Is Compose AI, Inc. SOC 2 compliant?

We could not confirm SOC 2 for Compose AI, Inc. from its public trust or security pages. This does not necessarily mean the vendor lacks it. Confirm directly with the vendor.

Is Compose AI, Inc. ISO 27001 certified?

We could not confirm ISO 27001 for Compose AI, Inc. from its public trust or security pages. This does not necessarily mean the vendor lacks it. Confirm directly with the vendor.

Is Compose AI, Inc. GDPR compliant?

We could not confirm GDPR for Compose AI, Inc. from its public trust or security pages. This does not necessarily mean the vendor lacks it. Confirm directly with the vendor.

Is Compose AI, Inc. HIPAA compliant?

We could not confirm HIPAA for Compose AI, Inc. from its public trust or security pages. This does not necessarily mean the vendor lacks it. Confirm directly with the vendor.

Does Compose AI, Inc. train AI models on customer data?

Compose AI, Inc.'s public documentation does not clearly state whether it trains AI models on customer data. Confirm directly with the vendor.

// Trust & Security Report

Compose AI, Inc.

Browser-based AI writing assistant: a free Chrome extension with premium tier offering AI-powered autocomplete and text generation across web applications.

Certifications held

Maturity

Growth

Trains on your data

Unknown

Trust center

PRICING & DETAILS

// Certification ledger

Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.

> Show 5 unconfirmed / not-held certifications

SOC 2 Type II

NOT CONFIRMED

No public evidence on vendor domain; third-party security profiles claim this, but unconfirmed by Compose AI's official website.

ISO 27001

NOT CONFIRMED

No public evidence on vendor domain.

GDPR Compliance

NOT CONFIRMED

Privacy policy mentions CCPA (California) and Nevada privacy rights, but no GDPR or EU data protection language found on vendor domain.

source: compose.ai

HIPAA

NOT CONFIRMED

No public evidence on vendor domain; not applicable for consumer writing tool.

PCI DSS

NOT CONFIRMED

No public evidence on vendor domain.

// Privacy & AI training

Trains on customer data

Not stated

Data processing agreement

Not offered

Data region

US-based (company in San Francisco); no EU data residency option documented.

Privacy policy does not disclose whether user text/data is used to train AI models. Homepage mentions personalization learns user voice, but no explicit opt-out for training is documented.

// Security controls

Encryption in transit

Mentioned as protocol for Google/Gmail integration; TLS implied but not explicitly confirmed.

nudgesecurity.com

Physical/Technical/Administrative Safeguards

Policy states: 'appropriate physical, technical, organizational and administrative security measures'; no specifics on encryption at rest, key management, or audits disclosed.

compose.ai

Data Retention

Retained while account is open; longer if needed for legal compliance, dispute resolution, or fee collection. Anonymous/aggregated data retained indefinitely.

compose.ai

Third-Party Integrations

Stripe (payments), Google Analytics, Mixpanel, Segment.io (analytics), Intercom (support), and others. No Data Processing Agreements published.

compose.ai

// Products & data scope

Compose AI FreeBrowser Extension / Writing Assistant

data: Text typed in Chrome extension; integrated with Gmail, Google Docs, and other web applications.

Free tier with basic AI autocomplete. Data used for service improvement and personalization.

Compose AI PremiumBrowser Extension / Writing Assistant

data: Same as free tier, plus advanced personalization features.

Paid subscription tier with enhanced personalization and advanced AI features.

// What to watch

THIRD-PARTY CERT CLAIM GAP: Nudge Security profile claims SOC 2, ISO 27001, HIPAA, PCI, FedRamp, and CSA STAR certifications, but none are mentioned on Compose AI's official website. These cannot be verified from vendor-domain sources.
NO GDPR LANGUAGE: Privacy policy addresses only US privacy laws (CCPA, Nevada). No mention of GDPR, EU data protection, Data Processing Agreements, or Standard Contractual Clauses—despite international user base.
AI TRAINING OPACITY: Privacy policy does not disclose whether user-submitted text trains the AI model. Homepage claims personalization 'learns your voice,' implying some form of model training, but no opt-out mechanism is documented.
NO DPA: No public Data Processing Agreement or vendor Data Protection Addendum available; essential for EU customers.
SINGLE JURISDICTION: Company operates under US law only; no regional compliance posture for international markets.
FUNDING PLATEAU: Seed-stage funding ($2.22M, 2021); no Series A or later rounds in 5 years suggests capital constraints for compliance/security investments.

// At a glance

Pricing model

Freemium: free basic tier + optional premium subscription.

Self-hostable

// How we verified this

Every certification marked HELD is confirmed against a verbatim quote on Compose AI, Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.

Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.

compose.ai

> Browse all vendor trust reports