Is ChatGPT SOC 2 Compliant? Claude, Cursor, Copilot and More, by Plan

ChatGPT's SOC 2 Type 2 covers Business, Enterprise and Edu, not Free, Plus or Pro. Anthropic's covers Claude Team, Enterprise and the API, not Free, Pro or Max. Of the 29 tools checked 13 Oct 2026, 26 publish or list a SOC 2 Type 2 and 8 name the plan it covers. We have not seen the reports.

Related: SOC 2 vendor management and CC9.2; SOC 2 controls for AI agents and MCP; the AI agents inside compliance platforms.

Facts come from each vendor's own trust centre, security and policy pages, read on the date shown. We have not seen the reports themselves. Not stated and Not listed by vendor mean the vendor's pages do not say, which is not proof that the vendor lacks it.

The line under each SOC 2 cell shows how closely the evidence ties to the product. Product named: the vendor names this product or plan in its SOC 2 scope. Company-wide: the vendor states a report but does not itemise which products it covers. Weaker evidence: the claim is inferred, covers the platform rather than the AI feature, or rests on a statement with no report listing seen.

Every cell restates what the vendor’s own trust, security, help or legal pages say, dated in the table caption. A fact shown as unpublished means those pages do not say, which is not evidence the answer is no.

Names change. ChatGPT Team is now Business, Windsurf is now Devin Desktop, Le Chat is now Vibe, Vertex AI is now Gemini Enterprise Agent Platform, and Microsoft Learn now calls Microsoft 365 Copilot “Microsoft Copilot”. Grammarly’s trust page speaks as Superhuman.

Is ChatGPT SOC 2 compliant?

Yes for ChatGPT Business, Enterprise and Edu, which are in OpenAI’s SOC 2 Type 2 scope. The Free, Plus and Pro plans are not listed. OpenAI’s product compliance matrix (version 1.1, 4 August 2026) also lists ChatGPT for Healthcare, ChatGPT for Teachers, Codex and the API Platform. OpenAI’s trust portal says the latest report covers 1 July 2025 to 30 June 2026 and was announced on 28 August 2026. The criteria are Security, Availability, Confidentiality and Privacy. Processing Integrity is not among them.

The matrix also splits the paid plans. ChatGPT Business is in SOC 2 scope but is not marked in the ISO 27001 or ISO 27701 columns, while Enterprise, Edu and the API Platform are. Older pages say “ChatGPT Team” is SOC 2 compliant; OpenAI has since renamed Team to Business.

Is Claude SOC 2 compliant?

Yes for Claude Team, Claude Enterprise and the Anthropic API, which Anthropic’s trust centre marks for SOC 2 Type 2. Free, Pro and Max are not in its scope table. Anthropic’s certifications article says it covers commercial products. The trust centre lists a 2025 SOC 2 Type 2 report, a 2025 SOC 3 and bridge letters dated August 2026 and October 2026, but shows no observation period.

Claude Code follows the terms of the account it is signed in with: Anthropic’s commercial terms apply under a Team, Enterprise or API login, and the consumer terms under Free, Pro or Max. A report that covers Claude Team does not cover a developer on a personal Pro plan.

Are Cursor, GitHub Copilot, Microsoft 365 Copilot and Gemini SOC 2 compliant?

Each answer below names the plan it applies to.

Is Cursor SOC 2 compliant?

Cursor states a SOC 2 Type II attestation for the company, with no plan itemized. Cursor’s security page (25 August 2026) states it, and the trust centre lists the attestation report. Teams and Enterprise are the managed plans. Its public pages show no observation period, criteria or auditor.

Is GitHub Copilot SOC 2 compliant?

Yes for Copilot Business and Copilot Enterprise; GitHub does not claim the individual plans (Free, Pro, Pro+, Max). GitHub’s Copilot trust centre FAQ says both business plans were included in GitHub’s latest SOC 2 Type 2, after a Type I for Copilot Business.

Is Microsoft 365 Copilot SOC 2 compliant?

Not confirmed for Microsoft 365 Copilot, the commercial Copilot; the consumer Copilot app is a different service. Microsoft publishes Office 365 SOC 1 and SOC 2 Type 2 reports, but its SOC 2 page (9 April 2026) does not name Copilot in the Office 365 in-scope list. The Copilot privacy page (18 August 2026) lists ISO 27001, HIPAA and ISO 42001 but not SOC 2. That is a gap in the public statement, not proof of a gap in the report. The Office 365 report on Microsoft’s Service Trust Portal, which needs an Office 365 account or free trial, would settle it: check whether Copilot appears in its system description.

Is Gemini SOC 2 compliant?

It depends on which Gemini.

• Gemini in Google Workspace (business and enterprise editions): Google says “Gemini has attained SOC 1/2/3” and, on a separate page, that its core Cloud and Workspace SOC 2 reports are Type II. No Google page joins the two, so the scope is inferred. Gemini Notebook and Gemini in Chrome are excluded, and the consumer Gemini app is separate.
• Gemini on Vertex AI, now the Gemini Enterprise Agent Platform: named in Google’s SOC 2 services-in-scope list.
• Gemini API and Google AI Studio: the API terms make no compliance claim, and the product is not in Google’s SOC 2 or HIPAA scope lists as retrieved. For a documented SOC 2 scope, Vertex is the Gemini product Google lists.

