// Trust & Security Report
Sora
by OpenAI, OpCo, LLC (OpenAI)
Sora is OpenAI's AI video-generation product family: the Sora web/app consumer product (sora.chatgpt.com, iOS/Android) for text-to-video creation and a social feed, and the developer-facing Sora 2 / Sora 2 Pro API served through the OpenAI platform. The consumer web/app experience has already been discontinued and the API is on a published sunset timeline.
Certifications held
8
Maturity
Enterprise
Trains on your data
Yes
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on trust.openai.com“Request access to our SOC 2 Report below to learn more about our security controls and compliance activities.”
Verify on trust.openai.com“Our products are also ISO 27001, 27017, 27018, and 27701 certified.”
Verify on trust.openai.com“Our products are also ISO 27001, 27017, 27018, and 27701 certified.”
Verify on trust.openai.com“Our products are also ISO 27001, 27017, 27018, and 27701 certified.”
Verify on trust.openai.com“IEC 27018:2019 ISO/IEC 27701:2019 SOC 2 SOC 2 Type 2 SOC 3 TX-RAMP FedRAMP 20x ISO/IEC 42001:2023 OpenAI is trusted by Morgan Stanley PwC Robinhood Square Zendesk Amgen Bain & Company Datadog JetBlue Airways”
Verify on trust.openai.com“the program and visit Bugcrowd to participate. Compliance CCPA PCI DSS v4.0.1 CSA STAR GDPR ISO/IEC 27001:2022 ISO/IEC 27017:2015 ISO/IEC 27018:2019 ISO/IEC 27701:2019 SOC 2 SOC 2 Type 2 SOC 3 TX-RAMP”
Verify on trust.openai.com“gram and visit Bugcrowd to participate. Compliance CCPA PCI DSS v4.0.1 CSA STAR GDPR ISO/IEC 27001:2022 ISO/IEC 27017:2015 ISO/IEC 27018:2019 ISO/IEC 27701:2019 SOC 2 SOC 2 Type 2 SOC 3 TX-RAMP FedRAMP 20”
Verify on trust.openai.com“Party Dependence Yes Hosting Major Cloud Provider Reports Data Flow Diagram SOC 3 Report Network Diagram View more Access Control Access Log Management Bring Your Own Device (BYOD) Data Access View”
> Show 4 unconfirmed / not-held certifications
source: trust.openai.comOpenAI's ISO/IEC 27001 Certificate documents OpenAI's operation of an Information Security Management System for OpenAI's API, ChatGPT Enterprise, and ChatGPT Edu services. Sora (consumer app or API) is not named in this scope statement, so it cannot be confirmed as covered; this is OpenAI-the-company's certification, not a Sora-specific one.
source: openai.com'OpenAI now maintains PCI-DSS compliance for the components of ChatGPT that support delegated payment processing.' This is scoped to ChatGPT payment processing, not stated to cover Sora.
source: trust.openai.comListed on the OpenAI Trust Portal compliance section; this targets US government use of OpenAI's platform/ChatGPT Gov, not the Sora consumer/video product. No evidence Sora is in scope.
source: help.openai.comOpenAI states ChatGPT (Free, Plus, Pro, and Team plans) is NOT HIPAA compliant under any circumstances, and a BAA is only available for API Platform use meeting specific requirements (BAA requested via baa@openai.com). No vendor page confirms a BAA is offered for the Sora consumer app; third-party commentary about 'Sora Series' HIPAA use refers to the API under a signed BAA, not the consumer product.
// Privacy & AI training
Trains on customer data
Yes
Data processing agreement
Offered
Data region
Not specified for Sora specifically on vendor pages found; OpenAI's general Data Processing Addendum references Standard Contractual Clauses / UK GDPR / Swiss DPA mechanisms for international transfers, implying no dedicated EU-only region guarantee for this product.
