Later (Mavrck LLC)

Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.

• AI TRAINING: Later explicitly uses customer content and engagement data to train AI models (content analysis, influencer matching, trend prediction, fraud detection). This is not prohibited by their policy but should be clearly disclosed to users.
• OPAQUE OPT-OUT: No explicit opt-out mechanism documented for AI training in the public privacy policy. Later states they 'never allow third party AI systems to use personal information for training' but does not clarify user opt-out rights for their own AI training.
• MAVELY ACQUISITION INTEGRATION: Mavely was acquired in January 2025 and handles creator payment data. Later should clarify whether Mavely operates under the same security and compliance framework (SOC 2, ISO 27001) as the main Later platform. Privacy policies for Mavely appear separate.
• DATA RESIDENCY BREADTH: Privacy policy states data 'may occur in any country where we operate or have engaged data processors'—broad language that may concern GDPR-regulated users. Standard Contractual Clauses are noted but actual processor list not published.
• NO DPA TEMPLATE: No formal Data Processing Agreement template found in public documentation. Enterprises should request this directly from Later for contract negotiations.
• HIPAA NOT APPLICABLE: Later does not claim HIPAA compliance, which is appropriate for an influencer marketing platform. However, if any customer attempts to process protected health information through Later (e.g., health influencer with PHI data), they would be out of compliance.
• NO INDEPENDENT TRUST SEAL: Trust center is powered by SafeBase (vendor-specific portal), not a third-party trust seal (e.g., TrustArc, Vanta) visible across the web.