// Trust & Security Report
Superhuman
Superhuman is a suite of AI productivity tools including Superhuman Mail (email), Grammarly (AI writing partner), Superhuman Docs (formerly Coda, all-in-one workspace), and Superhuman Go (AI assistant). Products work together as an integrated suite.
Certifications held
5
Maturity
Enterprise
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on trust.superhuman.com“SOC 2 Type 2 - Compliance certification displayed on Trust Center security certifications”
Verify on trust.superhuman.com“ISO/IEC 27001:2022 - Information security management system certification”
Verify on trust.superhuman.com“ISO/IEC 27017:2015 - Cloud security controls certification”
Verify on trust.superhuman.com“ISO/IEC 27018:2019 - Personal data protection in cloud services certification”
Verify on trust.superhuman.com“ISO/IEC 27701 - Privacy information management system certification”
> Show 2 unconfirmed / not-held certifications
source: blog.superhuman.comWe are not HIPAA-compliant and do not sign Business Associate Agreements for Protected Health Information sharing
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
United States and other locations where Superhuman and Sub-processors maintain operations. However, customer personal data originating in Europe will not be transferred outside Europe unless measures are taken to comply with European Data Privacy Laws. Superhuman participates in the Data Privacy Framework.
The Data Processing Addendum explicitly prohibits using customer data for AI training purposes. Superhuman has a Zero Day Data Retention agreement with LLM providers, meaning customer data will not be saved or retained by LLM providers.
// Security controls
Encryption at Rest
Google Cloud encryption infrastructure + application-level encryption for sensitive data
blog.superhuman.comEncryption in Transit
TLS 1.2+ for public internet traffic; Google Cloud ATLS for internal infrastructure traffic
blog.superhuman.comInfrastructure
Hosted on Google Cloud; benefits from Google's SOC 2 and ISO 27001 certifications
blog.superhuman.comData Residency (Mail)
For Superhuman Mail, inbox data is not stored on Superhuman servers - it is stored on the user's machine
blog.superhuman.com// Products & data scope
Data it handles: Email data downloaded from user accounts, stored on user's machine, not on Superhuman servers
SOC 2 Type 2 compliant; includes AI-powered features; Zero Day Data Retention for LLM providers
Data it handles: Text written in supported applications
AI writing assistant; part of unified Superhuman suite
Data it handles: Documents, wikis, project plans, shared with team members
All-in-one AI workspace; separate security documentation referenced
Data it handles: Works across Gmail, Drive, Jira, and 800+ other applications
Proactive AI assistant; integrates with user's favorite apps
// What to watch
- 'Superhuman' is the rebranded parent company formerly known as Grammarly Inc. (rebranded October 2025). The company owns Grammarly, Coda, and Mail. The privacy policy URL redirects to the Grammarly domain, indicating a shared privacy framework across products.
- Products are listed separately but are part of an integrated suite, and individual products may have varying compliance postures: Mail and Go are primary Superhuman products, while Grammarly and Docs are acquisitions under the Superhuman brand.
- Superhuman explicitly does not offer HIPAA compliance or sign Business Associate Agreements.
- There is no self-hosting option; all products are cloud-based SaaS only.
- Data residency defaults to the US; European data is handled under European frameworks (GDPR, DPF, SCCs).
- Superhuman Mail distinguishes itself with zero-knowledge local storage (the inbox is not stored on servers), reducing data exposure for email content.
// At a glance
Pricing model
Freemium with paid subscription tiers; suite pricing available
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Superhuman (formerly Grammarly Inc.)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.superhuman.com