// Trust & Security Report
Research Rabbit
by Litmap Limited (trading as Litmaps; operates ResearchRabbit, acquired May 2025)
Free-to-use academic literature discovery and citation-mapping web app (ResearchRabbit) that helps researchers explore related papers, authors, and topics via visual citation networks. Sibling product under the same parent company is Litmaps, a separate citation-tracking tool. No enterprise/API/team tier was found for ResearchRabbit itself.
Certifications held
0
Maturity
Startup
Trains on your data
Unknown
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
> Show 8 unconfirmed / not-held certifications
source: researchrabbit.aiNo public evidence of a SOC 2 attestation, report, or trust page on the vendor domain (researchrabbit.ai) or its parent (litmaps.com). No trust center exists; targeted web searches for 'ResearchRabbit SOC 2' and 'ResearchRabbit trust center' returned no vendor-domain results.
source: researchrabbit.aiNo public evidence of ISO 27001 certification on vendor domain or any independent registrar listing.
source: researchrabbit.aiNo public evidence of an AI-governance certification. No vendor-domain page addresses ISO 42001 or CSA STAR AI.
source: researchrabbit.aiNo public evidence found on vendor domain or CSA STAR registry.
source: researchrabbit.aiGDPR-rights language on the vendor's privacy policy page could not be independently confirmed with a direct quote. Secondary, non-vendor sources indicate the policy addresses EEA/UK/Swiss/Canadian/Australian/NZ data-subject rights and uses Standard Contractual Clauses for international transfers; this is unverified secondary information, not a direct vendor quote.
source: researchrabbit.aiNo public evidence on vendor domain; product is an academic literature tool, not positioned for health-record handling.
source: researchrabbit.aiNo public evidence found; product has no visible paid checkout flow to necessitate PCI scope.
source: researchrabbit.aiNo public evidence found; not applicable to this consumer/academic product.
// Privacy & AI training
Trains on customer data
Not stated
Data processing agreement
Not offered
Data region
Unverified. Secondary search summaries suggest primary processing in the United States with Standard Contractual Clauses for EEA/UK transfers, but this was not independently confirmed via direct vendor-domain quote.
The vendor's privacy policy text could not be directly quoted and confirmed. Secondary, unverified sources indicate the policy mentions partnerships with third-party AI providers (named as Databricks and OpenAI) 'to power certain features,' with input/output data 'shared with these providers under their respective agreements,' and states user data 'never leaves ResearchRabbit's own servers and is never sold to third parties.' None of this is confirmed by a direct vendor-domain quote and should be treated as unverified.
// Security controls
Cookie consent mechanism
Site presents an explicit cookie consent banner with Accept / Decline / Preferences options for non-essential cookies; essential cookies are used without consent per site's own disclosure.
researchrabbit.ai// Products & data scope
Data it handles: Account data (name, email), uploaded/synced reference libraries (e.g. Zotero integration), reading/collection activity, and academic paper metadata pulled from third-party scholarly databases (claims access to 310M+ papers).
Free consumer/academic tool, no visible paid enterprise tier, no API product surfaced in evidence. Acquired by Litmaps (New Zealand company, Litmap Limited) in May 2025; prior to acquisition it was described in press coverage as a US-based tool.
// What to watch
- No trust center or SOC 2, ISO, HIPAA, or GDPR certification evidence was found anywhere on the vendor domain. This is consistent with a small/free academic tool; no compliance badges apply.
- ResearchRabbit was acquired by Litmaps / Litmap Limited (New Zealand) in May 2025; it operates as part of that parent entity rather than independently.
- Not to be confused with 'CodeRabbit' (coderabbit.ai), an unrelated company with a similar name that holds SOC 2 Type II, ISO 27001, and GDPR documentation; those certifications belong to CodeRabbit, not ResearchRabbit.
- Third-party summaries describe AI feature partnerships with Databricks and OpenAI involving input/output data sharing; this has not been confirmed with a direct vendor-domain quote.
// At a glance
Pricing model
Free
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Litmap Limited (trading as Litmaps; operates ResearchRabbit, acquired May 2025)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-09. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
researchrabbit.ai