Adobe

Adobe states it does not analyse customer content to train generative AI models, with an explicit carve-out for content the user chooses to submit to the Adobe Stock marketplace.

Requires written confirmation — see Before you sign ↓

Retention is criteria-based: most personal information is kept while the account is active, with contract and transaction records retained for ten years after the last interaction; no content-data retention windows are stated publicly.

Requires written confirmation — see Before you sign ↓

Adobe publishes an annual transparency report, states it has built no government backdoors, challenges permanent gag orders in court, and seeks to redirect requests for enterprise customer data to the enterprise itself.

Requires written confirmation — see Before you sign ↓

Adobe discloses the US and India as main processing locations, with transfers to all countries where Adobe, its affiliates, providers and partners operate, under the EU-US, UK and Swiss Data Privacy Frameworks and data transfer agreements.

Confirm in writing: Ask the vendor to state this in writing before signing.

Adobe operates an RFC 9116 security.txt routing to a HackerOne programme and a PSIRT contact with PGP key, alongside regularly published security bulletins and advisories.

Confirm in writing: Ask the vendor to state this in writing before signing.

A per-service compliance list carries SOC 2 Type 2, the ISO 27001 family, ISO 22301, FedRAMP, CSA STAR Level 2, C5, ISMAP and scoped IRAP - and its scope footnotes explicitly place Adobe Firefly and Acrobat AI Assistant inside certified service groupings, with scope limits footnoted rather than glossed.

Most vendors publish certification logos without saying which products they cover; a list that names the AI services in scope and footnotes what is excluded is materially more usable for due diligence.

Adobe commits not to analyse customer content to train generative AI models, excepting content submitted to the Adobe Stock marketplace, and separately offers an opt-out for machine-learning content analysis used for product improvement.

The commitment is specific about the carve-out rather than absolute-sounding, which makes it credible, but the Stock exception and the analysis/training distinction both belong in writing for any contract.

Question for vendor: Confirm in writing that no content from the organisation's licensed services is used to train generative AI models, and how the Adobe Stock carve-out is prevented from applying to enterprise content.

No collected page names the foundation models behind Firefly or the AI Assistants, whether any third-party model providers sit in the processing path, or the subprocessors behind Adobe services - AI-technology processors are disclosed only as a category, and hosting providers only as leading cloud providers.

A buyer cannot establish from public evidence whose models process their content or where the contractual protections run; this is the largest gap in an otherwise strong disclosure surface.

Question for vendor: Name the model providers and subprocessors in the processing path for the AI features in scope, and provide the subprocessor register with change-notification terms.

Testing evidence on the collected surface is software-security level (Secure Product Lifecycle, bulletins); nothing describes how generative AI features are evaluated or red-teamed before or after release.

For a portfolio shipping generative and agentic AI at this scale, the absence of published model-evaluation practice leaves a domain a buyer must probe directly.

Question for vendor: Describe the evaluation and red-teaming applied to generative AI features before release, and any ongoing monitoring for harmful outputs.

Vulnerability intake and bulletins are strong, but no collected page states a customer breach-notification commitment or timeframe; retention is criteria-based with a ten-year record-retention outer bound and no content-data windows.

Breach-notification SLAs and retention windows are contract-schedule material; their absence from the public surface means they must be confirmed in the DPA before signature.

Question for vendor: State the contractual breach-notification timeframe and the retention and deletion windows for customer content, including on termination.

Technical evidence (DNS, certificate, or HTTP) shows a dependency on Google as a service provider. This dependency is not identified in the vendor's published materials.

An undisclosed provider dependency is exactly the gap independent verification exists to surface.

Question for vendor: Verification required — Google appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.

Technical evidence (DNS, certificate, or HTTP) shows a dependency on Stripe as a service provider. This dependency is not identified in the vendor's published materials.

An undisclosed provider dependency is exactly the gap independent verification exists to surface.

Question for vendor: Verification required — Stripe appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.

Technical evidence (DNS, certificate, or HTTP) shows a dependency on Atlassian as a service provider. This dependency is not identified in the vendor's published materials.

An undisclosed provider dependency is exactly the gap independent verification exists to surface.

Question for vendor: Verification required — Atlassian appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.