Hedra

Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.

• Marketing materials reference 'responsible AI' and 'transparency, consent, and quality as foundations of trust,' but the privacy policy permits broad AI training on customer data with only de-identification/anonymization, not an explicit customer opt-out; this framing may overstate the platform's actual compliance rigor.
• Hedra takes broad grants of perpetual, irrevocable rights to user content for model training, for both platform users and API customers. For API customers specifically, Hedra reserves rights to share Customer Content with third-party AI Services for training purposes.
• The privacy policy explicitly acknowledges data may be transferred to the US and other jurisdictions with lower privacy protections. No DPA template or specific data residency guarantees are published.
• Hedra is an early-stage company: 35 employees, founded 2023-2024, with a Series A in May 2025. It holds no enterprise-grade compliance certifications (SOC 2, ISO 27001), liability is capped at 3 months of fees, $100, or the statutory minimum, and services are offered as-is with no warranties.
• Hedra does not maintain a dedicated trust center or security documentation page; security and compliance information must be gathered from scattered policy pages.
• The platform collects facial geometry and voice biometric data. While compliant with BIPA, CUBI, and HB 1493, this is a material data type not covered by standard privacy frameworks.
• The privacy policy explicitly states 'we cannot guarantee the security of your personal information,' an unusually strong disclaimer relative to its claims of employing safeguards.
• While the privacy policy mentions customer agreements may govern data use, no public DPA template is offered; enterprise customers must negotiate custom agreements.