Stability AI
medium riskAI Media Generationstability.aiverified 2026-06-27
Data-handling profile
- Trains on input
- Unknown / not publicly stated
- Retention
- API data is stated to be excluded from model training and deleted after a short retention window; general personal information retained no longer than necessary for stated purposes, with no purpose exceeding one year. VPC/self-hosted deployment available for data sovereignty. Consumer-product (Stable Assistant/DreamStudio) training-on-input specifics not clearly published — marked unknown pending direct confirmation of consumer-tier terms.
- Data region
- Global
- Certifications
- SOC 2 Type IISOC 3
- DPA available
- Yes
- Breach history
- none known
- EU AI Act
- SOC 2 Type II/SOC 3 certification and VPC self-hosting support enterprise EU AI Act compliance for the API/enterprise tier; open-weight model distribution (Stable Diffusion) separately raises downstream-use and provenance questions relevant to the Act's GPAI transparency obligations.
Sources
- https://stability.ai/privacy-policy
- https://stability.ai/news-updates/stability-ai-achieves-soc-2-type-ii-and-soc-3-compliance
Every fact above is drawn from the vendor's public documentation, reviewed by a human, and version-stamped. Monitored daily for changes.
Change history
No material changes recorded since monitoring began.