it deleted? 4. Please provide your current, dated subprocessor list and explain how you notify customers of changes. 5. In which countries and regions is our data processed and stored, and can processing be limited to a region we choose? 6. Which NVIDIA products and hosted services are covered by current SOC 2 Type II, ISO/IEC 27001 or ISO/IEC 42001 reports, and can the reports and the model evaluation or red-teaming documentation for Nemotron and NIM-packaged models be shared under NDA? 7. Stripe appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data. 8. Atlassian appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data. 9. Microsoft appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data. A written reply to each point, or a link to where it is documented, is enough. Where a point is covered by a certification or independent report, please include the certificate number or the report and its date. Thank you,
Key findingsclick a row for the evidence
✓Mature product security incident response with machine-readable advisoriesStrong
NVIDIA operates a PSIRT with a published commitment to analyse, validate and remediate reported security concerns, a vulnerability reporting channel, PGP key, published PSIRT policies, email subscription for bulletin notifications, and from 1 October 2026 bulletins in Markdown, CSAF and CVE formats on GitHub alongside the Product Security website.
A buyer running NVIDIA AI Enterprise, NIM or BlueField in their own environment depends on timely, automatable vulnerability advisories to patch; CSAF/CVE feeds let that be integrated into vulnerability management tooling rather than monitored by hand.
“NVIDIA takes security concerns seriously and works to quickly evaluate and address them. Once a security concern is reported, NVIDIA commits the appropriate resources to analyze, validate and provide corrective actions to address the issue.”
“Starting October 1, 2026, NVIDIA PSIRT will only publish security bulletins on GitHub in Markdown, CSAF, and CVE formats to meet industry demand for easier integration. Coverage will expand across product lines over time, while all bulletins will continue to be available on the Product Security website, ensuring access from both sources in parallel.”
✗No disclosure found on training, retention or location for enterprise AI workload dataGap
The only data-handling disclosures collected are in the corporate privacy policy and concern personal data: telemetry from NVIDIA software (including enterprise software) is used to improve products and services, website chatbot messages are used to improve products and services, personal data is retained while engagement continues and erased after five years of inactivity, and data is generally stored in the United States under SCCs. Nothing collected states whether prompts, outputs, fine-tuning data or other workload data submitted to NVIDIA-hosted services (for example NVIDIA-hosted NIM endpoints or DGX Cloud) are used to train or improve NVIDIA models, how long they are kept, or where they are processed. The unfavorable training tag on c8 is scoped to website and app chatbots, not to enterprise AI products, and should not be read as a statement about NIM or AI Enterprise. For self-hosted NIM on the customer's own cloud or data center NVIDIA may sit outside the request path, but the hosted variants were not evidenced either way.
Training-use, retention and residency are the first questions most AI procurement and privacy reviews ask; for an Australian or EU buyer the default US storage of personal data also needs a documented transfer mechanism for the specific product, not just the corporate policy.
Question for vendor: For NVIDIA-hosted AI services (NVIDIA-hosted NIM endpoints, DGX Cloud and similar), are customer prompts, outputs and fine-tuning data used to train or improve NVIDIA models; how long are they retained; and in which regions are they processed? Please provide the product-specific terms or DPA that govern this.
“We collect your information when you use NVIDIA software, including GeForce Experience, GeForce NOW, Graphics Delivery Network, software for NVIDIA SHIELD, and enterprise software for our cloud, data center, networking, and embedded systems products.This helps us optimize your experience, improve our products and services, and better communicate with you.”
“When you interact with any of our chatbots on our web site or mobile apps we collect your messages, including the personal information included in the messages, such as your name and email address (if provided), along with the web page you are on. We use this data to improve our products and services, and to support our customer service efforts.”
“We retain your personal data for as long as our engagement with you continues (e.g., emails, website visits, logins, or event attendance). We erase customer and enterprise personal data if there has been no engagement with you for more than five years.”
