Common Room: security & AI-training scorecard
commonroom.io ↗ · Signals / intent · Last checked Oct 17, 2026
Does Common Room train AI on customer data?
UnknownNo vendor statement found as of the check date.
Note: No statement on AI model training found in privacy policy, DPA or security page.
No vendor source found as of check date.
SOC 2
Independent audit of security controls. Type II covers operating effectiveness over a period.
SOC 2 Type I per published DPA; current status not confirmed
“Processor maintains a SOC 2 type I certification, and is in the process of acquiring SOC 2 Type II certification”
Note: Statement is in the DPA's security annex; the DPA still cites EU Directive 95/46/EC, so it may be dated. The security page lists 'SOC' without a type.
ISO/IEC 27001
Certified information security management system.
Not verified from vendor-owned sources
Note: No statement found in fetched sources.
No vendor source found as of check date.
HIPAA / BAA
Whether the vendor will sign a Business Associate Agreement for PHI.
Not verified from vendor-owned sources
Note: No HIPAA/BAA statement found in fetched sources.
No vendor source found as of check date.
GDPR DPA
Data Processing Agreement/Addendum for personal data.
DPA published
“Data processing addendum PDF”
Trains AI on customer data
Whether the vendor says it uses customer data to train AI models.
Not verified from vendor-owned sources
Note: No statement on AI model training found in privacy policy, DPA or security page.
No vendor source found as of check date.
Data retention
What the vendor publishes about how long customer data is kept.
While you use the Services or as necessary for stated purposes
“We store the personal information we receive as described in this Privacy Notice for as long as you use our Services or as necessary to fulfill the purpose(s) for which it was collected”
Subprocessor list
Where the vendor lists third parties that process customer data.
Trust center
The vendor's security/trust portal.
Note: No separate trust portal; trust.commonroom.io did not resolve.
All sources checked (5)
Fetched on Oct 17, 2026. Vendor pages can change after this date.
Is this wrong? / Claim this listing
Vendors and readers can send evidence links. Nothing is published without a source.
Informational only, not legal advice or an audit. Summaries reflect Common Room's published pages as of Oct 17, 2026; verify with the vendor. Methodology & disclaimer.