Which AI Tools Are SOC 2 / GDPR / HIPAA / EU AI Act Compliant? (2026)
We track compliance for 165 AI tools and agents. 57% publish a SOC 2 Type II report, 73% state GDPR compliance, and 35% offer HIPAA/BAA. Each row also shows ISO 27001, EU AI Act risk tier, and Article-50 transparency — verified from the vendor's own trust page.
Last updated 2026-10-03
Compliance matrix
| Tool / Agent | SOC 2 | GDPR | HIPAA | ISO 27001 | EU AI Act tier | Art-50 |
|---|---|---|---|---|---|---|
| Composio (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Comm100 AI (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Gorgias AI (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| boost.ai (tool) | — | ✓ | — | — | UNCLASSIFIED | — |
| FlutterFlow AI (tool) | — | ✓ | — | — | UNCLASSIFIED | — |
| Adalo (tool) | — | — | — | — | UNCLASSIFIED | — |
| Claude Code (tool) | — | ✓ | — | — | UNCLASSIFIED | — |
| Databricks (tool) | — | — | — | — | UNCLASSIFIED | — |
| Deepnote (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| AdCreative.ai (tool) | — | ✓ | — | — | UNCLASSIFIED | — |
| Apollo.io (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Assembled (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Microsoft Foundry (tool) | — | — | — | — | UNCLASSIFIED | — |
| Clay (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Cognigy (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| HubSpot (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| DataRobot (tool) | — | ✓ | — | — | UNCLASSIFIED | — |
| Graphite (tool) | ✓ TYPE_II | — | — | — | UNCLASSIFIED | — |
| Inngest Agent (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Instantly AI (tool) | — | ✓ | — | — | UNCLASSIFIED | — |
| CircleCI AI (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Clari AI (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Clearbit Agent (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Datadog AI (tool) | ✓ TYPE_II | — | ✓ | — | UNCLASSIFIED | — |
| Helicone (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Agenta (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Comet Opik (tool) | ✓ TYPE_II | ✓ | ✓ | ✓ | UNCLASSIFIED | — |
| Chatfuel (tool) | — | ✓ | — | — | UNCLASSIFIED | — |
| Atlan Context Agents (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Coalesce Scout (tool) | — | ✓ | ✓ | — | UNCLASSIFIED | — |
| HubSpot Service Hub (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Figma AI (tool) | ✓ TYPE_II | ✓ | — | ✓ | UNCLASSIFIED | — |
| Hotjar AI (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Amplitude AI (tool) | — | ✓ | ✓ | — | UNCLASSIFIED | — |
| Akkio (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| DeepBrain AI (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Chatbase (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Getimg.ai (tool) | — | ✓ | — | — | UNCLASSIFIED | — |
| Help Scout AI (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| xpander.ai (agent) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Artisan AI (agent) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Salesforce Agentforce (agent) | — | ✓ | ✓ | — | UNCLASSIFIED | — |
| Ironclad Jurist (agent) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Bland AI (agent) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Synthflow AI (agent) | ✓ TYPE_II | ✓ | ✓ | — | LIMITED | — |
| Retell AI (agent) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Sintra AI (agent) | — | ✓ | — | — | UNCLASSIFIED | — |
| Devin (agent) | ✓ TYPE_II | — | — | — | UNCLASSIFIED | — |
| FloQast (agent) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Beam AI (agent) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| 11x AI (agent) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Harvey (agent) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| UiPath (agent) | — | ✓ | ✓ | — | UNCLASSIFIED | — |
