// Trust & Security Report
Nanonoble Pte. Ltd. (operating as MiniMax / Hailuo AI)
MiniMax is a foundation-model company (M-series LLMs) whose consumer-facing brands include Hailuo AI (hailuoai.video: text/image-to-video and image generation, 'Hailuo Agent'), MiniMax Chat/Agent, MiniMax Audio (speech/music models), MiniMax Talkie, and a developer API platform (platform.minimax.io) for enterprise/programmatic access.
Certifications held
0
Maturity
Growth
Trains on your data
Unknown
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
> Show 8 unconfirmed / not-held certifications
source: hailuoai.videoNo public evidence. No trust center, security page, or SOC 2 reference found on hailuoai.video, minimax.io, chat.minimax.io, or platform.minimax.io. Third-party blog commentary explicitly notes SOC 2 claims for MiniMax are unverified and should not be assumed.
source: minimax.ioNo public evidence. No ISO 27001 reference found on any vendor-owned domain (hailuoai.video, minimax.io, chat.minimax.io, platform.minimax.io).
source: minimax.ioNo public evidence of ISO 42001 certification on any vendor-owned domain.
source: minimax.ioNo public evidence of a CSA STAR registry listing or self-assessment for MiniMax/Hailuo.
source: hailuoai.videoNo public evidence. Privacy policy makes no reference to HIPAA, protected health information, or a Business Associate Agreement. Consumer ToS also states the company disclaims responsibility for content and does not offer healthcare-specific safeguards.
source: hailuoai.videoNo GDPR-specific certification or compliance statement found; the Hailuo privacy policy only commits to 'appropriate safeguards ... in accordance with applicable data protection laws' in general terms and names a Data Protection Officer contact for Singapore residents (contact.nanonoble@minimax.io), not a GDPR-specific representative or SCC/DPA framework.
source: minimax.ioNo public evidence; payments are handled via third-party processors per standard SaaS subscription flow but no PCI DSS statement appears on vendor domains.
source: minimax.ioNo public evidence; not applicable to this consumer/API product as observed.
// Privacy & AI training
Trains on customer data
Not stated
Data processing agreement
Not offered
Data region
Not disclosed on vendor-owned pages. The Hailuo privacy policy (Nanonoble Pte. Ltd., Singapore) discusses transfers of Singapore residents' data to affiliates/third parties without naming a primary processing region. Multiple independent (non-vendor) sources assert MiniMax's underlying infrastructure and primary data centers are located in mainland China, but this is not confirmed by any vendor-domain source captured here and is flagged as unverified.
No vendor-domain page explicitly states whether user prompts, uploads, or generated content are used to train MiniMax/Hailuo models, and no opt-out mechanism is documented publicly. The Hailuo Terms of Service grants the company a broad 'royalty-free, perpetual, irrevocable, worldwide, non-exclusive' license to use, reproduce, modify, and create derivative works from user-submitted content, which survives termination -- this is a content-license grant, not an explicit training disclosure, but it leaves the door open. Third-party (non-vendor) sources report MiniMax's free-tier terms allow data to be used to 'improve the model' during free periods, but this is unconfirmed on any vendor-owned domain and should be treated as unverified pending direct vendor confirmation.
// Security controls
Encryption in transit/at rest
Not disclosed. Privacy policy uses only generic 'reasonable efforts' language and explicitly disclaims guarantee of internet transmission security; no encryption specifics (TLS version, at-rest encryption, key management) are published on any vendor domain.
hailuoai.videoVulnerability disclosure / bug bounty
No public vulnerability disclosure policy or bug bounty program found on hailuoai.video or minimax.io.
minimax.ioTrust center / security page
None found on any vendor-owned domain (hailuoai.video, minimax.io, chat.minimax.io, platform.minimax.io). A third-party review blog (not a vendor domain) hosts an unofficial 'Security' explainer page, which does not count as vendor evidence.
minimax.ioEnterprise / API data handling
Enterprise/API customers are directed to contact MiniMax (api@minimax.io) for deployment support and enterprise solutions; data handling terms including DPA appear to be negotiated per-agreement rather than published, per platform terms structure separating Open Platform, Agent, Audio, and Video terms.
minimax.io// Products & data scope
data: User prompts, uploaded start/end-frame images, account info (email/phone), device and usage data, IP address.
Free and paid consumer tiers from $9.99/mo; broad content license granted to the company in ToS; no enterprise-specific safeguards documented for this surface.
data: Chat messages, uploaded files, account info.
Separate privacy policy from Hailuo video product; same lack of published certifications.
data: Voice/audio inputs, text prompts.
Covered by product-specific terms linked from the master ToS overview page; not independently verified in this assessment.
data: API request/response payloads, developer account data.
Enterprise-oriented surface; page content was not fully renderable via automated fetch (client-side app), so specific enterprise DPA/training-opt-out terms could not be directly quoted. Prospective enterprise buyers should request documentation directly (api@minimax.io) rather than assume parity with consumer terms.
// What to watch
- Identity-conflation risk: multiple unrelated companies share similar names/domains -- 'Minimax d.o.o.' (minimax.com, minimaxliving.com, fire-safety/cash-register/office-equipment company) and 'Minimax Sustainable AI Ltd' (minimax-sustainable-ai.com) are NOT the same entity as the AI vendor assessed here (Nanonoble Pte. Ltd. / minimax.io / hailuoai.video). Any cert or policy found on those other domains must not be attributed to this vendor.
- No trust center or security page exists on any vendor-owned domain; all certification fields are held=false on absence of evidence, not on confirmed non-possession.
- AI training data usage on user content is not clearly disclosed; the broad perpetual content-license grant in the Hailuo ToS combined with third-party (unverified) reports of training on free-tier data warrants caution -- flagged as an open question for enterprise buyers.
- Data residency/processing region is not stated on any vendor-owned page; only unverified third-party sources claim China-based processing, which is not confirmed here and should not be presented as fact without direct vendor confirmation.
// At a glance
Pricing model
Freemium subscription (consumer, from $9.99/mo) plus usage-based API pricing for developers/enterprise via platform.minimax.io.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Nanonoble Pte. Ltd. (operating as MiniMax / Hailuo AI)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-08. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
hailuoai.video