Clay: security & AI-training scorecard
clay.com ↗ · Data enrichment · Last checked Oct 16, 2026
Does Clay train AI on customer data?
No“Customer data is never used to train Clay's AI models or those of our AI providers.”
Note: Source is Clay's documentation site (university.clay.com), not a contract.
SOC 2
Independent audit of security controls. Type II covers operating effectiveness over a period.
Type II
“SOC 2 Type 2”
ISO/IEC 27001
Certified information security management system.
Yes
“ISO 27001:2022”
HIPAA / BAA
Whether the vendor will sign a Business Associate Agreement for PHI.
Not verified from vendor-owned sources
Note: No HIPAA/BAA statement found in fetched sources.
No vendor source found as of check date.
GDPR DPA
Data Processing Agreement/Addendum for personal data.
DPA available on request
“Clay offers Data Processing Agreements (DPAs) to users upon request.”
Trains AI on customer data
Whether the vendor says it uses customer data to train AI models.
No
“Customer data is never used to train Clay's AI models or those of our AI providers.”
Note: Source is Clay's documentation site (university.clay.com), not a contract.
Data retention
What the vendor publishes about how long customer data is kept.
No specific period published; trust center lists deletion-on-exit control
“Customer data deleted upon leaving”
Subprocessor list
Where the vendor lists third parties that process customer data.
Note: Subprocessors section of trust center.
All sources checked (4)
Fetched on Oct 16, 2026. Vendor pages can change after this date.
Is this wrong? / Claim this listing
Vendors and readers can send evidence links. Nothing is published without a source.
Informational only, not legal advice or an audit. Summaries reflect Clay's published pages as of Oct 16, 2026; verify with the vendor. Methodology & disclaimer.