Artisan: security & AI-training scorecard
artisan.co ↗ · AI SDR · Last checked Oct 17, 2026
Does Artisan train AI on customer data?
No“Artisan will not use Personal Data contained in Customer Data (including Outbound Communications Data) to train, fine-tune, benchmark, or improve any AI model outside the scope of delivering the Subscription Services to Customer under this Agreement, without Customer’s prior express written consent, unless in anonymized or aggregated form that cannot be re-identified.”
Note: Carve-out for anonymized/aggregated data. The privacy policy separately says Artisan may use usage patterns, interaction data and feedback to train its language models.
SOC 2
Independent audit of security controls. Type II covers operating effectiveness over a period.
Type II
“Artisan maintains a SOC 2 Type II report for its security controls.”
Note: Stated in the DPA (report provided under NDA on request). The public trust center lists no certifications and says: 'We are working on our security compliance.'
ISO/IEC 27001
Certified information security management system.
Not verified from vendor-owned sources
Note: No statement found in fetched sources.
No vendor source found as of check date.
HIPAA / BAA
Whether the vendor will sign a Business Associate Agreement for PHI.
Not HIPAA-tailored (per terms)
“The Services are not tailored to comply with industry-specific regulations, including HIPAA, GLBA, or FISMA”
GDPR DPA
Data Processing Agreement/Addendum for personal data.
DPA published (incorporated into terms)
“By accepting this Agreement, you enter into the DPA on your behalf.”
Trains AI on customer data
Whether the vendor says it uses customer data to train AI models.
No
“Artisan will not use Personal Data contained in Customer Data (including Outbound Communications Data) to train, fine-tune, benchmark, or improve any AI model outside the scope of delivering the Subscription Services to Customer under this Agreement, without Customer’s prior express written consent, unless in anonymized or aggregated form that cannot be re-identified.”
Note: Carve-out for anonymized/aggregated data. The privacy policy separately says Artisan may use usage patterns, interaction data and feedback to train its language models.
Data retention
What the vendor publishes about how long customer data is kept.
Deleted or returned within 30 days of termination on written request
“Upon termination of the applicable Subscription Term, Artisan will, upon Customer's written request, delete or return Customer Data within thirty (30) days”
Subprocessor list
Where the vendor lists third parties that process customer data.
Note: Listed under Legal > Subprocessors in trust center.
Trust center
The vendor's security/trust portal.
Note: SafeBase portal; read via WebFetch.
All sources checked (4)
Fetched on Oct 17, 2026. Vendor pages can change after this date.
Is this wrong? / Claim this listing
Vendors and readers can send evidence links. Nothing is published without a source.
Informational only, not legal advice or an audit. Summaries reflect Artisan's published pages as of Oct 17, 2026; verify with the vendor. Methodology & disclaimer.