| Tonkean (agent) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Conversica (agent) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Certainly (agent) | — | ✓ | — | — | UNCLASSIFIED | — |
| CodeRabbit (agent) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Codegen (agent) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Glia (agent) | ✓ TYPE_II | — | ✓ | — | UNCLASSIFIED | — |
| LangGraph (agent) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| ThoughtSpot Spotter (agent) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Manus (agent) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Ema (agent) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Mistral Agents (agent) | ✓ TYPE_II | ✓ | — | — | GPAI | — |
| Gumloop (agent) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Lindy (agent) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Cassidy AI (agent) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Bardeen (agent) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Genie AI (agent) | — | ✓ | — | — | UNCLASSIFIED | — |
| Replit Agent (agent) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Trullion (agent) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Augment Code (agent) | ✓ TYPE_II | ✓ | ✓ | — | LIMITED | — |
| Lumen (agent) | — | ✓ | — | — | UNCLASSIFIED | — |
| Hex Magic (agent) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Ada (agent) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Intercom Fin Agent (agent) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Forethought (agent) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Decagon AI (agent) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Hebbia (agent) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Activepieces (tool) | — | ✓ | — | — | UNCLASSIFIED | — |
| Harness AI (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Gladly AI (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Buildkite Agent (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| North (agent) | ✓ TYPE_II | — | — | — | UNCLASSIFIED | — |
| Bubble AI (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| HuggingFace Agent (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Ada Health (tool) | — | ✓ | ✓ | — | HIGH | — |
| Glide AI (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| crewAI (tool) | ✓ TYPE_II | — | — | — | UNCLASSIFIED | — |
| Dust (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Gong AI Agent (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Celonis (tool) | — | — | — | — | UNCLASSIFIED | — |
| Haptik (tool) | — | ✓ | ✓ | — | UNCLASSIFIED | — |
| Dataiku (tool) | ✓ TYPE_II | ✓ | — | ✓ | UNCLASSIFIED | — |
| Capacity AI (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Albato (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Cognism AI (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| AthenaHQ (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Hyperscience (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Insider (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Arize Phoenix (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Higgsfield AI (tool) | — | ✓ | — | — | UNCLASSIFIED | — |
| BuildShip (tool) | — | ✓ | ✓ | — | UNCLASSIFIED | — |
| Airtable AI (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Stability AI (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | ✓ |
| Automation Anywhere (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Hex (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Abacus.AI (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| Coefficient (tool) | ✓ TYPE_II | ✓ | ✓ | — | UNCLASSIFIED | — |
| AWS Bedrock Agents (agent) | ✓ TYPE_II | ✓ | ✓ | ✓ | UNCLASSIFIED | — |
| Ellipsis AI (agent) | — | — | — | — | UNCLASSIFIED | — |
| Sierra (agent) | ✓ TYPE_II | ✓ | ✓ | ✓ | LIMITED | ✓ |
| ContentBot (tool) | — | ✓ | — | — | UNCLASSIFIED | — |
