// Trust & Security Report
Crayon
Crayon AI: Competitive Intelligence Platform
Certifications held
3
Maturity
Enterprise
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on app.vanta.com“your competition, so you can compete like you mean it. Compliance SOC 2 Type II GDPR US Data Privacy Microsoft SSPA Resources View all General Security Brief DataFlow Diagram Crayon 2025 Pen Test SOC 2”
> Show 2 unconfirmed / not-held certifications
source: crayon.coNo ISO 27001 claim was found on Crayon's own domain (crayon.co). crayon.com / Crayon Group is an unrelated Norwegian IT-licensing company.
source: crayon.coNo HIPAA claim found on Crayon's site; product is B2B competitive intelligence and not positioned for PHI.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Not stated
Data region
unknown
Terms of Service Section 8 (AI/Machine Learning) is explicit: 'Neither Crayon nor its AI Tools providers will use Customer data, User Content, Inputs, or Outputs to train, fine-tune, or otherwise improve any general-purpose AI or machine learning models.' AI Tools are third-party LLMs (Crayon does not operate its own models); Customer data/Inputs/Outputs are processed solely to provide the Services. The product itself aggregates PUBLICLY available data about a customer's tracked competitors ('Targets'/'Competitors'), so the core dataset is public intel rather than the customer's private corpus.
// Security controls
SOC 2 Type II audit
Completed (announced Feb 2022); report available to customers/prospects under NDA
crayon.coVulnerability management
Covered under SOC 2 Type I scope (infrastructure, device management, incident response, vulnerability management)
crayon.coData security section in Privacy Policy
Dedicated 'Data Security' and 'Data Retention' sections present; states commitment to protecting personal information
crayon.coSubprocessor due diligence
Privacy framework references third-party/subprocessor obligations; no public subprocessor list confirmed on crayon.co
crayon.coBug bounty program
None found (no HackerOne/Bugcrowd program or public vulnerability disclosure policy located)
crayon.coPenetration testing
Not publicly stated (likely covered under SOC 2 controls but no explicit public claim)
crayon.coEncryption
Not explicitly stated on public pages (no in-transit/at-rest claim found publicly; likely in SOC 2 report under NDA)
crayon.co// Products & data scope
Data it handles: Aggregates publicly available data and third-party materials about competitors the customer chooses to track ('Targets'/'Competitors'). Customer-side data includes account/profile data, billing, and User Content (comments, battlecards, uploaded insights, search history). AI features (e.g., 'Sparks') run on third-party LLMs; Inputs/Outputs are not used to train models.
Single unified platform with feature modules: Aggregate, Organize, Publish, Enable, Measure, plus the 'Sparks' AI feature. Integrates into Slack, Microsoft Teams, and Salesforce. Sold B2B via subscription (Authorization Form), no self-serve consumer tier surfaced.
// What to watch
- Several unrelated companies use similar 'Crayon' names; this report covers Crayon, Inc. (crayon.co), the competitive intelligence platform, not Crayon Group ASA (crayon.com), a Norwegian IT/software-licensing company. Subprocessor and privacy pages on crayon.com do not apply to this vendor.
- No dedicated trust center; SOC 2 report only available under NDA, so deep security detail (encryption specifics, pen-test cadence, DPA terms) is not publicly verifiable.
- Strong positive: AI no-training commitment is unusually explicit and contractual (Terms Sec. 8), and Crayon relies on third-party LLMs rather than operating its own models.
// At a glance
Pricing model
Subscription / contract (B2B; demo-led sales, per-Authorization-Form pricing, auto-renewing subscription periods)
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Crayon, Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-09-30. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
app.vanta.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.