// Trust & Security Report
Wombo Dream
by WOMBO Studios Inc.
WOMBO Dream is an AI-powered text-to-image and text-to-video generator with 100+ artistic styles, powered by Stable Diffusion. Consumer-focused entertainment product with 200M+ downloads.
Certifications held
1
Maturity
Growth
Trains on your data
No
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on w.ai“Privacy policy states verbatim: 'Depending on your jurisdiction, you may have rights to: Access or receive a copy of your personal information. Correct inaccurate or incomplete data. Delete certain data ("right to be forgotten"). Restrict or object to certain processing. Withdraw consent for marketing or non-essential cookies. Receive your data in a portable format. Lodge a complaint with a supervisory authority.' Cross-border transfers rely on 'Standard Contractual Clauses, adequacy decisions, or your explicit consent.' Note: the policy documents GDPR-style data subject rights but does not name GDPR explicitly, and there is no third-party GDPR attestation (GDPR compliance is self-declared).”
> Show 6 unconfirmed / not-held certifications
No public evidence on vendor domain. Nudge Security security profile lists 'SOC 2 Compliant' but explicitly notes 'other security documentation links (security page, bug bounty program, vulnerability disclosure) were not populated in this profile.' Claims unverified.
No public evidence on vendor domain. Nudge Security lists claim but without independent verification. WOMBO's privacy policy at w.ai/privacy-policy makes no mention of ISO 27001 certification.
No public evidence on vendor domain. WOMBO Dream is a consumer AI art generator, not a covered entity under HIPAA (no healthcare services). Nudge Security claim unverified and likely inapplicable.
source: dream.aiNo public evidence on vendor domain. WOMBO Dream is a consumer product with no indication of federal contracting status. Nudge Security claim unverified.
source: w.aiNo public evidence on vendor domain. Privacy policy does not mention PCI compliance. Nudge Security claim unverified.
No public evidence on vendor domain. No mention in privacy policy or any WOMBO-owned web properties. Nudge Security claim unverified.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Not offered
Data region
Operations span US, Canada, EEA, UK, Singapore. Privacy policy states reliance on 'Standard Contractual Clauses, adequacy decisions, or your explicit consent' for cross-border transfers.
Privacy policy states verbatim: 'We do not sell your personal information for money, nor do we allow third-party model providers to train on your raw content without your explicit permission.' It also states 'we only train or fine-tune models on anonymized or aggregated data unless you opt-in.' No explicit opt-out mechanism is published, and these claims are self-declared with no independent audit.
// Security controls
Encryption in transit
No public evidence. The privacy policy's Data Security section provides no substantive detail and does not mention encryption, TLS, or secure connections. WOMBO publishes no security page documenting encryption practices.
w.aiData retention
CEO states 'all user data is deleted after 24 hours.' Privacy policy states retention 'only as long as necessary to fulfill the purposes.'
Third-party sharing
Shares data with service providers (hosting, analytics, support), AWS, Netlify, Google Workspace, Google Analytics, and payment processors.
Biometric data handling
Facial feature data temporarily shared with AWS to enable photo animation. Google Play store declares 'No data shared with third parties' but this contradicts documented AWS sharing for biometric processing.
Authentication
Supports Okta, Google Login, Microsoft Login, and SSO capabilities.
security-profiles.nudgesecurity.com// Products & data scope
Data it handles: Text prompts, generated images/videos, optional user account data (email, user ID), device identifiers, crash logs, app interaction data
Consumer-focused product. 200M+ downloads as of 2024. Text-to-image powered by Stable Diffusion. Optional biometric input for deepfake/avatar features. Available on iOS, Android, and web.
Data it handles: User photos (optional selfies)
Launched 2023, generates avatars from single selfies with professional and imaginative avatar packs
Data it handles: Compute network participation data, optional account information
Separate from Dream consumer product. Described as 'decentralized AI supercomputer.' Privacy policy at w.ai/privacy-policy governs both w.ai and WOMBO Dream services.
// What to watch
- Nudge Security lists seven major certifications for WOMBO (SOC 2, ISO 27001, HIPAA, FedRAMP, PCI, CSA STAR Level 1, GDPR-compliant), but none are independently verified on WOMBO's official domains (dream.ai or w.ai). Nudge Security's own profile states that other security documentation links (security page, bug bounty program, vulnerability disclosure) were not populated in this profile, so these claims appear unverified or self-reported.
- AWS data centers used for biometric processing are SOC 2 certified; that is AWS's certification, not WOMBO's, and biometric data sharing with AWS does not grant WOMBO certification.
- dream.ai has no published trust center, security page, or compliance documentation; /trust-center, /compliance, and /legal/privacy return 404.
- The Google Play store listing declares 'No data shared with third parties,' but documented evidence shows data sharing with AWS for biometric processing.
- A class action lawsuit filed in August 2024 alleges illegal biometric data collection and sharing without Illinois BIPA consent; the lawsuit was ongoing as of November 2025.
- The privacy policy at w.ai/privacy-policy governs both w.ai (distributed compute) and WOMBO Dream (consumer art tool); it is not clear whether all privacy terms apply equally to both products.
- No SOC 2 reports, ISO 27001 certificates, or other audit documentation are published or discoverable.
- The privacy policy states that only 'anonymized or aggregated data' is used for training, but does not detail the anonymization methods or reference an independent compliance audit.
// At a glance
Pricing model
Freemium with premium subscription tier. Premium offers priority processing, ad removal, higher quality outputs.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on WOMBO Studios Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
w.ai