Is Luma AI (Dream Machine) safe for work?
Medium risk · 44Luma AI · Video · facts (high-confidence)
Luma AI (Dream Machine) is medium-risk for default at-work use (44/100): it trains on your data unless you opt out.
44
Medium risk
Watch out: Luma trains on your content on consumer tiers; only Enterprise and API get a contractual no-training guarantee. It is explicitly not HIPAA-ready and has no verified SOC 2 or ISO 27001, so treat it as a creative tool rather than a compliance-grade one.
Data and compliance facts
- Trains on consumer-tier data
- Opt-out
- Trains on business-tier data
- No
- Training opt-out available
- Yes
- SOC 2 Type II
- Unverified
- ISO 27001
- Unverified
- ISO 42001 (AI management)
- Unverified
- GDPR Data Processing Addendum
- Yes
- HIPAA BAA
- No
- EU data residency
- No
- SSO / SAML
- Yes
- Data retention
- Input exportable for 30 days after account or subscription termination, after which Luma may delete it; content already incorporated into models is not removed.
- Safer tier
- Enterprise or API (only tiers with a contractual no-training guarantee, DPA and SSO)
Why it scores 44 out of 100
- +19Trains on your data. Training is on by default on the consumer tier; you must find and set the opt-out.
- +14HIPAA BAA. A Business Associate Agreement, required for protected health information.
- +11EU data residency. Whether data can be kept in the EU.