// Trust & Security Report
AI21 Labs Ltd.
AI-powered writing assistant (paraphrasing, rewriting, grammar/tone correction, summarization, translation) offered as a free/premium web app, browser extension, and mobile app; also sold as Wordtune for Business/Enterprise (adds a 'Traceless Model' privacy option) and exposed to developers as a Wordtune API through AI21 Studio. Wordtune is owned and operated by AI21 Labs Ltd, the Israeli company behind the Jamba/Jurassic LLM family and AI21 Studio.
Certifications held
5
Maturity
Growth
Trains on your data
Yes
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on ai21.com“we are proud to announce that AI21 Labs has successfully completed the SOC 2 audit report (report type/date not stated on the page). NOTE: this announcement is on AI21 Labs' corporate domain and never names Wordtune; Wordtune's own privacy policy, terms of use, business terms, and FAQ make no mention of SOC 2.”
Verify on ai21.com“AI21 Labs achieved ISO 27001, ISO 27017, and ISO 27018 certifications. NOTE: same corporate-domain-only caveat as SOC 2 above - Wordtune product pages do not reference this certification.”
Verify on ai21.com“AI21 Labs achieved ISO 27001, ISO 27017, and ISO 27018 certifications. Same scope caveat as ISO 27001 above.”
Verify on ai21.com“AI21 Labs achieved ISO 27001, ISO 27017, and ISO 27018 certifications. Same scope caveat as ISO 27001 above.”
Verify on wordtune.com“Wordtune will comply with GDPR transfer rules, including by implementing transfer mechanisms such as executing Standard Contractual Clauses with the data recipient and/or relying on their Data Privacy Framework certification.”
> Show 5 unconfirmed / not-held certifications
source: wordtune.comNo public evidence on wordtune.com or ai21.com of an ISO 42001 certification.
source: wordtune.comNo public evidence of CSA STAR registration or certification for Wordtune or AI21 Labs.
source: wordtune.comUsers are contractually barred from submitting sensitive categories: 'do not submit health information, financial account details, passwords, or government ID numbers' (paraphrase of Section 5.4 restriction). No BAA or HIPAA claim exists anywhere on wordtune.com.
source: wordtune.comNo PCI DSS claim found; payment processing is delegated to third-party processors (Stripe, Chargeflow) listed as sub-processors in the privacy policy, so card data does not appear to be handled directly by Wordtune.
source: wordtune.comNo public evidence; not applicable to this consumer/SMB writing tool.
// Privacy & AI training
Trains on customer data
Yes
Data processing agreement
Not offered
Data region
Primary processing/storage in the United States; cross-border transfers from EEA/UK/Switzerland covered by Standard Contractual Clauses and/or EU-US Data Privacy Framework reliance.
Consumer tier: Terms of Use grant Wordtune a 'nonexclusive, worldwide, royalty-free and fully-paid, transferable and sub-licensable, perpetual, and irrevocable license' to submitted content, usable to 'improve the algorithms underlying the Software'; users can only opt out of aggregated/de-identified use by emailing privacy@wordtune.com. Business tier: default plan lets 'Wordtune use the Input and Output on an anonymized basis to train its algorithms and improve the Service quality'; customers can instead purchase the 'Traceless Model,' under which 'all Input and Output will be automatically deleted a few seconds after generation, ensuring that Wordtune neither stores nor utilizes it for training.' No standalone customer-facing DPA was found publicly; the privacy policy only describes an internal intra-group data processing agreement covering transfers within the AI21 group.
// Security controls
Encryption in transit/at rest
Not specified in public documentation - only a generic statement that the company has 'implemented appropriate technical, organizational and security measures designed to protect your Personal Data.' No TLS/encryption-at-rest detail is published.
wordtune.comAI training opt-out
Consumer: opt-out limited to aggregated/de-identified use via emailing privacy@wordtune.com; default license otherwise permits use of content to improve algorithms. Business: 'Traceless Model' add-on disables storage and training entirely; the default business plan trains on anonymized input/output.
wordtune.comCross-border data transfer mechanism
Standard Contractual Clauses and/or reliance on the recipient's EU-US Data Privacy Framework certification.
wordtune.comSensitive data restriction
Terms of Use prohibit submitting health information, financial account details, passwords, or government ID numbers.
wordtune.comData retention
Personal data is stored until proactively deleted by Wordtune or a valid deletion request is received, subject to legal/litigation holds.
wordtune.comParent-entity certifications (corporate scope)
AI21 Labs Ltd - the legal entity that operates Wordtune per Wordtune's own Terms of Use - publicly states it holds SOC 2 and ISO 27001/27017/27018 certifications and runs a corporate Trust Center at trust.ai21.com. These are corporate-level claims on ai21.com; no Wordtune-specific document confirms the Wordtune product/infrastructure is within the certified scope.
ai21.com// Products & data scope
data: User-submitted text (documents, emails, messages); broad perpetual license granted to Wordtune for service delivery and algorithm improvement
Default plan trains on user content per Terms of Use; opt-out only for aggregated/de-identified use via email request. No cert claims on this tier.
data: Same as consumer by default (anonymized training) unless the 'Traceless Model' add-on is purchased, which deletes input/output within seconds and excludes it from training
Only tier where AI21 offers a documented no-training/no-retention mode ('Traceless Model'); this is the tier most likely to matter for buyers with strict data-handling requirements.
data: Developer-submitted API payloads processed through AI21 Studio infrastructure
Distributed through AI21 Studio rather than wordtune.com; falls under AI21's Studio/API terms rather than the consumer Wordtune Terms of Use - not independently verified in this assessment.
// What to watch
- Evidence-capture gap: the crawler only retrieved Wordtune's homepage.
- Identity/scope ambiguity: SOC 2 and ISO 27001/27017/27018 certifications are announced only on AI21 Labs' corporate domain (ai21.com) and are never tied to Wordtune by name; Wordtune's own privacy policy, terms of use, business terms of use, and FAQ contain zero mention of any certification. Because AI21 Labs Ltd is confirmed (via Wordtune's own Terms of Use) to be the entity operating Wordtune, these certs are graded held=true at the corporate level, but buyers should not assume Wordtune-specific product infrastructure was in the audit scope without asking AI21 directly.
- No dedicated Wordtune trust center exists; AI21's trust.ai21.com is a corporate trust center for the AI21 Labs entity, not a Wordtune-branded page, and was not independently loadable for full-text verification (JS-rendered).
- Consumer tier trains on user content by default via a broad perpetual license in the Terms of Use; the only documented no-training path (the 'Traceless Model') is a paid Business/Enterprise add-on, not available to free or Premium individual users.
- No evidence of a self-serve, customer-facing Data Processing Agreement; only an internal AI21-group intra-group DPA is documented.
// At a glance
Pricing model
Freemium subscription (free tier + paid Premium for individuals; separate paid Business/Enterprise plans with per-seat pricing and an optional 'Traceless Model' privacy add-on)
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on AI21 Labs Ltd.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-09. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
wordtune.com