“NVIDIA is located in California, and in most cases we need to securely transfer and store your information in the United States. Transfers of personal data to the United States, and to or from NVIDIA, are made subject to the Standard Contractual Clauses which have been pre-approved by the European Commission and ensure appropriate data protection safeguards.”
“This data is used exclusively for the purposes of AV and AI projects and is not used or connected to personal data for our other products and services. This data is never used to uniquely identify or profile individuals.”
“Part of NVIDIA AI Enterprise, NVIDIA NIM microservices are a set of easy-to-use microservices for accelerating the deployment of foundation models on any cloud or data center and helps keep your data secure.”
!Independent assurance and model evaluation not evidenced beyond Data Privacy Framework self-certificationGap
The only attestation found is NVIDIA's statement that it complies with the EU-U.S., Swiss-U.S. and UK Extension Data Privacy Framework Principles, a self-certification covering personal data transfers that is listed on the US DPF registry but was not checked here. No SOC 2, ISO/IEC 27001, ISO/IEC 42001 or other third-party audit of NVIDIA AI Enterprise, NIM, DGX or its hosted services appears on the collected pages, and no description of NVIDIA's own model testing, red-teaming or safety evaluation for Nemotron or NIM-packaged models was found. independent_assurance is assessed partial (the DPF attestation exists but is narrow) and testing_and_evaluation not_evidenced: both are disclosures a vendor of this size could supply, so their absence is treated as a gap rather than not applicable.
Without an audited control set a buyer cannot rely on vendor statements about security updates or data handling, and without published evaluation results the buyer carries the full burden of testing model behaviour before production use.
Question for vendor: Which NVIDIA products and hosted services are covered by current SOC 2 Type II, ISO/IEC 27001 or ISO/IEC 42001 reports, and can the reports and the model evaluation or red-teaming documentation for Nemotron and NIM-packaged models be shared under NDA?
“In addition, NVIDIA complies with the EU-U.S., Swiss-U.S., and UK Extension to the EU-U.S. Data Privacy Framework Principles and we are subject to enforcement by the U.S. Federal Trade Commission.”
“Accelerate innovation with NVIDIA Nemotron, a family of open models purpose-built for enterprise AI. Unlock flexibility, transparency, and trust with models designed for scale and adaptability.”
“NVIDIA AI Enterprise is an end-to-end platform for developing, deploying, and managing AI applications. It includes AI frameworks, NIM microservices, and SDKs in the Application Layer and GPU drivers, Kubernetes operators, and cluster management tools in the Infrastructure Layer - each with independent release branches, lifecycle policies, and enterprise support.”
✓Agent runtime isolation and platform attestation capabilities are documentedStrong
NVIDIA documents OpenShell, an open source runtime that mediates what an autonomous agent can see and do and where inference is routed, running agents in isolated sandboxes, and an Attestation Suite (NRAS, RIM Service, OCSP Responder) for verifying device and platform integrity in confidential computing deployments. NIM microservices are stated to receive ongoing security updates and AI Enterprise components to follow independent release branches and lifecycle policies.
These are the product-level controls a buyer would configure to contain agent behaviour and verify that inference runs on trusted hardware; their existence does not substitute for assurance over NVIDIA's own operations, but they materially reduce the buyer's residual exposure when NVIDIA software is self-hosted.
“NVIDIA OpenShell is an open source runtime to build and deploy autonomous, self-evolving agents more safely. OpenShell sits between your agent and your infrastructure to govern how the agent executes, what the agent can see and do, and where inference goes. It enables claws to run in isolated sandboxes, with fine-grained control over privacy and security.”
“The NVIDIA Attestation Suite enhances Confidential Computing by providing robust mechanisms to ensure the integrity and security of devices and platforms. The suite includes NVIDIA Remote Attestation Service (NRAS), the Reference Integrity Manifest (RIM) Service, and the NDIS OCSP Responder.”
“NVIDIA NemoClaw is an open source stack that simplifies running OpenClaw always-on assistants more safely, with a single command. It installs the NVIDIA OpenShell runtime, part of NVIDIA Agent Toolkit, a secure environment for running autonomous agents, and open source models like NVIDIA Nemotron.”
