Yandex (LLC Yandex)

Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.

• IDENTITY-CLARITY: Distinction between free Translate service and enterprise Yandex Cloud API. Free service has minimal compliance documentation; enterprise API inherits Yandex Cloud certifications but responsibility for compliance placed on customer per API terms.
• OVER-CLAIM-RISK: API terms explicitly disclaim liability and state 'no guarantee' of error-free operation or service consistency. Customer bears responsibility for legal compliance. Marketing may imply broader guarantees than actually provided.
• DATA-RESIDENCY: Primary data storage in Russia under Federal Law 152-FZ. International GDPR posture relies on the vendor's self-declared measures and a Data Processing Addendum; no Standard Contractual Clauses or EU adequacy basis is referenced on the vendor domain, a material concern for Western organizations subject to GDPR/HIPAA/government contracts.
• SOC-2-AMBIGUITY: SOC 2 certification confirmed only for Yandex ID service (2020-2022), not for Yandex Cloud or Yandex Translate. Public SOC 2 audit reports not available for the translation service.
• HIPAA-NOT-AVAILABLE: No evidence of HIPAA compliance or suitable business associate agreements for healthcare use cases.
• AI-TRAINING-DISCLOSURE: Free service permits use of user translations in marketing materials. Enterprise service does not train on customer data by default, but opt-in custom training available. Disclosure is buried in terms, not prominently featured.
• MIXED-RESPONSIBILITY: Free service governed by general Yandex terms; enterprise API customer responsible for compliance per API terms. Compliance posture depends heavily on which product tier customer uses.