Perplexity
perplexity.ai
Automated, point-in-time. Not independently reviewed or approved by TRUSTYCYBER unless expressly stated.
- Data retention window not stated
- Underlying model providers not named
See Before you sign, with what to ask for ↓
Scanned Aug 28, 2026 · Public evidence · Point-in-time
Higher scores indicate stronger, independently supported AI assurance — governance, AI systems, models, data, supply chain and third-party assurance evidence. The score and the decision are related but different: a well-scored vendor can still carry conditions.
Before you sign
Why it matters: The public sources scanned do not give a retention period for customer data or prompts/outputs.
What to ask for: Get retention windows, in days, in writing.
“We keep your personal data for only as long as necessary to fulfil the purposes in this Notice unless a longer retention period is required or permitted by law.”
Why it matters: AI is used but the public sources scanned do not name which foundation models or providers sit in the request path.
What to ask for: Require named providers and model versions, plus notice before any model change.
Buyer questionsanswered only from the public evidence scanned — click a row for the answer
✓Will they train on your data?Clear
The privacy notice states email content from connected accounts is not used to create, train, improve or fine-tune AI models.
“We do not use the content of emails to create, train, improve, or fine-tune AI models.”
!How long do they keep your data?Ask the vendor
Retention is bounded by necessity against stated purposes, with legal, accounting and reporting requirements as the extension basis.
Requires written confirmation — see Before you sign ↓
“We keep your personal data for only as long as necessary to fulfil the purposes in this Notice unless a longer retention period is required or permitted by law.”
✓Who else can access your data?Clear
Perplexity publishes a subprocessor register on its trust portal.
“subprocessors.”
“we do not sell your personal data or send your queries, prompts, or conversation content to advertisers.”
!Where is your data processed?Ask the vendor
Transfers outside the EEA/UK are disclosed with Standard Contractual Clauses available on request.
Confirm in writing: Ask the vendor to state this in writing before signing.
“transfer, storage, and processing of your data in a country other than your country of residence including, but not limited to, the United States.”
✓What happens in a security incident?Clear
Perplexity documents SIEM-based monitoring, behavioural threat detection, and rapid incident response with remote forensics.
“and analysis of endpoint activity, advanced threat detection using behavioral analysis and machine learning, and rapid incident response capabilities. It also enables remote forensics to investigate and contain potential security incidents.”
Key findingsclick a row for the evidence
✓Security engineering detail is unusually specificStrong
Named tooling (SIEM, cloud security platform, WAF), annual pentests, bounty plus public VDP, and secure SDLC detail.
Specific, falsifiable security claims beat generic assurances.
“Bug Bounty and Vulnerability Disclosure Program We are committed to building strong partnerships with the security research community. In addition to conducting annual third-party penetration tests, we actively collaborate with researchers through our private Bug Bounty program on BugCrowd and our public Vulnerability Disclosure Program (VDP)”
“and analysis of endpoint activity, advanced threat detection using behavioral analysis and machine learning, and rapid incident response capabilities. It also enables remote forensics to investigate and contain potential security incidents.”
“suite of integration and unit tests, and preview deployments to non-production environments for manual QA. Developers are trained to adhere to secure coding guidelines and are aware of the OWASP Top 10 issues. Security-sensitive code is always reviewed by domain experts.”
!Enterprise AI data terms are thinner than the security storyGap
Training commitments in the collected sources are scoped to connected email content; a general no-training commitment for enterprise prompts was not found in the collected pages.
The core enterprise question needs the enterprise terms, which sit behind the trust portal.
Question for vendor: Confirm training and retention terms for Enterprise Pro and API prompts.
“We do not use the content of emails to create, train, improve, or fine-tune AI models.”
“We keep your personal data for only as long as necessary to fulfil the purposes in this Notice unless a longer retention period is required or permitted by law.”
?Technical dependency observed: GoogleObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Google as a service provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — Google appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.
“we assess third-party sub-processors and vendors using a risk-based framework to ensure their privacy, security, and confidentiality practices align with our commitment to safeguarding customer data and maintaining a highly available service.”
“subprocessors.”
?Technical dependency observed: StripeObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Stripe as a service provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — Stripe appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.
“we assess third-party sub-processors and vendors using a risk-based framework to ensure their privacy, security, and confidentiality practices align with our commitment to safeguarding customer data and maintaining a highly available service.”