“It includes AI frameworks, NIM microservices, and SDKs in the Application Layer and GPU drivers, Kubernetes operators, and cluster management tools in the Infrastructure Layer - each with independent release branches, lifecycle policies, and enterprise support.”
“NIM microservices have production-grade runtimes including on-going security updates.”
!Collected legal terms are website-level and partly stale; product licences and subprocessor register not collectedGap
The Legal Info page carries a 1997-2016 copyright and an older corporate address, governs website materials only, defers to separate download agreements, and treats anything posted to the site as non-confidential and usable by NVIDIA for any purpose. The privacy policy, by contrast, is dated September 2025 with archived versions and an email commitment for significant updates. No NVIDIA AI Enterprise or NIM licence, cloud service terms, DPA or subprocessor list for AI products was collected; the named processors (Drift, hCaptcha, Google, 6Sense, Leadspace) relate to the website and marketing, not to AI service delivery.
A buyer relying on the collected pages would be reading website terms, not the contract that will actually govern their use of NVIDIA AI software or hosted services; the product-level terms need to be obtained and reviewed before contracting.
Question for vendor: Please provide the current NVIDIA AI Enterprise and NIM licence terms, the cloud service terms and DPA for any NVIDIA-hosted service in scope, and the subprocessor list that applies to those services.
“By downloading any materials from this site, you agree to these terms, unless the materials are accompanied by a separate download agreement, in which case the terms of that Agreement shall control your rights to use the materials.”
“Any material, information or other communication you transmit or post to this Site will be considered non-confidential and non-proprietary ("Communications"). NVIDIA will have no obligations with respect to the Communications. NVIDIA and its designees will be free to copy, disclose, distribute, incorporate and otherwise use the Communications and all data, images, sounds, text, and other things embodied therein for any and all commercial or non-commercial purposes.”
“Updates to this policy will be posted at www.nvidia.com/privacy . Significant updates will be communicated by email.”
“If the chatbot platforms are supported by third-party vendors such as Drift, such vendors will collect and process this data, including your personal information if provided, as part of the provision of the chatbot services. These vendors will process your personal information as a data processor, and under our instructions.”
“When you visit our websites or online services, we collect information about your visit such as IP address, how long you have been on the website or app, or your mouse movements. Our service provider hCaptcha uses this data to verify whether user actions meet our security requirements.”
“We share your request and contact information with business partners and third-party service providers so they can communicate with you about relevant products or services. We share your email address and phone number with Google to assess the effectiveness of our internet advertising. We share your contact information with identity enrichment providers such as 6Sense or Leadspace to obtain additional details (e.g., title, associated industries) about you.”
?Technical dependency observed: StripeObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Stripe as a service provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — Stripe appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.
“Accelerate innovation with NVIDIA Nemotron, a family of open models purpose-built for enterprise AI. Unlock flexibility, transparency, and trust with models designed for scale and adaptability.”
“If the chatbot platforms are supported by third-party vendors such as Drift, such vendors will collect and process this data, including your personal information if provided, as part of the provision of the chatbot services. These vendors will process your personal information as a data processor, and under our instructions.”
“When you visit our websites or online services, we collect information about your visit such as IP address, how long you have been on the website or app, or your mouse movements. Our service provider hCaptcha uses this data to verify whether user actions meet our security requirements.”
“We share your request and contact information with business partners and third-party service providers so they can communicate with you about relevant products or services. We share your email address and phone number with Google to assess the effectiveness of our internet advertising. We share your contact information with identity enrichment providers such as 6Sense or Leadspace to obtain additional details (e.g., title, associated industries) about you.”
“We sometimes share this data with third-party vendors supporting our technology or with business partners that are also developing AV and AI technology. We require all recipients to agree to contractual restrictions on how personal data is used, stored, and shared.”
?Technical dependency observed: AtlassianObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Atlassian as a service provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — Atlassian appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.
“Accelerate innovation with NVIDIA Nemotron, a family of open models purpose-built for enterprise AI. Unlock flexibility, transparency, and trust with models designed for scale and adaptability.”
