Deep AI, Inc.

Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.

• Over-claim risk: Third-party vendor platform (Nudge Security) lists DeepAI as compliant with SOC 2, ISO 27001, HIPAA, FedRAMP, and CSA STAR Level 1. However, NONE of these certifications are documented on deepai.org's own website, privacy policy, terms of service, or any dedicated security/compliance page. When searching specifically on the vendor domain for these certs, no results appear. Recommend direct vendor contact to verify status.
• Security posture gaps: Business Digital Index security assessment rated DeepAI 91/100 overall but flagged 'medium risk to be leaked' with issues including 25 SSL configuration problems, 16 phishing/malware concerns, 8 corporate credential breaches, and 17% of employees reusing breached passwords. This contradicts claims of advanced security certifications.
• Minimal security documentation: Privacy policy provides very basic security statements (general contractual safeguards for international transfers) with no mention of encryption, security architecture, or compliance frameworks. No dedicated trust center or security documentation page exists.
• AI training by default: User data (including generated content and prompts) is used to train AI models by default. While opt-out is available via privacy choices, this is a material data practice that requires clear consent. Generated images are also public by default on free tier.
• Small team / growth stage: Company has ~20 employees and $2.2M revenue (2025), which raises questions about ability to maintain enterprise-grade security and compliance programs. Though company does take on custom enterprise projects.
• Limited liability: Terms of service cap liability at amount paid or $100 (whichever is greater), severely limiting recourse for data breaches or service failures.
• No DPA / BAA: No Data Processing Agreement or Business Associate Agreement mentioned, limiting viability for regulated data (healthcare, financial).
• Data ownership clarity: Users retain ownership of generated content; generated AI images are free of copyright. This is positive for users but should be verified for enterprise use cases.