How does the assessment decide?

It combines the data you would enter (public, PII, PHI, financial, source code, confidential) with the tool's sourced facts: whether it trains on your data, and its HIPAA BAA, SOC 2 and GDPR DPA status. PHI without a BAA, or sensitive data with default training, produces a reject or conditional verdict.

Is it a substitute for legal or security review?

No. It is a fast first-pass triage to focus your review, not legal advice or a certification. Confirm the current tier and terms with the vendor before relying on any result.

Where do the facts come from?

Each tool's data-handling facts are compiled from the vendor's own privacy policy, DPA and trust centre, with a source link on the tool's profile. Anything unverified is treated as a gap, not assumed safe.

Free tool

AI vendor risk assessment

Answer one question, is this AI tool safe for the data we would put into it, in under a minute. Pick a tool and your data types for an explainable verdict you can export for your records.

AI tool

What data would go into it?

Public / non-sensitiveMarketing copy, published contentPersonal data (PII)Names, emails, customer recordsHealth data (PHI)Anything covered by HIPAAFinancial dataAccounts, transactions, card dataSource codeProprietary or client codeConfidential / IPUnreleased plans, contracts, secrets

approve

Looks safe for this use

Ada · risk score 0/100 (Low)

✓Does not train on your data by default.
✓Holds a SOC 2 report.
✓Offers a GDPR Data Processing Agreement.

See the full Ada risk profile, then capture the decision in a free AI usage policy.

About this tool

How does the assessment decide?: It combines the data you would enter (public, PII, PHI, financial, source code, confidential) with the tool's sourced facts: whether it trains on your data, and its HIPAA BAA, SOC 2 and GDPR DPA status. PHI without a BAA, or sensitive data with default training, produces a reject or conditional verdict.
Is it a substitute for legal or security review?: No. It is a fast first-pass triage to focus your review, not legal advice or a certification. Confirm the current tier and terms with the vendor before relying on any result.
Where do the facts come from?: Each tool's data-handling facts are compiled from the vendor's own privacy policy, DPA and trust centre, with a source link on the tool's profile. Anything unverified is treated as a gap, not assumed safe.