// Trust & Security Report
Uncharted Labs, Inc. (d/b/a Udio)
Consumer AI music generation web app (udio.com). Single product line with tiered plans: Free, Standard, and Pro. No enterprise, team, or API/developer offering is published; no self-hosted or on-prem option.
Certifications held
0
Maturity
Startup
Trains on your data
Yes
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
> Show 8 unconfirmed / not-held certifications
source: udio.comno public evidence: no trust center, security page, or certification mention found on udio.com or unchartedlabs.ai; /security redirects to the login page
source: udio.comIndividuals and the data protection supervisory authorities in the EU/EEA ... may also contact our data protection representatives according to Article 27 GDPR/GDPR UK: EU: DP-Dock GmbH ... UK: DP Data Protection Services UK Ltd.
source: udio.comno public evidence; product is a consumer music generator with no health-data use case or BAA offering
source: udio.comOur payment processing partner Stripe, Inc. ("Stripe") collects your voluntarily-provided payment card information necessary to process your payment. -- card data is handled by Stripe, not Udio directly; no PCI DSS attestation for Udio itself found
source: udio.comno public evidence; consumer product, not marketed to US federal government
// Privacy & AI training
Trains on customer data
Yes
Data processing agreement
Not offered
Data region
United States. Privacy Policy states: 'The Services are hosted and operated in the United States ... you authorize the Company to transfer, store and process your information to and in the U.S., and possibly other countries. In some circumstances, your Personal Data may be transferred to the U.S. pursuant to a data processing agreement incorporating standard data protection clauses.'
Terms of Service state training use of both inputs and outputs is mandatory with no opt-out: 'You acknowledge and agree that we may use your Input Content and any Output to train or otherwise improve our Services, including our artificial intelligence and machine learnings model(s) related to the Services.' The content license grant is described as 'royalty free, fully paid-up, transferable, sub-licensable, assignable, worldwide, perpetual and irrevocable.' No tiered opt-out (Free/Standard/Pro) is mentioned anywhere in the Terms or Privacy Policy. Note: Udio is also the subject of active musician/rightsholder litigation (e.g. Illinois biometric-privacy suit and copyright class actions against Uncharted Labs) alleging training on copyrighted recordings and voiceprints without consent -- this is public litigation, not a vendor admission, and is flagged for awareness rather than graded as a cert.
// Security controls
Encryption in transit
not verified: no public technical documentation states encryption specifics; site is served over HTTPS
udio.comData security commitment
"We seek to protect your Personal Data from unauthorized access, use and disclosure using appropriate physical, technical, organizational and administrative security measures based on the type of Personal Data and how we are processing that data ... no method of transmitting data over the internet or storing data is completely secure." -- general assurance language, no specifics or independent audit referenced.
udio.comPayment handling
Payment card data is processed by Stripe, Inc. (third-party processor); Udio does not appear to directly store full card data.
udio.comGDPR Article 27 representatives
EU representative: DP-Dock GmbH (Hamburg, Germany); UK representative: DP Data Protection Services UK Ltd. (London) -- indicates baseline GDPR compliance infrastructure for a US-based company serving EU/UK users.
udio.comDo Not Track / GPC
"Please note that because of our use of Cookies, the Services do not support 'Do Not Track' requests sent from a browser at this time." Global Privacy Control (GPC) is honored for opt-out of sale/share/targeted advertising per the Privacy Policy's opt-out section.
udio.com// Products & data scope
data: Account profile/contact data, device/IP data, web analytics, uploaded Input Content (prompts, lyrics, optional audio files); no payment data collected
10 credits/day, 100 credits/month, 3 full-length (2:10) song generations per day. Input/Output used for AI training per ToS; no opt-out.
data: Same as Free plus payment data (via Stripe) and any uploaded reference audio/cover art
$8-10/month. Adds voice control, lyric/music editing, audio-file uploads, style reference from existing songs. Same training terms apply as Free tier.
data: Same as Standard
$24-30/month, highest generation limits. No enterprise/business tier, no team seats, no API, no admin/SSO controls found.
// What to watch
- No trust center, security page, or third-party audit/certification of any kind found on udio.com or unchartedlabs.ai; /security path redirects to login rather than a security page -- normal for a small consumer startup but means all security claims are unverifiable beyond generic Privacy Policy language.
- Mandatory AI training on user Input Content and Output with no opt-out, and a perpetual/irrevocable/sublicensable license grant over user content -- should be disclosed prominently to any AIFOXX visitor considering uploading original audio.
- Uncharted Labs, Inc. (Udio) is named in active third-party litigation (a 2025 Illinois class action alleging unlicensed biometric voiceprint collection, and copyright infringement suits from major labels/artists over training data) -- these are unresolved public legal allegations, not confirmed facts, and are not a substitute for a security/compliance assessment, but are material context for a listing.
- No DPA (Data Processing Agreement) or Business Associate Agreement is offered or referenced for customers -- appropriate for a B2C tool but means Udio is not suited for any use case requiring contractual data-processing terms.
- Identity check: confirmed the operating entity is Uncharted Labs, Inc. d/b/a udio.com (per Terms of Service masthead and litigation captions), not to be confused by name similarity with any other 'Udio'/'Uncharted' branded companies.
// At a glance
Pricing model
Freemium consumer subscription (Free / Standard ~$8-10mo / Pro ~$24-30mo) plus a la carte credit packs; no enterprise or usage-based API pricing published
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Uncharted Labs, Inc. (d/b/a Udio)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-09. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
udio.com