OpenAI's help center states: 'Data controls offer you the ability to choose whether your content will be used to improve and train our models... To disable model training, navigate to your profile icon... Settings > Data Controls, and disable Improve the model for everyone. While this is disabled, new content won't be used to train our models.' This opt-out is confirmed to apply to the Sora app specifically via the dedicated 'Data Controls and Privacy on the Sora app' help article. By default, consumer-tier content (including Sora video generations) may be used for model improvement unless the user opts out; API/business customers under the enterprise privacy commitments are, per OpenAI's general policy, excluded from training by default. Historical training data used to build the original Sora video model included licensed and 'publicly available' content whose exact sourcing OpenAI has not fully disclosed (third-party reporting, not vendor-confirmed).
// Security controls
Content provenance / watermarking
Every video generated with Sora embeds C2PA metadata plus visible and invisible provenance signals, and OpenAI provides reverse image/audio search tools to trace videos back to Sora.
openai.comContent safety guardrails
Guardrails check both prompts and outputs across multiple video frames and audio transcripts to block unsafe content (sexual material, terrorist propaganda, self-harm promotion) before generation.
openai.comOrganizational compliance program
OpenAI (the parent org) maintains SOC 2 Type 2, ISO/IEC 27001:2022/27017/27018/27701, ISO/IEC 42001:2023, PCI DSS v4.0.1, CSA STAR and FedRAMP 20x programs, but public documentation scopes these to the API Platform, ChatGPT Enterprise, ChatGPT Edu and ChatGPT Team, not the Sora consumer product by name.
trust.openai.comData Processing Addendum
Available to business/API customers on request (must be actively executed); covers GDPR Art. 28, UK GDPR, Swiss FADP, and includes audit rights.
openai.com// Products & data scope
Data it handles: User prompts, uploaded images/video (cameo feature), generated videos; feed posts are public if the user chooses to publish them.
Discontinued: per OpenAI's own help center article 'What to know about the Sora discontinuation,' the Sora web and app experience ended April 26, 2026. Users could export content at sora.chatgpt.com/sunset; remaining data is permanently deleted after the export window. Not covered by OpenAI's published SOC 2 / ISO scope statements. HIPAA BAA not available for this consumer tier.
Data it handles: API request prompts, reference media, generated video outputs, billing/usage metadata.
Runs on OpenAI's general API platform (subject to org-level SOC 2/ISO commitments per OpenAI's platform-wide scope, though Sora is not named explicitly in scope docs found). Per third-party reporting corroborated by OpenAI's own sunset article, the Sora 2 API is scheduled to be discontinued September 24, 2026. A BAA can be requested for HIPAA-relevant API use, subject to OpenAI's standard API BAA process, but no vendor page confirms this has been specifically extended to Sora media generation.
// What to watch
- The Sora consumer web/app was discontinued April 26, 2026 per OpenAI's own help center notice; the Sora 2 API is scheduled to be discontinued September 24, 2026. This is not an actively onboardable consumer product; new customers cannot currently sign up for the consumer app.
- OpenAI (the parent org) holds SOC 2 Type 2, ISO 27001/27017/27018/27701, ISO 42001, PCI DSS, CSA STAR and FedRAMP, but every public scope statement found names the API Platform, ChatGPT Enterprise, ChatGPT Edu and ChatGPT Team as covered, not the Sora product by name. Because Sora runs on OpenAI's shared infrastructure, some of these controls likely apply in practice, but no vendor document explicitly confirms Sora is in scope.
- AI training default: consumer Sora content may be used to train OpenAI's models unless the user opts out via Data Controls; this is a meaningful privacy consideration for any user-generated video/likeness content uploaded to Sora.
- HIPAA is explicitly NOT available for ChatGPT consumer tiers per OpenAI's own guidance; by analogy the discontinued Sora consumer app should not be treated as HIPAA-eligible. Any HIPAA use of Sora capability would need to go through the API with an executed BAA.
// At a glance
Pricing model
Consumer: bundled with ChatGPT Plus/Pro subscriptions plus a limited free daily quota (discontinued as of April 26, 2026). API: usage-based, priced per second of generated video (e.g., ~$0.10/sec Standard 720p, ~$0.30-$0.70/sec Pro tier depending on resolution), scheduled to sunset September 24, 2026.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on OpenAI, OpCo, LLC (OpenAI)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-09. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.openai.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.