Prisma Labs, Inc.

Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.

• NO FORMAL COMPLIANCE CERTIFICATIONS: Despite processing biometric data (facial geometry), Lensa holds no public SOC 2, ISO 27001, ISO 27017, or ISO 27018 certifications. This is unusual for a company handling sensitive personal data.
• BBB F RATING: Better Business Bureau rates Prisma Labs, Inc. as 'F' due to failure to respond to 2 filed complaints. BBB file opened 12/5/2022; business started 5/15/2016. This raises questions about responsiveness to compliance issues.
• AI TRAINING CONTRADICTION: Official privacy policy states 'We do not use your Personal Data to train separate AI products,' but historical reports (ArtNews, ArtMajeur, 2022-2023) and earlier ToS language suggest Lensa previously used user data for AI model training. Current policy appears to narrowly exclude per-user custom model training (used only for that user's avatars/effects) from the definition of 'training separate products.' This ambiguity should be clarified.
• WEAK DATA SECURITY POSTURE: Privacy policy explicitly states Lensa 'cannot guarantee the security' and 'there is no ideal technology or measure to maintain 100% security.' This low-assurance language is concerning for a vendor processing biometric/facial data.
• NO ENCRYPTION SPECIFICATIONS: Public privacy policy and terms do not specify encryption standards, protocols, or key management practices for data in transit or at rest.
• NO PUBLIC TRUST CENTER: Lensa does not publish a trust center, security documentation, or compliance audit reports on its vendor domain.
• BIOMETRIC DATA WITH MINIMAL OVERSIGHT: Lensa collects facial geometry (via Apple TrueDepth) and other biometric data without formal security certifications or third-party audits. BIPA lawsuit filed (Illinois Biometric Information Privacy Act) alleging collection of facial geometry without proper consent.
• COPYRIGHTS/LICENSING CONCERN: Lensa's underlying Magic Avatars and Art Styles models use third-party models (Stable Diffusion) trained on internet images with unclear licensing. While this does not directly implicate Lensa's data handling, it raises questions about IP governance and vendor oversight of third-party dependencies.
• DATA RETENTION GAPS: Data retention policies vary by feature (24 hours for Art Styles, immediate for Magic Avatars, 30 days for AI-Assistant via OpenAI). No global data retention policy; complex multi-vendor data lifecycle.
• MINIMAL GDPR CERTIFICATION: Lensa claims GDPR compliance via Standard Contractual Clauses but provides no formal assessment letter, Data Protection Impact Assessment (DPIA), or auditor confirmation of adequacy of safeguards.