“subprocessors.”
?Technical dependency observed: MicrosoftObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Microsoft as a service provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — Microsoft appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.
“we assess third-party sub-processors and vendors using a risk-based framework to ensure their privacy, security, and confidentiality practices align with our commitment to safeguarding customer data and maintaining a highly available service.”
“subprocessors.”
Assurance dimensionsweighted components of one score — not eight separate ratings
Organisation & AI governance15% of the score40
Who owns AI risk — policies, responsible-AI principles, human oversight and administrative controls.
Assessed against ISO 42001 · NIST AI RMF · AIUC-1
“we assess third-party sub-processors and vendors using a risk-based framework to ensure their privacy, security, and confidentiality practices align with our commitment to safeguarding customer data and maintaining a highly available service.”
AI system15% of the score27
What AI the vendor actually runs and where it sits in the product — the map everything else is judged against.
Assessed against ISO 42001 · NIST AI RMF
“suite of integration and unit tests, and preview deployments to non-production environments for manual QA. Developers are trained to adhere to secure coding guidelines and are aware of the OWASP Top 10 issues. Security-sensitive code is always reviewed by domain experts.”
How AI features are evaluated before and after release — evals, red-teaming, monitoring.
Assessed against NIST GenAI · NIST AI RMF · ISO 42001
“suite of integration and unit tests, and preview deployments to non-production environments for manual QA. Developers are trained to adhere to secure coding guidelines and are aware of the OWASP Top 10 issues. Security-sensitive code is always reviewed by domain experts.”
How changes to models and AI features are controlled and communicated — versioning, notice, rollback.
Assessed against ISO 27001 · ISO 42001
Change management: not publicly evidenced.
Model10% of the score0
Which model providers and versions process customer data, and how changes to them are disclosed.
Assessed against NIST GenAI · ISO 42001
Model provider transparency: not publicly evidenced.
Customer data15% of the score72
Whether customer data trains models, how long it is retained, where it is processed, and how it is protected.
Assessed against ISO 27018 · OAIC APPs · EU AI Act
“We do not use the content of emails to create, train, improve, or fine-tune AI models.”
“We keep your personal data for only as long as necessary to fulfil the purposes in this Notice unless a longer retention period is required or permitted by law.”
“transfer, storage, and processing of your data in a country other than your country of residence including, but not limited to, the United States.”
Customer data treatment: the certifications above are independently corroborated, but they cover the management system — these specific disclosures are the vendor's own statements, not yet independently verified.
AI supply chain10% of the score60
The named chain of AI and infrastructure providers behind the product, and how it is disclosed.
Assessed against ISO 27001 · ISO 27017
“we assess third-party sub-processors and vendors using a risk-based framework to ensure their privacy, security, and confidentiality practices align with our commitment to safeguarding customer data and maintaining a highly available service.”
“subprocessors.”
Subprocessors & supply chain: vendor-evidenced, not yet independently corroborated.
Security foundation15% of the score85
How security problems are found, reported and handled — disclosure channels, bug bounty, incident response.
Assessed against ISO 27001 · NIST AI RMF
“Bug Bounty and Vulnerability Disclosure Program We are committed to building strong partnerships with the security research community. In addition to conducting annual third-party penetration tests, we actively collaborate with researchers through our private Bug Bounty program on BugCrowd and our public Vulnerability Disclosure Program (VDP)”
“and analysis of endpoint activity, advanced threat detection using behavioral analysis and machine learning, and rapid incident response capabilities. It also enables remote forensics to investigate and contain potential security incidents.”
Vulnerability & incident handling: the certifications above are independently corroborated, but they cover the management system — these specific disclosures are the vendor's own statements, not yet independently verified.
Independent assurance evidence10% of the score85
Whether claimed certifications and attestations are independently corroborated — checked against official registries and issuing bodies. Which certifications, and what each one does and does not establish, is stated per certificate.
Assessed against ISO 17021-1 · ISO 42006 · ISO 27006-1 · ISO 27008
“Bug Bounty and Vulnerability Disclosure Program We are committed to building strong partnerships with the security research community. In addition to conducting annual third-party penetration tests, we actively collaborate with researchers through our private Bug Bounty program on BugCrowd and our public Vulnerability Disclosure Program (VDP)”
Read from the registry record above — cited, not reproduced.
