// Trust & Security Report
International Business Machines Corporation (IBM)
Watson Assistant — conversational AI/chatbot platform for building enterprise-grade virtual agents. Deployable on IBM Cloud (public), on-premises, or hybrid. Variants include Standard, Premium, and Dedicated deployment tiers.
Certifications held
8
Maturity
Enterprise
Trains on your data
Yes
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on ibm.com“IBM Cloud is SOC 2 Type 1 and Type 2 compliant; SOC 2 Type 2 reports issued annually. All Watson AI services have received SOC 2 certification.”
Verify on ibm.com“IBM Cloud has obtained Business unit certifications for ISO 27001 (information security management system); IBM Office of the CISO covers PaaS, VPC, and SaaS offerings including Watson services.”
Verify on ibm.com“All Watson AI services have received ISO 27018 Certification, which allows acceptance of Personally Identifiable Information (PII) across Standard, Premium, and Dedicated deployment options.”
Verify on ibm.com“IBM has obtained certification for ISO 27017 (information security for cloud services) for its cloud service offerings.”
Verify on ibm.com“IBM Cloud holds ISO 27701 certification (privacy information management system) as part of its comprehensive information security management system.”
Verify on ibm.com“IBM Cloud is GDPR-ready and compliant; IBM has Data Processing Addendum (DPA) in place, with Binding Corporate Rules for Controllers (BCR-C) approved by European Data Protection Authorities, and Global Cross-Border Privacy Rules (CBPR) compliance.”
Verify on ibm.com“IBM Cloud services achieved CSA STAR Level 2 certification by external third-party audit, demonstrating security controls and practices per Cloud Security Alliance standards.”
Verify on ibm.com“IBM Cloud for Government (IC4G) meets FedRAMP High security standards with Provisional Authorization to Operate (P-ATO) from the Joint Authorization Board. Additional FedRAMP-authorized watsonx services available on AWS GovCloud.”
> Show 2 unconfirmed / not-held certifications
source: ibm.comWatson Assistant explicitly does NOT accept regulated data types such as Personal Health Information (PHI) under HIPAA, even though ISO 27018 certified. While IBM Cloud offers HIPAA support via Business Associate Agreement (BAA), Watson Assistant is not a HIPAA-covered service. Customers cannot process PHI with Watson Assistant.
source: ibm.comWatson AI services explicitly exclude PCI data. Search results state 'regulated data types such as...Payment Card Industry (PCI) data' are exceptions to what Watson Assistant can accept, despite IBM Cloud supporting PCI DSS at the infrastructure level.
// Privacy & AI training
Trains on customer data
Yes
Data processing agreement
Offered
Data region
Global multi-zone regional deployment; IBM operates 60+ data centers across 19 countries. Data residency options available for regulated customers.
By default, IBM uses conversation logs to improve Watson Assistant (except for Enterprise plan data). Customers can opt-out per request: (1) API: set X-Watson-Learning-Opt-Out header to true, (2) Web Chat: set learningOptOut parameter to true, or (3) Premium plans: opt-out of conversation logging entirely. Customers must NOT add PHI or PCI data to training data.
// Security controls
Key Management
Key Protect (IBM-managed) or BYOK (Bring Your Own Key) options; premium customers can integrate customer-managed keys
ibm.comData Isolation
Optional single-tenant data isolation available for enterprise; physically isolated data store not shared with other accounts
ibm.comSensitive Data Masking
Private variables feature masks sensitive data before logging; supports masking customer input and assistant responses
medium.comData Retention & Deletion
Client content removed at customer request or at service end-of-life. Enterprise plan conversation logs are excluded from service learning.
ibm.com// Products & data scope
data: Conversation logs, training data (intents, entities, user examples), conversation history. Explicitly excludes PHI and PCI data.
Available as Standard, Premium, or Dedicated tiers on IBM Cloud. Includes web chat, API, and integration connectors. Multi-language support. Enterprise features include dedicated support, custom SLAs, and single-tenant deployment.
data: Same as cloud variant; customer controls physical infrastructure and data residency.
Deployable via IBM Cloud Pak for Data or on customer-managed infrastructure. Recommended for customers with strict data residency or air-gapped requirements.
// What to watch
- IMPORTANT: Watson Assistant CANNOT accept HIPAA (PHI) or PCI DSS data, even though IBM Cloud infrastructure supports these standards. This is an explicit product limitation. Customers seeking HIPAA/PCI compliance should not use Watson Assistant for sensitive data.
- Data training is opt-in to improvement program by default. Customers must actively opt-out if they do not want logs used for service learning.
- ISO 27018 certification confirms PII handling capability, but explicit carve-outs for PHI and PCI data mean the product is not suitable for heavily regulated data types (healthcare, finance) despite strong general data protection posture.
// At a glance
Pricing model
SaaS subscription per tier (Standard, Premium, Dedicated); also available as on-premises or cloud pak deployment. Pay-per-use or fixed monthly pricing available.
Self-hostable
Yes
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on International Business Machines Corporation (IBM)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-07. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
ibm.com