Civitai Inc.

Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.

• OVER-CLAIM DETECTED: Nudge Security vendor profile lists SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS, FedRAMP, and CSA STAR Level 1 compliance for Civitai. However, ZERO of these certifications are published or referenced on civitai.com. Extensive site searches and direct fetches of privacy/terms pages yield no vendor-domain proof. This is either a questionnaire error, outdated information, or misrepresentation by the third-party vendor tool.
• MATERIAL DATA-USE GAP: Privacy policy explicitly does not address AI model training, data retention, or deletion procedures. Terms grant broad content license rights but do not clarify data-use boundaries. For a platform where users upload AI models, this is a critical compliance gap.
• SECURITY DISCLAIMER: Civitai explicitly disclaims all security guarantees ('we can make no guarantees as to the security or privacy of your information'). This is not typical of enterprise-grade platforms.
• NO GDPR INFRASTRUCTURE: Privacy policy mentions GDPR only in the context of acknowledging data transfers to the U.S., with no mechanism for exercising GDPR rights (right to access, erasure, portability, etc.).
• LIMITED 2FA SUPPORT: Nudge profile reports no or very limited 2-factor authentication options, limiting account security controls.
• NO DPA AVAILABLE: As a consumer platform, Civitai does not appear to offer Data Processing Agreements for B2B/enterprise use.
• STARTUP MATURITY: Founded 2022, seed-stage company with a16z backing. No indication of enterprise security programs (vulnerability disclosure, penetration testing, bug bounty, incident response SLA).
• USE-CASE RISK: Platform enables generation and sharing of deepfakes and NSFW content (with stated policies against real-person deepfakes and CSAM). Regulatory risk in jurisdictions restricting such content (e.g., UK, Australia).