// Trust & Security Report
Microsoft Corporation (Clipchamp by Microsoft)
Cloud-based video editing platform with AI features (auto-cut, auto-compose, transcription, voiceovers). Available as free personal editor, premium add-on, and enterprise 'Clipchamp for Work' integrated with Microsoft 365.
Certifications held
7
Maturity
Enterprise
Trains on your data
Unknown
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on learn.microsoft.com“Microsoft 365 (of which Clipchamp is part) has SOC 2 Type 2 certification. Clipchamp for Work follows Microsoft 365 compliance protocols outlined in the Microsoft Trust Center.”
Verify on learn.microsoft.com“Microsoft 365 (including Clipchamp for Work) is certified to ISO/IEC 27001:2013. Azure ISO/IEC 27001 certificate covers Azure, Dynamics 365, Power Platform, and select Microsoft 365 cloud services.”
Verify on clipchamp.com“Clipchamp's blog post (posted January 4, 2023) states verbatim: 'The compliance, privacy and security information that applies to Clipchamp for work is available in the Microsoft Trust Center in the Microsoft 365 section.' Microsoft 365 services are GDPR compliant under the Microsoft Data Protection Addendum, and Clipchamp for Work data stored on OneDrive/SharePoint inherits Microsoft 365's GDPR compliance framework. No Clipchamp-specific GDPR attestation is published on clipchamp.com; the blog post itself does not mention GDPR by name.”
Verify on learn.microsoft.com“As a Microsoft 365 service, Clipchamp for Work inherits Microsoft 365's HIPAA compliance certification when used within a HIPAA-covered entity configuration through Microsoft 365.”
Verify on learn.microsoft.com“Microsoft 365 holds ISO/IEC 27017 certification (cloud-specific information security controls). Clipchamp for Work, as a Microsoft 365 service, is covered under this certification.”
Verify on learn.microsoft.com“Microsoft 365 holds ISO/IEC 27018 certification (personal data protection in cloud). Clipchamp for Work inherits this coverage.”
Verify on learn.microsoft.com“Microsoft Azure and Microsoft 365 services hold CSA STAR Level 2 certification. Clipchamp for Work, as a Microsoft 365 service, is covered under this certification.”
> Show 3 unconfirmed / not-held certifications
No public evidence of PCI DSS certification found in Clipchamp or Microsoft 365 documentation. Clipchamp does not appear to be a payment processor or handle payment card data directly.
source: learn.microsoft.comFedRAMP certification is limited to Microsoft 365 GCC (Government Community Cloud) environments. Clipchamp for Work is available in standard Microsoft 365 but FedRAMP coverage is not explicitly documented for Clipchamp standalone.
No public evidence of ISO/IEC 42001 certification found for Clipchamp or Microsoft 365 as of July 2026.
// Privacy & AI training
Trains on customer data
Not stated
Data processing agreement
Offered
Data region
Flexible - data stored on OneDrive/SharePoint can be configured for EU/EEA data residency. However, AI feature processing location not explicitly confirmed for all EU/EEA scenarios.
UNCONFIRMED / DISPUTED, not established. Clipchamp's own terms do not state that user content is used to train AI models. The AIRIN third-party risk profile rates Clipchamp AI 'High' with 932 findings, but AIRIN itself states the training risk is INFERRED from Microsoft's broad content-license terms ('to improve Microsoft products and services'), not from any statement that Clipchamp trains on user content. Against this, Microsoft's documented public position is that it does NOT use Microsoft 365 consumer or commercial customer data to train foundational large language models. A general Microsoft privacy-statement line ('we may use your data to develop and train our AI models') exists but is not Clipchamp-specific and is contradicted by Microsoft's explicit M365 commercial commitment. Treat training-on-customer-data as unverified rather than a fact. Consumer-tier output usage under the Microsoft Services Agreement is restricted to personal, noncommercial purposes.
// Security controls
Data storage
Projects stored on OneDrive or SharePoint with Microsoft's encryption at rest. Third-party media files stored on GCP via Cloudflare.
clipchamp.comAudit & Compliance logging
Microsoft Purview audit logs support Clipchamp video file activities (upload, modify, delete, access, share, comment). eDiscovery and DLP tools available.
learn.microsoft.comData retention
Retention policies and labels supported for Clipchamp video files stored in SharePoint/OneDrive, same as other Microsoft 365 files.
learn.microsoft.comThird-party integrations
Cloudflare (video hosting), Datadog (monitoring), Fullstory (analytics), GIPHY (GIF library), Google Cloud Platform (video storage), Storyblocks (media library).
clipchamp.com// Products & data scope
data: Personal projects, limited to Microsoft Privacy Statement. No explicit SOC 2/ISO inherited unless user also subscribes to Microsoft 365.
Cloud-based editor accessed via web browser. Projects auto-backup to cloud. Free exports (up to 480p, watermark optional). AI features: auto-cut, transcript, voiceovers (basic).
data: Same as Free tier. Premium features available for additional fee.
Paid subscription for personal use. Features: 4K exports, premium stock media, advanced AI features, no watermarks.
data: Included with Microsoft 365 E3, E5, Business Premium, Business Standard, Office 365 E3/E5. Fully covered under Microsoft 365 compliance (SOC 2, ISO 27001, GDPR, HIPAA, etc.)
Enterprise version with admin controls, SSO, data residency configuration. Available as standard or premium tier. Integrated with SharePoint, Stream, OneDrive, Teams.
// What to watch
- No independent Clipchamp trust center or security documentation. All compliance certifications are inherited from Microsoft 365 platform, not Clipchamp-specific. Blog post from January 2023 explicitly states transition to Microsoft Services Agreement (no longer independent compliance).
- AIRIN third-party profile rates Clipchamp AI 'High' risk (932 findings), driven largely by Microsoft's broad content-license terms. IMPORTANT: AIRIN's 'trains on user content' finding is INFERRED from license language, not a verified fact, and Microsoft publicly states it does not use Microsoft 365 customer data to train foundational AI models. Treat AI-training risk as unconfirmed, not established.
- AI feature processing location (especially transcription, voiceovers) not explicitly confirmed for EU/EEA data residency compliance. User support questions suggest uncertainty about this.
- Vendor does not maintain a public trust center or compliance portal. Security info scattered across Microsoft Learn, blog posts, and redirects to Microsoft privacy statement.
- Third-party data flows: Cloudflare, GCP, Datadog, Fullstory, GIPHY, Storyblocks. Each introduces separate privacy/security dependencies.
- Clipchamp (personal) and Clipchamp for Work have different compliance scopes. Personal version only inherits Microsoft Privacy Statement, not full Microsoft 365 certifications unless user subscribed to M365.
- Consumer-tier content licensing under the Microsoft Services Agreement is broad; users should review Microsoft privacy controls. No verified evidence of an opt-in-by-default AI-training program specific to Clipchamp.
- Output/content ownership restricted to noncommercial personal use. Commercial use prohibited, which may conflict with business use cases.
- IDENTITY VERIFICATION: clipchamp.org is NOT the official product (it's a general blog). Official product is clipchamp.com (Microsoft-owned). Nudge Security profile may have aggregated general Microsoft certs rather than Clipchamp-specific certs.
// At a glance
Pricing model
Freemium (personal) + premium add-on + subscription (standalone). Included with Microsoft 365 E3/E5/Business licenses for work version.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Microsoft Corporation (Clipchamp by Microsoft)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
go.microsoft.com