Vendor Privacy Scorecards
Is your AI tool safe for client information?
Your business is responsible for what your AI vendors do with your data. Each scorecard answers the questions an auditor or licensing board will ask, plan by plan, in plain English.
OpenAI
Depends on plan and settingsChatGPT
The most common AI assistant in small offices. The privacy picture changes completely between the personal plans and the business plans.
- Trains on your data
- Depends on plan
- HIPAA BAA
- Depends on plan
Anthropic
Depends on plan and settingsClaude
A strong writing and analysis assistant. Commercial plans keep your data out of training; personal plans ask each user to choose.
- Trains on your data
- Depends on plan
- HIPAA BAA
- Depends on plan
Microsoft
Strong on business plansMicrosoft 365 Copilot
AI built into Word, Outlook, Teams and Excel. On a business Microsoft 365 account it stays inside your existing Microsoft data protections.
- Trains on your data
- No
- HIPAA BAA
- Yes
Google
Depends on plan and settingsGoogle Gemini
AI built into Gmail, Docs and Drive, plus the Gemini app. Workspace business accounts and personal Google accounts follow very different rules.
- Trains on your data
- Depends on plan
- HIPAA BAA
- Depends on plan
GitHub (Microsoft)
Depends on plan and settingsGitHub Copilot
An AI coding assistant. Business and Enterprise plans keep your code out of training.
- Trains on your data
- Depends on plan
- HIPAA BAA
- No
Zoom
Depends on plan and settingsZoom AI Companion
Meeting summaries, transcripts and chat help inside Zoom.
- Trains on your data
- No
- HIPAA BAA
- Depends on plan
Canva
Depends on plan and settingsCanva Magic Studio
AI design and writing tools inside Canva for marketing work.
- Trains on your data
- Depends on plan
- HIPAA BAA
- No
Notion
Strong on business plansNotion AI
AI writing, search and summaries inside Notion workspaces.
- Trains on your data
- No
- HIPAA BAA
- Depends on plan
Asana
Strong on business plansAsana AI
AI summaries, status updates and workflow help inside Asana.
- Trains on your data
- No
- HIPAA BAA
- Depends on plan
Perplexity AI
Depends on plan and settingsPerplexity
An AI research and answer engine with cited sources.
- Trains on your data
- Depends on plan
- HIPAA BAA
- No
Slack (Salesforce)
Strong on business plansSlack AI
Channel recaps, thread summaries and search answers inside Slack.
- Trains on your data
- No
- HIPAA BAA
- Depends on plan
Grammarly
Depends on plan and settingsGrammarly
Writing suggestions and AI rewrites in email, documents and the browser.
- Trains on your data
- Depends on plan
- HIPAA BAA
- Depends on plan
Adobe
Strong on business plansAdobe Firefly
AI image and design generation inside Photoshop, Illustrator, Express and Firefly.
- Trains on your data
- No
- HIPAA BAA
- No
Midjourney
Use with careMidjourney
A popular AI image generator used for marketing art.
- Trains on your data
- Yes
- HIPAA BAA
- No
Otter.ai
Use with careOtter.ai
Meeting transcription and summaries that can join calls automatically.
- Trains on your data
- Depends on plan
- HIPAA BAA
- Depends on plan
Fireflies.ai
Depends on plan and settingsFireflies.ai
An AI meeting notetaker that records, transcribes and summarizes calls.
- Trains on your data
- No
- HIPAA BAA
- Depends on plan
Jasper AI
Depends on plan and settingsJasper
An AI marketing writer for blogs, ads, email and brand content.
- Trains on your data
- No
- HIPAA BAA
- No
Copy.ai
Depends on plan and settingsCopy.ai
AI writing and sales workflow automation.
- Trains on your data
- Depends on plan
- HIPAA BAA
- No
Descript
Depends on plan and settingsDescript
AI audio and video editing, transcription and voice cloning.
- Trains on your data
- Depends on plan
- HIPAA BAA
- No
ElevenLabs
Depends on plan and settingsElevenLabs
AI voice generation, voice cloning and AI phone agents.
- Trains on your data
- Depends on plan
- HIPAA BAA
- Depends on plan
Synthesia
Strong on business plansSynthesia
AI video with digital presenters, used for training and marketing videos.
- Trains on your data
- No
- HIPAA BAA
- No
HubSpot
Depends on plan and settingsHubSpot Breeze
AI assistants and agents inside the HubSpot CRM and marketing tools.
- Trains on your data
- No
- HIPAA BAA
- Depends on plan
Salesforce
Strong on business plansSalesforce Einstein
AI inside Salesforce CRM, including Agentforce agents.
- Trains on your data
- No
- HIPAA BAA
- Depends on plan
monday.com
Strong on business plansmonday.com AI
AI summaries, writing and automations inside monday.com boards.
- Trains on your data
- No
- HIPAA BAA
- Depends on plan
ClickUp
Depends on plan and settingsClickUp Brain
AI answers, writing and summaries across ClickUp tasks and docs.
- Trains on your data
- No
- HIPAA BAA
- Depends on plan
Coda (Grammarly)
Depends on plan and settingsCoda AI
AI writing and table help inside Coda docs.
- Trains on your data
- No
- HIPAA BAA
- No
Box
Strong on business plansBox AI
AI questions, summaries and extraction over files stored in Box.
- Trains on your data
- No
- HIPAA BAA
- Depends on plan
Loom (Atlassian)
Depends on plan and settingsLoom AI
AI titles, summaries and chapters for screen recordings.
- Trains on your data
- No
- HIPAA BAA
- No
Anysphere
Depends on plan and settingsCursor
An AI code editor that reads and writes code across a project.
- Trains on your data
- Depends on plan
- HIPAA BAA
- No
Mistral AI
Depends on plan and settingsMistral Le Chat
A European AI assistant and model platform.
- Trains on your data
- Depends on plan
- HIPAA BAA
- No
Inside AI Governance Rule Watch™, each scorecard sits next to the tool in your AI Tool Roster, and recording your review adds a dated entry to your Evidence Vault and permanent Diligence Ledger.
One unvetted AI tool can trigger a board investigation.
Regulators, licensing boards, and insurers ask for proof that you vetted every AI tool your business uses. AI Governance Rule Watch™ keeps your approved tool list, your vendor reviews and every decision in one dated record you can hand to an auditor the same day they ask.
Founding member rate. Cancel anytime. Plus applicable taxes. Renews until canceled. Not legal advice and not a compliance certification.