Pipedrive: security & AI-training scorecard
pipedrive.com ↗ · CRM AI · Last checked Oct 17, 2026
Does Pipedrive train AI on customer data?
Unclear“We do not permit third parties to use Client Data to improve or train their AI models.”
Note: Covers third parties. For Beta Services, terms allow Pipedrive to use Client Data 'to train or refine such capabilities solely for the purpose of providing the Beta Services to you.'
SOC 2
Independent audit of security controls. Type II covers operating effectiveness over a period.
Type II
“SOC 2 Type 2”
ISO/IEC 27001
Certified information security management system.
Yes
“ISO/IEC 27001:2022”
HIPAA / BAA
Whether the vendor will sign a Business Associate Agreement for PHI.
Not designed for HIPAA (per terms)
“not designed to comply with industry-specific regulations such as the Health Insurance Portability and Accountability Act (HIPAA)”
GDPR DPA
Data Processing Agreement/Addendum for personal data.
DPA published (incorporated into Terms)
“please refer to our Data Processing Addendum (the “DPA”), available at https://www.pipedrive.com/en/privacy/dpa”
Trains AI on customer data
Whether the vendor says it uses customer data to train AI models.
Unclear
“We do not permit third parties to use Client Data to improve or train their AI models.”
Note: Covers third parties. For Beta Services, terms allow Pipedrive to use Client Data 'to train or refine such capabilities solely for the purpose of providing the Beta Services to you.'
Data retention
What the vendor publishes about how long customer data is kept.
Varies; no fixed period published
“Our retention periods vary based on business, legal, and regulatory needs.”
Subprocessor list
Where the vendor lists third parties that process customer data.
Trust center
The vendor's security/trust portal.
Note: SafeBase portal; read via WebFetch.
All sources checked (5)
Fetched on Oct 17, 2026. Vendor pages can change after this date.
Is this wrong? / Claim this listing
Vendors and readers can send evidence links. Nothing is published without a source.
Informational only, not legal advice or an audit. Summaries reflect Pipedrive's published pages as of Oct 17, 2026; verify with the vendor. Methodology & disclaimer.