“If the chatbot platforms are supported by third-party vendors such as Drift, such vendors will collect and process this data, including your personal information if provided, as part of the provision of the chatbot services. These vendors will process your personal information as a data processor, and under our instructions.”
“When you visit our websites or online services, we collect information about your visit such as IP address, how long you have been on the website or app, or your mouse movements. Our service provider hCaptcha uses this data to verify whether user actions meet our security requirements.”
“We share your request and contact information with business partners and third-party service providers so they can communicate with you about relevant products or services. We share your email address and phone number with Google to assess the effectiveness of our internet advertising. We share your contact information with identity enrichment providers such as 6Sense or Leadspace to obtain additional details (e.g., title, associated industries) about you.”
“We sometimes share this data with third-party vendors supporting our technology or with business partners that are also developing AV and AI technology. We require all recipients to agree to contractual restrictions on how personal data is used, stored, and shared.”
?Technical dependency observed: MicrosoftObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Microsoft as a service provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — Microsoft appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.
“Accelerate innovation with NVIDIA Nemotron, a family of open models purpose-built for enterprise AI. Unlock flexibility, transparency, and trust with models designed for scale and adaptability.”
“If the chatbot platforms are supported by third-party vendors such as Drift, such vendors will collect and process this data, including your personal information if provided, as part of the provision of the chatbot services. These vendors will process your personal information as a data processor, and under our instructions.”
“When you visit our websites or online services, we collect information about your visit such as IP address, how long you have been on the website or app, or your mouse movements. Our service provider hCaptcha uses this data to verify whether user actions meet our security requirements.”
“We share your request and contact information with business partners and third-party service providers so they can communicate with you about relevant products or services. We share your email address and phone number with Google to assess the effectiveness of our internet advertising. We share your contact information with identity enrichment providers such as 6Sense or Leadspace to obtain additional details (e.g., title, associated industries) about you.”
“We sometimes share this data with third-party vendors supporting our technology or with business partners that are also developing AV and AI technology. We require all recipients to agree to contractual restrictions on how personal data is used, stored, and shared.”
Assurance dimensionsweighted components of one score, not eight separate ratings
Organisation & AI governance15% of the score40
Who owns AI risk: policies, responsible-AI principles, human oversight and administrative controls.
Assessed against ISO 42001 · NIST AI RMF · AIUC-1
“We are the data controller, and we remain responsible for any of your personal information that is shared with third parties for processing on our behalf.”
“If you have any questions, wish to contact an NVIDIA data protection officer in a specified region, or if you’re an Authorized Agent seeking to make a request on behalf of a consumer under California’s Consumer Privacy Act, please contact our Data Privacy Team.”
AI system15% of the score33
What AI the vendor actually runs and where it sits in the product, the map everything else is judged against.
Assessed against ISO 42001 · NIST AI RMF
“NVIDIA AI Enterprise is an end-to-end platform for developing, deploying, and managing AI applications. It includes AI frameworks, NIM microservices, and SDKs in the Application Layer and GPU drivers, Kubernetes operators, and cluster management tools in the Infrastructure Layer - each with independent release branches, lifecycle policies, and enterprise support.”
“Part of NVIDIA AI Enterprise, NVIDIA NIM microservices are a set of easy-to-use microservices for accelerating the deployment of foundation models on any cloud or data center and helps keep your data secure.”
“NVIDIA NemoClaw is an open source stack that simplifies running OpenClaw always-on assistants more safely, with a single command. It installs the NVIDIA OpenShell runtime, part of NVIDIA Agent Toolkit, a secure environment for running autonomous agents, and open source models like NVIDIA Nemotron.”
“NVIDIA OpenShell is an open source runtime to build and deploy autonomous, self-evolving agents more safely. OpenShell sits between your agent and your infrastructure to govern how the agent executes, what the agent can see and do, and where inference goes. It enables claws to run in isolated sandboxes, with fine-grained control over privacy and security.”
