// Trust & Security Report
Adobe Firefly
by Adobe Inc.
Adobe Firefly is Adobe's generative AI image and content creation platform, available as a standalone tool (firefly.adobe.com), within Creative Cloud, Adobe Express, and as an API. Firefly generates images, applies intelligent edits (Generative Fill, Expand, Match), and creates text effects powered by licensed datasets and public domain content.
Certifications held
13
Maturity
Enterprise
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on blog.adobe.com“We are pleased to report that Adobe has achieved SOC 2 – Type 2 (Security & Availability) and ISO 27001:2013 certifications for enterprise products within Adobe’s cloud offerings:”
Verify on adobe.com“Read now Prev 1 2 3 4 Next Frequently asked questions SOC 1 SOC 2 SOC 2 + HIPAA SOC 3 ISO 27001 ISO 27017 ISO 27018 ISO 22301 ISO 9001 SSPA (Microsoft) CSA STAR Level 2 BSI C5 TISAX Spain ENS KFSI CSP Self”
Verify on blog.adobe.com“We are pleased to report that Adobe has achieved SOC 2 – Type 2 (Security & Availability) and ISO 27001:2013 certifications for enterprise products within Adobe’s cloud offerings:”
Verify on adobe.com“purpose limitation, and customer control over personal data. Read now ISO 27017:2015 Code of practice adding cloud-specific security controls for cloud service providers and customers, assessed as an”
Verify on adobe.com“processes, customer satisfaction, and continual service improvement. Read now ISO 27018:2019 Code of practice for public cloud PII processors covering transparency, purpose limitation, and customer control”
Verify on adobe.com“ISO 9001:2015 included in Adobe Firefly compliance certifications”
Verify on adobe.com“ISO 22301:2019 included in Adobe Firefly compliance certifications”
Verify on adobe.com“Creative Cloud for enterprise edition is built with compliance at its core and supports certifications such as...FedRAMP Tailored”
Verify on adobe.com“Creative Cloud for enterprise supports certifications such as...GLBA ready”
Verify on adobe.com“assessed by TrustArc and recognised across APEC member economies. Read now TISAX ENX-governed automotive industry information security assessment required across the supply chain. Applies to Adobe San”
Verify on adobe.com“to evaluate vendor security controls and data protection practices. Read now CSA STAR Level 2 Third-party certification against the Cloud Security Alliance Cloud Controls Matrix, building on ISO 27001.”
> Show 3 unconfirmed / not-held certifications
source: adobe.comAdobe Firefly as a creative tool is not among the designated HIPAA-ready services. While Adobe offers HIPAA-ready services with BAA support, these are limited to specific products such as Adobe Acrobat Sign and selected Experience Cloud components deployed in health data-ready environments, not Firefly.
source: business.adobe.comAdobe references ISO 42001 in its responsible AI adoption framework and awareness materials, but no public evidence that Adobe Firefly has obtained ISO/IEC 42001 certification.
source: adobe.comAdobe maintains PCI DSS v4.0 compliance in its Common Controls Framework, but no specific evidence Firefly itself is directly PCI DSS certified (PCI is typically for payment processors).
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
Firefly inference processes and stores reference/generated content in AWS US-East and US-West data centers. Creative Cloud for Enterprise more broadly uses regional data centers in North America, Europe, and Japan, with content stored in the region assigned at user provisioning.
Adobe Firefly does NOT train on customer Creative Cloud or Experience Cloud subscriber personal content or Firefly inputs/outputs. Firefly models are trained exclusively on licensed content (e.g., Adobe Stock) and public domain content where copyright has expired. However, customers' cloud-stored content (Adobe Cloud Documents, Behance, Adobe Stock) MAY be used to help improve Adobe services by default. Users can disable this setting and/or use Content Credentials 'Do Not Train' signal to explicitly prevent AI systems from using their work for future training or style imitation.
// Security controls
Encryption in Transit
HTTPS/TLS encryption for all data transmitted to and from Firefly services
adobe.comEncryption at Rest
AES 256-bit encryption for reference content and generated output stored in AWS S3 buckets; customer cloud-stored content encrypted according to region-specific key management
adobe.comData Retention
User-uploaded reference content for Firefly is stored in AES 256-bit encrypted AWS S3 and is deleted within 24 hours after initial creation (for inference purposes)
adobe.comAudits & Assessments
Annual SOC 2 audits, regular penetration testing, and third-party security assessments; customers can request SOC 2 reports
docs.firefly.aiContent Moderation
Adobe may access, view, and moderate user content through automated and manual methods for compliance, safety, and legal purposes
adobe.com// Products & data scope
Data it handles: Image prompts, reference images, generated outputs; cloud storage optional
Available at firefly.adobe.com; free and paid tiers. Generates images, applies intelligent edits (Fill, Expand, Match), and creates text effects.
Data it handles: Project files, reference content, generated content; all stored in Creative Cloud by default if logged in
Includes Firefly; available as web app and desktop/mobile apps; free and premium plans
Data it handles: All Creative Cloud apps including Firefly; enterprise data centers with regional storage
Includes Firefly with enterprise compliance controls (DPA, BAA options, HIPAA-ready availability for other products, audit logging)
Data it handles: API calls with image prompts, reference images, generated content; outputs stored per API configuration
Developer access to Firefly generative capabilities; supports Generative Fill, Expand, Match, and text effects; quota-based pricing
Data it handles: User-supplied training images; custom model outputs; training data and models remain private
Enables users to train custom Firefly models on their own artistic styles; training uploads not folded back into Adobe's broader Firefly models
// What to watch
- Firefly is a creative and generative AI tool, not designed for processing Protected Health Information (PHI). It is not HIPAA-ready even though Adobe offers HIPAA-ready services for other products, so treating Firefly as HIPAA-compliant would be inaccurate.
- Cloud-stored content (not prompts or inputs) may be used to improve Adobe services by default. Users must explicitly disable this setting and/or use Content Credentials to prevent training, which is a compliance consideration for regulated data.
- In June 2024, Adobe faced backlash over ambiguous terms-of-service language that raised concerns about AI training on customer data. Adobe has since clarified and reiterated its commitment not to train Firefly on subscriber content, and current documentation is clear on this point.
- While Adobe references ISO 42001 in its responsible AI frameworks, there is no public evidence that Firefly holds ISO/IEC 42001 (AI Management Systems) certification. Adobe appears aware of the standard but not certified against it.
- GDPR and data processing agreement (DPA) coverage for Firefly is available only with enterprise Creative Cloud licensing. Free and individual plans do not include DPA coverage.
- While Adobe offers Business Associate Agreements for certain health-data-ready products, Firefly is excluded from HIPAA BAA coverage. Healthcare organizations cannot use Firefly for PHI processing.
// At a glance
Pricing model
Freemium (Firefly.adobe.com with monthly free generations); subscription-based for Creative Cloud (Single App, All Apps, Teams); API and Custom Models use token/credit consumption
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Adobe Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
adobe.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.