Lavender: security & AI-training scorecard
lavender.ai ↗ · AI email assistant · Last checked Oct 17, 2026
Does Lavender train AI on customer data?
UnknownNo vendor statement found as of the check date.
Note: No statement on AI model training found in privacy page or terms.
No vendor source found as of check date.
SOC 2
Independent audit of security controls. Type II covers operating effectiveness over a period.
Type II
“We are SOC 2 Type 2 certified and GDPR compliant.”
ISO/IEC 27001
Certified information security management system.
Not verified from vendor-owned sources
Note: No statement found in fetched sources.
No vendor source found as of check date.
HIPAA / BAA
Whether the vendor will sign a Business Associate Agreement for PHI.
Not HIPAA-tailored (per terms)
“The Services are not tailored to comply with industry-specific regulations (Health Insurance Portability and Accountability Act (HIPAA)”
GDPR DPA
Data Processing Agreement/Addendum for personal data.
GDPR claimed; DPA not confirmed
“We are SOC 2 Type 2 certified and GDPR compliant.”
Trains AI on customer data
Whether the vendor says it uses customer data to train AI models.
Not verified from vendor-owned sources
Note: No statement on AI model training found in privacy page or terms.
No vendor source found as of check date.
Data retention
What the vendor publishes about how long customer data is kept.
Not verified from vendor-owned sources
Note: Not located in fetched sources.
No vendor source found as of check date.
Subprocessor list
Where the vendor lists third parties that process customer data.
Not verified from vendor-owned sources
Note: Not located in fetched sources.
No vendor source found as of check date.
Trust center
The vendor's security/trust portal.
Not verified from vendor-owned sources
Note: trust.lavender.ai (Drata) blocks automated access; contents not verified.
No vendor source found as of check date.
All sources checked (2)
Fetched on Oct 17, 2026. Vendor pages can change after this date.
Is this wrong? / Claim this listing
Vendors and readers can send evidence links. Nothing is published without a source.
Informational only, not legal advice or an audit. Summaries reflect Lavender's published pages as of Oct 17, 2026; verify with the vendor. Methodology & disclaimer.