“The NVIDIA Attestation Suite enhances Confidential Computing by providing robust mechanisms to ensure the integrity and security of devices and platforms. The suite includes NVIDIA Remote Attestation Service (NRAS), the Reference Integrity Manifest (RIM) Service, and the NDIS OCSP Responder.”
How AI features are evaluated before and after release, evals, red-teaming, monitoring.
Assessed against NIST GenAI · NIST AI RMF · ISO 42001
How changes to models and AI features are controlled and communicated: versioning, notice, rollback.
Assessed against ISO 27001 · ISO 42001
“It includes AI frameworks, NIM microservices, and SDKs in the Application Layer and GPU drivers, Kubernetes operators, and cluster management tools in the Infrastructure Layer - each with independent release branches, lifecycle policies, and enterprise support.”
“NIM microservices have production-grade runtimes including on-going security updates.”
“Updates to this policy will be posted at www.nvidia.com/privacy . Significant updates will be communicated by email.”
AI system description: vendor-evidenced, not yet independently corroborated.
Testing & evaluation: not publicly evidenced.
Model10% of the score40
Which model providers and versions process customer data, and how changes to them are disclosed.
Assessed against NIST GenAI · ISO 42001
“Accelerate innovation with NVIDIA Nemotron, a family of open models purpose-built for enterprise AI. Unlock flexibility, transparency, and trust with models designed for scale and adaptability.”
“NVIDIA NemoClaw is an open source stack that simplifies running OpenClaw always-on assistants more safely, with a single command. It installs the NVIDIA OpenShell runtime, part of NVIDIA Agent Toolkit, a secure environment for running autonomous agents, and open source models like NVIDIA Nemotron.”
Customer data15% of the score57
Whether customer data trains models, how long it is retained, where it is processed, and how it is protected.
Assessed against ISO 27018 · OAIC APPs · EU AI Act
“We collect your information when you use NVIDIA software, including GeForce Experience, GeForce NOW, Graphics Delivery Network, software for NVIDIA SHIELD, and enterprise software for our cloud, data center, networking, and embedded systems products.This helps us optimize your experience, improve our products and services, and better communicate with you.”
“When you interact with any of our chatbots on our web site or mobile apps we collect your messages, including the personal information included in the messages, such as your name and email address (if provided), along with the web page you are on. We use this data to improve our products and services, and to support our customer service efforts.”
“We retain your personal data for as long as our engagement with you continues (e.g., emails, website visits, logins, or event attendance). We erase customer and enterprise personal data if there has been no engagement with you for more than five years.”
“NVIDIA is located in California, and in most cases we need to securely transfer and store your information in the United States. Transfers of personal data to the United States, and to or from NVIDIA, are made subject to the Standard Contractual Clauses which have been pre-approved by the European Commission and ensure appropriate data protection safeguards.”
“This data is used exclusively for the purposes of AV and AI projects and is not used or connected to personal data for our other products and services. This data is never used to uniquely identify or profile individuals.”
AI supply chain10% of the score40
The named chain of AI and infrastructure providers behind the product, and how it is disclosed.
Assessed against ISO 27001 · ISO 27017
“If the chatbot platforms are supported by third-party vendors such as Drift, such vendors will collect and process this data, including your personal information if provided, as part of the provision of the chatbot services. These vendors will process your personal information as a data processor, and under our instructions.”
“When you visit our websites or online services, we collect information about your visit such as IP address, how long you have been on the website or app, or your mouse movements. Our service provider hCaptcha uses this data to verify whether user actions meet our security requirements.”
“We share your request and contact information with business partners and third-party service providers so they can communicate with you about relevant products or services. We share your email address and phone number with Google to assess the effectiveness of our internet advertising. We share your contact information with identity enrichment providers such as 6Sense or Leadspace to obtain additional details (e.g., title, associated industries) about you.”
“We sometimes share this data with third-party vendors supporting our technology or with business partners that are also developing AV and AI technology. We require all recipients to agree to contractual restrictions on how personal data is used, stored, and shared.”
