Hugging Face Inference
low riskAI Productivityhuggingface.coverified 2026-06-27
Data-handling profile
- Trains on input
- No — does not train on customer inputs
- Retention
- Hugging Face does not store request bodies or responses for routed Inference Provider traffic; debug logs kept up to 30 days without storing user data or tokens. Serverless Inference API may cache tokens briefly (minutes) to speed repeated requests. Does not use user data for training.
- Data region
- Global
- Certifications
- SOC 2 Type II
- DPA available
- Yes
- Breach history
- none known
- EU AI Act
- As a model hub and inference router aggregating many third-party model providers, EU AI Act obligations vary per underlying provider routed to; Hugging Face itself publishes no first-party training-on-input practice.
Sources
- https://huggingface.co/privacy
- https://huggingface.co/docs/inference-providers/en/security
- https://huggingface.co/chat/privacy
Every fact above is drawn from the vendor's public documentation, reviewed by a human, and version-stamped. Monitored daily for changes.
Change history
No material changes recorded since monitoring began.