Security

What each provider says about how it keeps accounts and data safe, such as audits and admin controls.

Please note: This site is only a guide to help people understand. Consult your IT, security and/or privacy department for clarification.

No provider is ranked or recommended here. Providers appear in the same order every time. Why these tools? Facts were last reviewed on 2026-10-07. If we could not find a fact on a provider's own pages, the table says “Not found in reviewed sources.”

Security: Frontier model providers
Claude	ChatGPT	Gemini	Grok	Llama
Anthropic's trust center lists SOC 2 Type 2, ISO 27001, ISO 42001 and CSA STAR for the Team plan, the Enterprise plan and the API. HIPAA is listed for Enterprise and the API, not for Team. Source for Claude, SecurityChecked 2026-10-07 Single sign-on (SSO) comes with Team and Enterprise. Automatic user setup (SCIM), audit logs and custom data-retention settings are Enterprise only. Source for Claude, SecurityChecked 2026-10-07	OpenAI's trust portal lists SOC 2 Type 2, SOC 3, ISO/IEC 27001, 27017, 27018, 27701 and 42001, and CSA STAR. Its ISO 27001 certificate covers the API, ChatGPT Enterprise and ChatGPT Edu. Source for ChatGPT, SecurityChecked 2026-10-07 ChatGPT Business and Enterprise have each completed a SOC 2 Type 2 audit. Data is encrypted when stored and when sent, and SAML single sign-on is available. Source for ChatGPT, SecurityChecked 2026-10-07	With Google Workspace, Gemini holds SOC 1/2/3, ISO 9001, ISO/IEC 27001, 27701, 27017, 27018 and 42001, and FedRAMP High, and can support HIPAA work. Source for Gemini, SecurityChecked 2026-10-07 Workspace admins can turn the Gemini app on or off for users (it is on by default), and audit logs show Gemini activity. Source for Gemini, SecurityChecked 2026-10-07	xAI's pricing page lists SOC 2 (Type I and II) on every plan. Its business page also lists HIPAA, GDPR and CCPA. Its detailed trust center requires a request form to view documents. Source for Grok, SecurityChecked 2026-10-07 Business accounts get SAML single sign-on and a 90-day audit trail that admins can export. Data is encrypted when sent and when stored. Source for Grok, SecurityChecked 2026-10-07 x.ai is run by SpaceXAI. Some older claims below say "xAI", the name the same pages used when we first read them.	From the model developer (Meta) If you or a vendor run Llama, security is the host's job. Meta's license provides Llama "as is" and says the user is solely responsible for the risks of using it. Source for Llama, SecurityChecked 2026-10-07 From the host: Amazon Web Services (Amazon Bedrock) Example host, Amazon Bedrock: in scope for ISO, SOC and CSA STAR Level 2, and HIPAA eligible. Under AWS's shared-responsibility model, you manage your own content and security settings. Source for Llama, SecurityApplies to: Amazon BedrockChecked 2026-10-07 Open-weight: the developer's license and the host's terms are separate. Whoever hosts the model is responsible for its security.