Security foundation15% of the score40
How security problems are found, reported and handled: disclosure channels, bug bounty, incident response.
Assessed against ISO 27001 · NIST AI RMF
“NVIDIA takes security concerns seriously and works to quickly evaluate and address them. Once a security concern is reported, NVIDIA commits the appropriate resources to analyze, validate and provide corrective actions to address the issue.”
“Starting October 1, 2026, NVIDIA PSIRT will only publish security bulletins on GitHub in Markdown, CSAF, and CVE formats to meet industry demand for easier integration. Coverage will expand across product lines over time, while all bulletins will continue to be available on the Product Security website, ensuring access from both sources in parallel.”
Independent assurance evidence10% of the score55
Whether claimed certifications and attestations are independently corroborated, checked against official registries and issuing bodies. Which certifications, and what each one does and does not establish, is stated per certificate.
Assessed against ISO 17021-1 · ISO 42006 · ISO 27006-1 · ISO 27008
“In addition, NVIDIA complies with the EU-U.S., Swiss-U.S., and UK Extension to the EU-U.S. Data Privacy Framework Principles and we are subject to enforcement by the U.S. Federal Trade Commission.”
Read from the registry record above, cited, not reproduced.
None of the corroborated certifications is AI-specific (ISO/IEC 42001 or AIUC-class) — this assurance is security and data-transfer attestation, not AI-management-system assurance.
Legal & contractual10% of the score40
The contractual backbone a buyer can rely on, terms, DPAs, privacy commitments and regulatory posture.
Assessed against EU AI Act · OAIC APPs
“By downloading any materials from this site, you agree to these terms, unless the materials are accompanied by a separate download agreement, in which case the terms of that Agreement shall control your rights to use the materials.”
“Any material, information or other communication you transmit or post to this Site will be considered non-confidential and non-proprietary ("Communications"). NVIDIA will have no obligations with respect to the Communications. NVIDIA and its designees will be free to copy, disclose, distribute, incorporate and otherwise use the Communications and all data, images, sounds, text, and other things embodied therein for any and all commercial or non-commercial purposes.”
“Updates to this policy will be posted at www.nvidia.com/privacy . Significant updates will be communicated by email.”
Not graded: Agent, not applicable to this scan.
What would strengthen assuranceeach figure is from today's score, resolving one changes the others
Resolving an evidence gap strengthens the dimension it belongs to, and with it the score: 43 → up to 70 with every identified gap resolved.
AI supply chainclick a node to focus it · drag to pan · zoom with the controls
View as list
What you inheritTrustyCyber's AI Shared Responsibility Matrix v1.0
This scan names the vendor’s AI supply chain without assessing the responsibility split, that depends on how you consume the product. Under the common managed models, a deployer inherits 16 of the matrix’s 41 responsibilities from providers, each with named evidence owed.
Map your inherited responsibilitiesAssurance evidence: certifications 3, registry checks and verification ladders, click to view
Self-certification covering transfers of personal data to NVIDIA in the United States; subject to FTC enforcement. Not a third-party audit and not scoped to any AI product or hosted service. The DPF registry listing referenced by the policy was not checked in this pass.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Not claimed in any public source scanned. This is the AI-management-system certification — in its absence, the vendor’s AI governance rests on its general security and privacy certifications.
Checked against Data Privacy Framework (dataprivacyframework.gov), Oct 21, 2026: Verified on the registry
Sources 13, click to view
Appendix: standards landscape 8, click to view
Where each standard behind this assessment stands today, from TrustyCyber’s continuously maintained standards radar.
Want to go further?
This scan assesses NVIDIA at an organisational level. Assurance can vary significantly between products, models and agents, enter the product you’re evaluating to run a deeper AI System Assurance Scan.
Scan a specific product →This automated result is based on publicly available information at the time of scanning. It is not an audit, certification, legal opinion or assurance engagement. Publicly unavailable evidence may materially change the conclusion.
Monitor for changes
Get an email if its TRUSTYCYBER Score, grade or certifications change. One credit per refresh; reading the report always stays free.