Does the SOC 2 report cover the plan your team uses?

Often only part of it. A SOC 2 report describes one system over one period, and vendors scope that system by product or plan. Of the tools that list a Type 2, 8 name the product or tier in scope. For most of the others the vendor states a company-wide report without itemizing products, so the public pages do not show whether the AI feature sits inside the audited system.

Naming the AI feature is the exception worth looking for. Notion says Notion AI is in the scope of its SOC 2 Type 2 report, and v0’s docs say v0 is in Vercel’s attestation. At the other end, Zoom’s SOC 2 is described at platform level, and no Zoom page says AI Companion is inside the audited system.

Criteria differ too: OpenAI’s report lists four, v0’s three, and Replit’s is Security only. If staff paste customer data into a tool, check that Confidentiality is among them.

A Type 2 describes a past window, and few vendors print theirs:

• OpenAI: 1 July 2025 to 30 June 2026.
• Lovable: 1 February to 1 August 2026,, published 5 October 2026 with no exceptions noted. It is Lovable’s first Type 2; a Type I came first, so many older posts say Type I only.
• Replit: 2 June 2024 to 31 October 2025, Security criteria only.
• Zoom: 16 October 2024 to 15 October 2025, with a bridge letter and no newer report seen.

For the rest the period sits behind the report. Ask for it, and for the bridge letter that covers the time since. Some evidence is thinner: Bolt says it holds a SOC 2 Type 2 and its trust profile lists one, but no report entry or period is public, and Jasper’s security page says only “SOC 2 Compliant” while its trust centre lists a Type 2 PDF.

The tools with no stated Type 2 are Gemini API and Google AI Studio, Microsoft 365 Copilot and Tabnine. The table shows what each vendor’s pages say. For how to read a Type 2 once you have it, see what a SOC 2 Type 2 report contains.

Which AI tools will sign a HIPAA BAA?

A BAA path exists for 19 of the 29 tools, and 8 of those tie it to no single plan. The vendors that limit it to named plans or services are ChatGPT, Claude, Cohere, Cursor, ElevenLabs, Fireflies.ai, Grammarly, Granola, Notion AI, Otter.ai and Perplexity. A BAA is a contract with the vendor and is separate from SOC 2; for how the two frameworks relate, see SOC 2 vs HIPAA. The plan caveats the table cannot hold:

• ChatGPT. OpenAI states, “We do not offer a BAA for ChatGPT Business.” Its BAA article sends sales-managed Enterprise and Edu accounts to sales, but its HIPAA-eligible list names ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace and ChatGPT for Clinicians, and does not list Edu. Confirm Edu with OpenAI. Free, Plus and Pro are not listed. The OpenAI API has a self-serve BAA for organizations with an established history of API usage; it covers the “API with Modified Retention” configuration.
• Claude and the Anthropic API. Claude Enterprise only, after the Primary Owner switches on HIPAA settings and accepts the BAA; Team shows HIPAA as not applicable. Anthropic’s BAA article excludes Claude Console, Cowork in the cloud and beta features such as Claude in Office, Design, Slides and Docs. For the API, covered models need 30-day retention and are not available with zero data retention unless Anthropic authorizes it.
• Microsoft 365 Copilot and Gemini. Microsoft includes a BAA by default through its Online Services Data Protection Addendum, and Microsoft Copilot and Copilot Chat are on its HIPAA in-scope list (page dated 29 July 2025). Google’s Workspace BAA includes Gemini but not Gemini Notebook or Gemini in Chrome.
• GitHub Copilot. No BAA is published. GitHub’s Data Protection Agreement (version October 2025, clause 12) bars protected health information “except with GitHub’s prior, written, and specific consent”.
• Lovable and Replit. Lovable states it does not sign BAAs. Replit says it does not sign them for standard hosting.

A HIPAA badge is not a BAA. Writer’s trust centre lists a 2026 “SOC 2 Type II + HIPAA” report, yet none of Writer’s pages says it signs a BAA. Cohere’s trust centre shows a HIPAA badge while its commitments page says its BAA covers custom model development only, not its SaaS products. Perplexity’s trust centre lists a “HIPAA Gap Assessment”, which is not an attestation.

Which AI tools are ISO 42001 certified?

15 of the 29 tools list an ISO/IEC 42001:2023 certificate: Anthropic API, ChatGPT, Claude, Cohere, Cursor, ElevenLabs, Fireflies.ai, Gemini in Google Workspace, Gemini on Vertex AI, GitHub Copilot, Glean, Grammarly, Microsoft 365 Copilot, OpenAI API Platform and Writer. ISO 42001 certifies an AI management system. It is a different standard from SOC 2 and from ISO 27001, which 23 of the 29 list. See our ISO 42001 framework guide for the standard itself.

