Coda AI

Data-handling profile

Trains on input

No — does not train on customer inputs

Retention

Customer data is retained as long as the account is active or as needed to provide services; users can delete content at any time, triggering permanent deletion from production servers within 30 days.

Data region

United States (primary), with options for enterprise customers to request specific data residency in certain regions (e.g., EU) via enterprise contracts.

Certifications

SOC 2 Type IIISO/IEC 27001ISO/IEC 27018HIPAA compliant (via BAA)

DPA available

Yes

Breach history

No major public history of unauthorized data breaches involving customer PII.

EU AI Act

As a provider of AI-integrated productivity tools, Coda is subject to the transparency requirements of the EU AI Act; they explicitly state they do not use customer data to train their underlying AI models.

Sources

• https://coda.io/trust
• https://coda.io/trust/privacy
• https://coda.io/legal/termslink no longer resolves
• https://help.coda.io/en/articles/8394464-how-coda-ai-uses-your-datalink no longer resolves

Every fact above is drawn from the vendor's public documentation, reviewed by a human, and version-stamped. Monitored daily for changes. 2 of these 4 links no longer resolve. We record what we relied on rather than deleting it, so the trail stays auditable — but a struck-through source cannot be re-checked today.

Control mapping

Obligations this vendor triggers, each attributable to the fact it rests on — for your supplier register, not a compliance determination.

• EU AI Act Art. 50 — Transparency obligations for AI systemsok

  trains_on_input = no. Vendor states inputs are not used for training.

• EU AI Act Art. 26 — Obligations of deployers of high-risk AI systemsapplies

  Applies to your organisation as deployer, independent of vendor. Assign human oversight, keep logs, and monitor operation where this tool is used in a high-risk context (Annex III duties apply from 2 Dec 2027).

• ISO/IEC 27001 A.5.19 — Information security in supplier relationshipsapplies

  Coda AI processes organisational data as a supplier. Include this vendor in the supplier register and risk assessment.

• ISO/IEC 27001 A.5.20 — Addressing information security within supplier agreementsok

  dpa_available = true. A data processing agreement is available and should be executed.

• ISO/IEC 27001 A.5.23 — Information security for use of cloud servicesapplies

  Cloud AI service; trains_on_input = no. Define acceptable-use and configuration rules for this cloud service.

• ISO/IEC 42001 A.10.3 — Suppliers of AI systems and servicesapplies

  certifications: SOC 2 Type II, ISO/IEC 27001, ISO/IEC 27018, HIPAA compliant (via BAA) No AI-management certification identified; assurance must come from your own supplier assessment.

• GDPR Art. 44–49 — International transfers of personal dataok

  data_region = United States (primary), with options for enterprise customers to request specific data residency in certain regions (e.g., EU) via enterprise contracts.. Processing region is within the EU/EEA.

• NIS2 Art. 21(2)(d) — Supply chain securityapplies

  AI vendor forms part of your ICT supply chain. In scope for entities covered by NIS2; include in supply-chain risk measures.

• DORA Art. 28 — General principles for ICT third-party riskapplies

  AI vendor is an ICT third-party service provider. For financial entities: register of information and contractual requirements apply.

Change history

No material changes recorded since monitoring began.