// Trust & Security Report
IBM Watson Assistant
by International Business Machines Corporation (IBM)
Watson Assistant: conversational AI/chatbot platform for building enterprise-grade virtual agents. Deployable on IBM Cloud (public), on-premises, or hybrid. Variants include Standard, Premium, and Dedicated deployment tiers.
Certifications held
9
Maturity
Enterprise
Trains on your data
Yes
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on ibm.com“Home Products IBM Cloud products Compliance SOC 2 IBM Cloud® compliance: SOC 2 Chat now What is SOC 2? Service Organization Control (SOC) reports are independent, third-”
Verify on ibm.com“IBM has obtained certificates to the ISO 27001 standard by country or business unit.”
Verify on ibm.com“The ISO (International Organization for Standardization) 27018 standard provides a framework to ensure that the certified organization addresses those needs for its customers.”
Verify on ibm.com“IBM has obtained Corporate wide certifications for ISO 9001, ISO 27001, ISO 27018, ISO 27701, ISO 14001, ISO 50001 and ISO 45001”
Verify on ibm.com“IBM Cloud is GDPR-ready and compliant; IBM has Data Processing Addendum (DPA) in place, with Binding Corporate Rules for Controllers (BCR-C) approved by European Data Protection Authorities, and Global Cross-Border Privacy Rules (CBPR) compliance.”
Verify on ibm.com“IBM Cloud for Financial Services EBA (EU) FISC (Japan) GxP HIPAA HITRUST PCI DSS SEC Rule 17a 4(f) Global programs CIS CSA STAR ISO 20000 ISO 20243 ISO 22301 ISO 27001 ISO 27017 ISO 27018 ISO 27701”
Verify on ibm.com“IBM Cloud for Government (IC4G) meets FedRAMP High security standards with Provisional Authorization to Operate (P-ATO) from the Joint Authorization Board. Additional FedRAMP-authorized watsonx services available on AWS GovCloud.”
Verify on ibm.com“Certificates ISO 31000 Business Unit Certificate ISO 45001 Global Certificate ISO 42001 Global Certificate These certifications have been acquired mainly through the use of normal IBM business practices and”
> Show 2 unconfirmed / not-held certifications
source: ibm.comWatson Assistant explicitly does NOT accept regulated data types such as Personal Health Information (PHI) under HIPAA, even though ISO 27018 certified. While IBM Cloud offers HIPAA support via Business Associate Agreement (BAA), Watson Assistant is not a HIPAA-covered service. Customers cannot process PHI with Watson Assistant.
source: ibm.comThe vendor's pages state this for a different product or company, not for this product.
// Privacy & AI training
Trains on customer data
Yes
Data processing agreement
Offered
Data region
Global multi-zone regional deployment; IBM operates 60+ data centers across 19 countries. Data residency options available for regulated customers.
By default, IBM uses conversation logs to improve Watson Assistant (except for Enterprise plan data). Customers can opt-out per request: (1) API: set X-Watson-Learning-Opt-Out header to true, (2) Web Chat: set learningOptOut parameter to true, or (3) Premium plans: opt-out of conversation logging entirely. Customers must NOT add PHI or PCI data to training data.
// Security controls
Key Management
Key Protect (IBM-managed) or BYOK (Bring Your Own Key) options; premium customers can integrate customer-managed keys
ibm.comData Isolation
Optional single-tenant data isolation available for enterprise; physically isolated data store not shared with other accounts
ibm.comSensitive Data Masking
Private variables feature masks sensitive data before logging; supports masking customer input and assistant responses
medium.comData Retention & Deletion
Client content removed at customer request or at service end-of-life. Enterprise plan conversation logs are excluded from service learning.
ibm.com// Products & data scope
Data it handles: Conversation logs, training data (intents, entities, user examples), conversation history. Explicitly excludes PHI and PCI data.
Available as Standard, Premium, or Dedicated tiers on IBM Cloud. Includes web chat, API, and integration connectors. Multi-language support. Enterprise features include dedicated support, custom SLAs, and single-tenant deployment.
Data it handles: Same as cloud variant; customer controls physical infrastructure and data residency.
Deployable via IBM Cloud Pak for Data or on customer-managed infrastructure. Recommended for customers with strict data residency or air-gapped requirements.
// What to watch
- Watson Assistant cannot accept HIPAA (PHI) or PCI DSS data, even though IBM Cloud infrastructure supports these standards. This is an explicit product limitation; customers seeking HIPAA or PCI compliance should not use Watson Assistant for sensitive data.
- Data training is opt-in to improvement program by default. Customers must actively opt-out if they do not want logs used for service learning.
- ISO 27018 certification confirms PII handling capability, but explicit carve-outs for PHI and PCI data mean the product is not suitable for heavily regulated data types (healthcare, finance) despite strong general data protection posture.
// At a glance
Pricing model
SaaS subscription per tier (Standard, Premium, Dedicated); also available as on-premises or cloud pak deployment. Pay-per-use or fixed monthly pricing available.
Self-hostable
Yes
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on International Business Machines Corporation (IBM)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-07. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
ibm.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.