// Trust & Security Report
Stability AI Inc.
Stable Audio (Stability AI's generative audio model family, currently Stable Audio 3.0), offered as open-weight downloads, a consumer web app (StableAudio.com), an enterprise Brand Studio product, a Platform API, and a Self-Hosted License; part of the wider Stability AI portfolio (image, video, 3D, audio models).
Certifications held
3
Maturity
Growth
Trains on your data
Yes
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on trust.stability.ai“Compliance: SOC 2 Type 2 ... Security Frameworks: Stability AI Inc. SOC 2 Type 2 Report, Stability AI Inc. SOC 3 Report”
Verify on stability.ai“The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on... the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure”
> Show 6 unconfirmed / not-held certifications
source: trust.stability.aiNo public evidence: the trust center's Compliance section lists only 'SOC 2 Type 2' as a security framework; ISO 27001 is not listed anywhere on trust.stability.ai or in third-party compliance trackers.
source: stability.aiNo public evidence of HIPAA compliance or BAA availability. Stability AI's Terms of Service instruct users not to input sensitive personal information including 'health information', which points away from HIPAA-covered use.
source: trust.stability.aiNo public evidence; not applicable in captured materials (no first-party payment-card processing described; billing appears to route through a third-party payment processor).
source: trust.stability.aiNo public evidence: not listed among the trust center's Compliance or Security Frameworks entries.
source: trust.stability.aiNo public evidence: not listed among the trust center's Compliance or Security Frameworks entries.
// Privacy & AI training
Trains on customer data
Yes
Data processing agreement
Not offered
Data region
Not specified on vendor pages. Production infrastructure and the HPC training cluster are hosted on Amazon Web Services per the trust center subprocessor list; no specific data-residency region (e.g. EU-only hosting) is disclosed for Stable Audio.
Training is on by default with an opt-out, and the default differs by input type. Per the vendor's own Privacy Center: for Stable Audio, uploaded audio itself is not used for training, but the generated audio outputs from user interactions may be used to improve/train the model unless the user disables 'Training: Improve the Model for Everyone' in account settings at StableAudio.com. The same opt-out pattern is offered across Brand Studio, Platform API, and Stable Assistant, each with its own settings toggle. Enterprise/Self-Hosted License customers get full control over their data per the vendor's enterprise materials.
// Security controls
Independent SOC 2 Type 2 audit
Report available to prospects/customers via the trust center portal (request access required)
trust.stability.aiVulnerability Disclosure Program
Public VDP with a dedicated reporting page and security@stability.ai contact
trust.stability.aiPenetration testing
Third-party penetration testing performed; a 2025 Penetration Test Executive Report is published in the trust center resource library
trust.stability.aiSubprocessors disclosed
Named subprocessors include AWS (cloud hosting/HPC), Thorn (CSAM dataset filtering), Cinder (content-policy monitoring), and OpenRouter/Mistral/DeepInfra (only when using the 'AI Enhance Prompt' feature)
trust.stability.aiData retention
Personal information is generally retained no longer than one year, then deleted or anonymized unless a longer period is legally required
stability.aiCopyright / content controls
Uses Audible Magic content-recognition (ACR) technology on audio uploads to help detect and prevent copyright infringement
stability.ai// Products & data scope
data: No account data processed by Stability AI beyond a download; inference runs on the user's own infrastructure.
Free to download and run locally; commercial use governed by the Stability AI license terms.
data: Processes user prompts and any uploaded audio; generated outputs may be used for model training unless the user opts out in account settings.
Primary product mapped to the aifoxx 'stability-audio' listing.
data: Enterprise accounts with per-user training opt-out toggle in Settings.
Positioned for brand/marketing teams; separate plans/pricing from the consumer app.
data: Inputs/outputs sent via API; training opt-out available at platform.stability.ai/account/overview.
Used by third-party developers integrating Stable Audio generation into their own products.
data: Full customer control; models deployed in customer-controlled environment, no data leaves customer infrastructure.
Includes legal indemnification under Stability AI's Enterprise license, per vendor marketing copy.
// What to watch
- The captured trust center content lists SOC 2 Type 2 only; no ISO 27001, HIPAA, PCI DSS, ISO 42001, or CSA STAR evidence exists anywhere on vendor-owned pages as of this review, despite Stability AI's enterprise-facing marketing (indemnification, Brand Studio, Self-Hosted License). Do not infer these certs from the enterprise positioning alone.
- No standalone, publicly linked Data Processing Agreement (DPA) document was found; enterprise customers should confirm DPA availability directly with Stability AI's legal/privacy team.
- Training-on-data policy differs by product and by input type (uploaded audio vs. generated output) and is opt-out, not opt-in, by default - flag this nuance in any listing copy so it is not mis-simplified as 'does not train on your data'.
// At a glance
Pricing model
Free open-weight download; paid consumer/creator plans on StableAudio.com; usage-based Platform API; custom enterprise pricing for Brand Studio and Self-Hosted License (includes indemnification)
Self-hostable
Yes
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Stability AI Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-27. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.stability.ai