// Trust & Security Report
Microsoft Corporation
Bing Image Creator (and sibling Bing Video Creator) is a free, consumer-facing AI image/video generation feature built into Bing, accessed with a Microsoft account; it is a distinct product from Microsoft's paid enterprise AI offerings (Azure AI Foundry / Azure OpenAI Service, Microsoft 365 Copilot), which have separate certifications and contracts.
Certifications held
1
Maturity
Enterprise
Trains on your data
No
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on microsoft.com“With respect to personal data subject to the European Union General Data Protection Regulation (GDPR) and processed in connection with your use of the [Bing] services, you and Microsoft are independent controllers of that personal data ... [users have] the right to access, correct, restrict, delete, or transfer their personal data.”
> Show 8 unconfirmed / not-held certifications
source: learn.microsoft.comThe Azure ISO/IEC 27001 certificate covers Azure, Dynamics 365, Power Platform, and select Microsoft 365 cloud services. (Microsoft stopped issuing/accepting SOC 2 for security scope and uses ISO/IEC 27001 + 27701 instead; scope is the enterprise cloud services listed, which do not include the consumer Bing website or Bing Image Creator.)
source: learn.microsoft.comServices in scope: Azure, Dynamics 365, Microsoft 365, Power Platform ... The Azure ISO/IEC 27001 certificate covers Azure, Dynamics 365, Power Platform, and select Microsoft 365 cloud services.
source: azure.microsoft.comMicrosoft has achieved ISO/IEC 42001:2023 certification ... for both Azure AI Foundry Models and Microsoft Security Copilot. (Certification is scoped to those two products only; Bing / Bing Image Creator is not named as in scope.)
source: learn.microsoft.comNo public evidence that Bing Image Creator is a HIPAA-eligible / BAA-covered service. Microsoft's HIPAA Business Associate Agreement is offered only for in-scope Microsoft Online Services under an enterprise agreement; the free consumer Bing website is not one of those in-scope services.
source: bing.comNo public evidence. Bing Image Creator is a free consumer feature with no in-product payment flow (Microsoft Rewards points are used instead of card payment), so PCI DSS scope is not applicable to this product.
source: learn.microsoft.comThese certifications, where held by Microsoft, are documented as covering Azure/Microsoft 365/Dynamics 365 cloud services via the Service Trust Portal; no vendor-domain page lists the consumer Bing website or Bing Image Creator as in scope.
No public evidence located on a Microsoft vendor-domain page tying CSA STAR to the consumer Bing Image Creator product specifically.
No public evidence. FedRAMP authorizations Microsoft holds apply to Azure Government / GCC cloud offerings, not the public consumer Bing website.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Not offered
Data region
Not specified for this consumer product; no data-residency commitment found on a Bing/Microsoft page for Bing Image Creator (contrast with Azure's documented regional data-residency options for enterprise customers).
Bing Image Creator's own Help/FAQ states uploaded images are used only to fulfill the request and to improve image-processing services generally, and are explicitly NOT used 'zum Trainieren von KI-Modellen oder zur Personalisierung Ihrer Erfahrung' (to train AI models or personalize your experience), and that Microsoft does not attempt to identify faces in uploaded images. This is narrower than Microsoft's general Privacy Statement, which states company-wide that 'we may use your data to develop, train, and fine-tune our AI models, including large language models (LLMs).' The product-specific FAQ is treated as authoritative for Bing Image Creator, but the broader Privacy Statement language creates disclosure ambiguity worth flagging to users.
// Security controls
Account authentication required
Unauthenticated users cannot generate creations; a Microsoft account (MSA) sign-in is required to use the online services.
bing.comUpload retention limit
"Bilder, bei denen Gesichter erkannt werden, werden nach 30 Tagen gelöscht; wenn keine Gesichter erkannt werden, können Bilder bis zu 18 Monate gespeichert werden." (Uploaded images in which faces are detected are deleted after 30 days; images with no detected faces may be stored for up to 18 months.)
bing.comAI content provenance / watermarking
Bing Image Creator applies a visible watermark plus an invisible, C2PA-standard digital watermark (Content Credentials) recording creation time/date and confirming AI provenance; Microsoft is a C2PA founding member.
blogs.bing.comAcceptable use / content moderation
Code of Conduct in the Terms of Use prohibits harmful, deceptive, non-consensual biometric, CSAM, and other disallowed content; prompts/outputs that violate the policy may be blocked, restricted, or removed, and repeated violations can suspend the account.
bing.com// Products & data scope
data: User prompts and optionally uploaded reference images; outputs ("creations") saved to the user's history for up to 90 days per vendor FAQ summary; no enterprise contract, DPA, or BAA available.
Previously powered by DALL-E 3, which the vendor's own home page states is being retired in the coming weeks in favor of newer models; a paid/enterprise equivalent for programmatic image generation is Azure OpenAI / Azure AI Foundry, a separate product with its own (different) certification scope.
data: Same account/session model as Image Creator; realistic uploaded faces for video generation are restricted per the Code of Conduct.
Bundled under the same Terms of Use and FAQ as Bing Image Creator.
// What to watch
- Bing Image Creator is a free consumer feature of the Bing website, not a contracted enterprise service. It is explicitly NOT within the audit scope of Microsoft's Azure/Dynamics 365/Microsoft 365/Power Platform ISO 27001, SOC 2, or ISO/IEC 42001 (Azure AI Foundry / Security Copilot) certificates. Do not credit this product listing with Microsoft's enterprise-cloud certifications; those belong to different, separately-scoped Microsoft products.
- Possible disclosure contradiction: the product-specific Help/FAQ says uploaded images/prompts are NOT used for AI model training, while Microsoft's company-wide Privacy Statement says user data generally 'may' be used to train and fine-tune AI models. Treated the narrower, product-specific FAQ as authoritative here, but this should be reverified periodically since Microsoft policy pages change.
- No HIPAA Business Associate Agreement is available for this consumer product; PHI/regulated health data should not be entered into Bing Image Creator.
- No dedicated trust center, security page, or DPA exists for Bing Image Creator; under GDPR, Microsoft and the user are described as independent data controllers for this consumer service (Microsoft is not acting as a data processor under its enterprise Online Services DPA here).
// At a glance
Pricing model
Free for consumers; faster/priority generations can be unlocked with Microsoft Rewards points rather than a cash purchase. No paid enterprise tier of "Bing Image Creator" itself exists.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Microsoft Corporation's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-27. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
microsoft.com