Security: Other general AI assistants
Microsoft Copilot	Perplexity	Mistral Le Chat
Microsoft says Microsoft 365 Copilot has compliance offerings and certifications including GDPR, ISO 27001, HIPAA and ISO 42001, and keeps Microsoft 365's existing security, privacy and compliance commitments. Source for Microsoft Copilot, SecurityApplies to: Microsoft 365 Copilot (now named Microsoft Copilot), paid work licenseChecked 2026-10-08 Copilot Chat prompts and responses are logged and stored in Exchange for auditing and eDiscovery, and the same retention policies used for Microsoft 365 Copilot can be applied. For Microsoft 365 Copilot, admins can view and manage stored prompts and responses with Content search or Microsoft Purview. Source for Microsoft Copilot, SecurityApplies to: Microsoft 365 Copilot and Copilot Chat (work)The Content search and Microsoft Purview sentence is on https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy.Checked 2026-10-08 Admins can block Copilot Chat for all users or for specific users and groups, control web search with the "Allow web search in Copilot" policy, and see a usage report. Sign-in is with a Microsoft Entra work or school account. Source for Microsoft Copilot, SecurityApplies to: Microsoft 365 Copilot Chat (now named Microsoft Copilot Chat)Checked 2026-10-08 Security: Not found in reviewed sources: A certification or audit list (SOC or ISO) covering the consumer Copilot app Source for Microsoft Copilot, SecurityApplies to: Microsoft Copilot app (consumer)We checked the consumer Copilot privacy overview, privacy controls, activity history and the older Privacy FAQ.Checked 2026-10-08	Perplexity says it is SOC 2 Type II certified. Enterprise Pro includes single sign-on (SSO). Source for Perplexity, SecurityApplies to: Perplexity Enterprise (Enterprise Pro)Checked 2026-10-08 Audit logs (real-time to a webhook) are only for Enterprise organizations with 50 or more seats or at least one Enterprise Max user. SCIM, audit logs and configurable data retention have no seat minimum if the organization has at least one Enterprise Max user. Source for Perplexity, SecurityApplies to: Perplexity Enterprise (Enterprise Pro (50+ seats), Enterprise Max)The SCIM sentence is on Perplexity's plans page, https://www.perplexity.ai/help-center/en/articles/11187416-which-perplexity-subscription-plan-is-right-for-you.Checked 2026-10-08 Security: Not found in reviewed sources: The full certification list on Perplexity's Trust Center Source for Perplexity, SecurityThe Trust Center page needs JavaScript. Our page fetch saw only the title, and the browser could not read it.Checked 2026-10-08	Mistral says it complies with SOC 2 Type II and ISO 27001/27701. Compliance reports are requested through the Trust Center. Source for Mistral Le Chat, SecurityApplies to: Mistral (company-wide)Read from the help-center article. The Trust Center page itself (trust.mistral.ai) was not opened.Checked 2026-10-08 Audit logs and SAML single sign-on are listed for the Enterprise plan. Team lists domain name verification and data export. Source for Mistral Le Chat, SecurityApplies to: Vibe (Team, Enterprise)Checked 2026-10-08

Security: Tools built for nonprofits
Givebutter	Grantable
Payments go through Stripe, which Givebutter calls its PCI-compliant payments partner. Givebutter says it uses industry-standard encryption for data in transit and offers two-factor authentication (2FA) for logins. Staff access follows "least privilege". Source for Givebutter, SecurityApplies to: GivebutterChecked 2026-10-08 Admin controls: preset user roles (Administrator, Finance, Campaign Editor, CRM Manager, Mobile Access). Only an Administrator can add or remove account users. Source for Givebutter, SecurityApplies to: GivebutterChecked 2026-10-08 Security: Not found in reviewed sources: A named SOC 2 or ISO certification of Givebutter itself (not Stripe), SSO or SAML, and admin audit logs Source for Givebutter, SecurityApplies to: GivebutterWe checked the trust-and-safety page, the security help article, the account-users help article and the privacy policy.Checked 2026-10-08	Grantable's last SOC 2 Type II examination covered 9 April to 9 July 2025. Grantable says it does not claim an active certification while further work is in progress. Data is encrypted in transit (TLS 1.2+) and at rest, and it uses role-based access controls. Source for Grantable, SecurityApplies to: GrantableChecked 2026-10-08 Admin controls: workspace roles are Admin, Editor, Commenter and Viewer. Account roles are Owner, Admin and Member. The Owner manages billing and settings. Source for Grantable, SecurityApplies to: GrantableChecked 2026-10-08 SSO/SAML is listed under enterprise features ("Talk to sales"). The sub-processor list names WorkOS for single sign-on, only for organizations that use it. Source for Grantable, SecurityApplies to: Grantable (Enterprise)The WorkOS detail is on https://grantable.co/legal/sub-processors.Checked 2026-10-08 Security: Not found in reviewed sources: Admin audit logs Source for Grantable, SecurityApplies to: GrantableWe checked the trust, roles-permissions and pricing pages.Checked 2026-10-08

Questions to ask any provider

Ask these about security before you commit. See the full printable checklist.

SecurityWhich independent security audit reports can you share with us?A report from an outside auditor is better evidence than a promise on a web page.What admin and access controls do we get, such as single sign-on and who can see what?You need to be able to add and remove people quickly when staff or volunteers change.How fast will you tell us if our data is exposed in a breach, and how?Some laws and funders set deadlines, so you need to learn about a problem quickly.Can your support staff read our conversations, and under what conditions?People other than you may be able to see what you typed.Can you share your latest SOC 2 Type II report, and which products and dates does it cover?A Type II report tests whether controls worked over a period of time, but only for the system and dates it names.Does your ISO/IEC 27001 certificate's scope include the exact product and plan we would use?A certificate only covers the parts of the company listed in its scope, which may not include the tool you use.

New to this? Read lesson 2 first.