• Microsoft’s ISO 42001 page (11 September 2026) lists Microsoft Copilot, Microsoft Copilot Chat and GitHub Copilot among the AI services in scope.
• Lovable’s trust centre lists AIUC-1 (27 July 2026) instead of ISO 42001, and Cursor and ElevenLabs list AIUC-1 alongside it. See AIUC-1, the certification for AI agents.

No public vendor page names the certification body for any of these certificates. The certificates sit in trust centres, some behind a request, so ask for the certificate and read its scope statement and issuer. SOC 2 has no AI-specific criteria, so a vendor’s ISO 42001 certificate is extra evidence for your vendor file, not something the SOC 2 criteria ask for.

Do these tools train on your data?

It depends on the plan. These vendors say customer content is not used to train models, with no split by plan: Fireflies.ai, Glean, Jasper, Microsoft 365 Copilot, Tabnine, Writer and Zoom AI Companion. At the rest, free, individual and self-serve plans often work differently, and vendors set the defaults in different places:

• ChatGPT and Claude. On ChatGPT Free, Plus and Pro, content is used unless the user opts out, and thumbs-up or thumbs-down feedback can still send a whole conversation into training. On Claude Free, Pro and Max, content is used if the user allows model improvement, if a chat is flagged for safety review, or through opt-in programs. Anthropic’s article does not state the default for that setting.
• Cursor. With Privacy Mode on, Cursor says content is not used for training; with it off, Cursor may store and train on code, prompts and edits. It is on by default for Teams and Enterprise members.
• GitHub Copilot. Individual Free, Pro, Pro+ and Max: GitHub may use prompts, suggestions and code snippets unless the user opts out.
• Gemini API. Unpaid services: Google uses submitted content to improve its products and human reviewers may read it. Paid services: it does not.
• Grammarly. Training is on by default for Free, Premium and single-user Pro accounts. Multi-user team accounts bought on the website start with it on, and an admin can turn it off. Accounts bought through Sales start with it off.
• Otter.ai. Says it trains its models on user audio and transcripts after automatic de-identification. Its public pages describe no tier or admin opt-out.
• Bolt. New terms took effect for existing accounts on 7 October 2026. Unless a user opts out, Bolt may use prompts, outputs, interaction data and project files to train models and may license de-identified datasets to third parties for compensation. The terms exclude accounts in the EEA, UK or Switzerland, organization-managed accounts unless an admin enables it, and accounts under a separate written agreement.
• Devin Desktop (Windsurf). Cognition’s Devin security page says data may be used for training by default, paid plans can opt out and Enterprise is never used without written consent. That page covers Devin; it does not say whether the same default applies to Devin Desktop.

Replit states no training default, and Cohere’s SaaS platform has an opt-out toggle whose default its commitments page does not state. Retention is a separate setting: Notion does not train on customer data by default, yet its LLM providers keep data up to 30 days outside Enterprise.

How do you get an AI vendor’s SOC 2 report?

Request it through the vendor’s trust centre. Microsoft and Google publish theirs for download behind an account, and a few vendors say they require an NDA first.

• Trust-centre request. OpenAI requires an account on its trust portal. Anthropic, Cursor and GitHub have a “Request access” step; Cursor says access typically arrives within one business day.
• Account portals. Microsoft’s Service Trust Portal needs an Office 365 subscription or free trial account. Google’s Compliance Reports Manager offers SOC 2 Type II reports and monthly bridge letters for download.
• NDA first. Cognition (Windsurf, now Devin Desktop) has you request access and then sign an NDA in its portal. Replit shares the full report under a mutual NDA and lists a letter of attestation separately. Cohere requires a signed mutual NDA first. Grammarly’s public text names no portal.
• Split access. Mistral’s attestation letter is viewable; the full report is for Enterprise customers only.

OpenAI, Anthropic, GitHub, Notion, Vercel and ElevenLabs also list a SOC 3. It is the general-use version of an examination and does not replace the SOC 2 when your auditor wants to see the tests.

Trust centres move: Jasper changed portals on 14 August 2026 and everyone with earlier access had to request it again. Record the date you downloaded each report.

What should your vendor review check beyond the report?

Check what the report cannot tell you: which plan your staff are on, how it is configured, and where the vendor sends your data. A vendor’s SOC 2 describes the vendor’s controls over a period. It does not describe how your staff configure or use the tool, and it covers the criteria the vendor chose, not AI-specific outcomes such as accuracy or bias. For the vendor file, record the plan each team uses and whether the report, the BAA and the training terms apply to it, then the training and retention setting and who controls it.

Also record the vendor’s own AI providers. Microsoft names Anthropic and OpenAI models as subprocessors inside Copilot. Zoom names OpenAI and Anthropic as third-party models. Plans and terms change, so date each entry; Bolt’s data terms changed for existing accounts on 7 October 2026.

For the general vendor-review process, see SOC 2 vendor management and CC9.2. For tools that act through connected systems rather than just answer, such as coding agents and MCP servers, see SOC 2 controls for AI agents and MCP. For shadow AI, see SOC 2 for companies that use or build AI. For the AI agents inside compliance platforms, see what each platform’s AI agents do.