Document held and reviewed by TrustyCyber — cited, not reproduced.
Document held and reviewed by TrustyCyber — cited, not reproduced.
Read from the registry record above — cited, not reproduced.
Capped at 85: none of the corroborated certifications is AI-specific — this is security attestation, not AI-management-system assurance.
None of the corroborated certifications is AI-specific (ISO/IEC 42001 or AIUC-class) — this assurance is security and data-transfer attestation, not AI-management-system assurance.
Legal & contractual10% of the score60
The contractual backbone a buyer can rely on — terms, DPAs, privacy commitments and regulatory posture.
Assessed against EU AI Act · OAIC APPs
“transfer, storage, and processing of your data in a country other than your country of residence including, but not limited to, the United States.”
“we do not sell your personal data or send your queries, prompts, or conversation content to advertisers.”
Legal & contractual transparency: vendor-evidenced, not yet independently corroborated.
Not graded: Agent — not applicable to this scan.
What would strengthen assuranceeach figure is from today's score — resolving one changes the others
Resolving an evidence gap strengthens the dimension it belongs to, and with it the score: 54 → up to 80 with every identified gap resolved.
AI supply chainclick a node to focus it · drag to pan · zoom with the controls
View as list
What you inheritTrustyCyber's AI Shared Responsibility Matrix v1.0
This scan names the vendor’s AI supply chain without assessing the responsibility split — that depends on how you consume the product. Under the common managed models, a deployer inherits 16 of the matrix’s 41 responsibilities from providers, each with named evidence owed.
Map your inherited responsibilitiesAssurance evidence: certifications 5 — registry checks and verification ladders, click to view
Not claimed in any public source scanned. This is the AI-management-system certification — in its absence, the vendor’s AI governance rests on its general security and privacy certifications.
SOC 2 Type 2 by Insight Assurance (Tampa, Florida), report dated 31 Mar 2026, unqualified; system: Perplexity's Text Generation and Information Retrieval Platform; period 1 Mar 2025 - 28 Feb 2026, so current. Type 2 covers both suitability of design AND operating effectiveness. IMPORTANT LIMITATION: the criteria in scope are SECURITY, AVAILABILITY AND CONFIDENTIALITY ONLY - privacy is NOT among them, nor is processing integrity. A buyer asking about privacy commitments gets no assurance from this report, and it is not equivalent to a SOC 2 that includes the privacy criterion. Report held in the TrustyCyber vault.
Checked against SOC 2 Type 2 report held in the TrustyCyber vault (supplied by Perplexity), Aug 24, 2026: Verified on the registry
Checked against Data Privacy Framework (dataprivacyframework.gov), Aug 28, 2026: Verified on the registry
ISO/IEC 27001:2022, Insight Assurance (MSCB-306), certificate IS-IA-2026-07-29-01, issued 29 Jul 2026, expires 28 Jul 2029, next surveillance 28 Jul 2027; statement of applicability v1.0 dated 24 Dec 2025. SCOPE COVERS CONSUMER AND ENTERPRISE ALIKE: the management system supporting Perplexity Free, Pro and Max, Enterprise Pro and Enterprise Max, the Sonar API, Search API and API Platform, Computer and Comet. Functional areas: Security, Engineering, Infrastructure, Legal, HR, GRC and Product development. Broader than OpenAI's 27001, whose scope names the business offerings only. Certificate held in the TrustyCyber vault.
Checked against ISO/IEC 27001:2022 certificate held in the TrustyCyber vault (supplied by Perplexity), Aug 24, 2026: Verified on the registry
Checked against FedRAMP Marketplace (fedramp.gov), Aug 28, 2026: Verified on the registry
Sources 18 — click to view
Appendix: standards landscape 8 — click to view
Where each standard behind this assessment stands today, from TrustyCyber’s continuously maintained standards radar.
Want to go further?
This scan assesses Perplexity at an organisational level. Assurance can vary significantly between products, models and agents — enter the product you’re evaluating to run a deeper AI System Assurance Scan.
Scan a specific product →This automated result is based on publicly available information at the time of scanning. It is not an audit, certification, legal opinion or assurance engagement. Publicly unavailable evidence may materially change the conclusion.