| Amp (Sourcegraph) (agent) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Glass Health (tool) | — | — | ✓ | — | UNCLASSIFIED | — |
| Elai.io (tool) | — | ✓ | — | — | UNCLASSIFIED | — |
| Google Veo (tool) | — | — | — | — | LIMITED | ✓ |
| Open WebUI (tool) | — | — | — | — | UNCLASSIFIED | — |
| Hailuo AI (tool) | — | — | — | — | LIMITED | — |
| Directual (tool) | — | ✓ | — | — | UNCLASSIFIED | — |
| expert.ai (tool) | — | ✓ | — | — | UNCLASSIFIED | — |
| Brand24 (tool) | — | — | — | — | UNCLASSIFIED | — |
| Crayon AI (tool) | — | ✓ | — | — | UNCLASSIFIED | — |
| Codex CLI (tool) | — | — | — | — | UNCLASSIFIED | — |
| Arya.ai (tool) | — | ✓ | — | — | UNCLASSIFIED | — |
| Axiom.ai (tool) | — | ✓ | — | — | UNCLASSIFIED | — |
| Agno (tool) | — | — | — | — | UNCLASSIFIED | — |
| Amplemarket (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Imagine AI (tool) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Haystack (tool) | — | — | — | — | UNCLASSIFIED | — |
| Flair.ai (tool) | — | — | — | — | UNCLASSIFIED | — |
| Insilico Medicine (tool) | — | ✓ | — | — | UNCLASSIFIED | — |
| Everlaw AI (tool) | ✓ TYPE_II | ✓ | ✓ | ✓ | UNCLASSIFIED | — |
| Structurely (agent) | — | — | — | — | UNCLASSIFIED | — |
| nunu.ai (agent) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Kiro (agent) | — | — | ✓ | — | UNCLASSIFIED | — |
| OpenHands (agent) | — | — | — | — | UNCLASSIFIED | — |
| Aible Agentic Analytics (agent) | — | — | — | — | UNCLASSIFIED | — |
| Daloopa Scout (agent) | — | ✓ | — | — | UNCLASSIFIED | — |
| Siena (agent) | — | ✓ | — | — | UNCLASSIFIED | — |
| Regie AI (agent) | ✓ TYPE_II | ✓ | — | — | UNCLASSIFIED | — |
| Lexis+ Protege (agent) | — | — | — | — | UNCLASSIFIED | — |
| Microsoft Copilot Studio (agent) | — | — | — | — | UNCLASSIFIED | — |
| VoiceGenie (agent) | — | ✓ | ✓ | — | UNCLASSIFIED | — |
| AutoGPT (agent) | — | ✓ | — | — | UNCLASSIFIED | — |
| Cline (agent) | — | — | — | — | UNCLASSIFIED | — |
| Factory AI (agent) | ✓ TYPE_II | ✓ | — | ✓ | UNCLASSIFIED | — |
| Google Assistant Agent (agent) | — | — | — | — | UNCLASSIFIED | — |
| Siri AI Agent (agent) | — | — | — | — | UNCLASSIFIED | — |
| Baidu Comate Agent (agent) | — | — | — | — | UNCLASSIFIED | — |
| Clearscope (tool) | — | — | — | — | UNCLASSIFIED | — |
| DomoAI (tool) | — | — | — | — | UNCLASSIFIED | — |
| Bramework (tool) | — | — | — | — | UNCLASSIFIED | — |
| Undermind (agent) | — | — | — | — | UNCLASSIFIED | — |
| Fume (agent) | ✓ TYPE_II | — | — | — | UNCLASSIFIED | — |
| Sema4.ai (agent) | — | — | — | — | UNCLASSIFIED | — |
| MetaGPT (agent) | — | — | — | — | UNCLASSIFIED | — |
| Devika (agent) | — | — | — | — | UNCLASSIFIED | — |
| Refact.ai Agent (agent) | — | — | — | — | UNCLASSIFIED | — |
| Qwen Agent (agent) | — | — | — | — | UNCLASSIFIED | — |
| Z.ai (agent) | — | — | — | — | GPAI | — |
| Power Automate Agent (agent) | — | — | — | — | UNCLASSIFIED | — |
| Atomic Agents (tool) | — | — | — | — | UNCLASSIFIED | — |
| Hotpot AI (tool) | — | — | — | — | UNCLASSIFIED | — |
| Agency Swarm (tool) | — | — | — | — | UNCLASSIFIED | — |
✓ = vendor explicitly states it · — = not stated (not a claim of non-compliance).
How we verify compliance
Each claim is read from the vendor's own trust / security / transparency / AI-Act page and re-checked on a schedule. We reject marketing language ("SOC 2 in progress", "HIPAA-ready", "GDPR-friendly") and show a "—" when a claim is not explicitly stated, rather than implying a false negative. EU AI Act Article-50 covers AI-interaction disclosure, synthetic-content marking (C2PA/SynthID), biometric-system disclosure, and deepfake labeling.
Frequently asked questions
What is EU AI Act Article 50?
Article 50 sets transparency obligations that became enforceable on August 2, 2026: providers must tell users when they are interacting with an AI, mark AI-generated (synthetic) content in a machine-readable way, and deployers must disclose deepfakes. This page tracks each tool's Article-50 disclosure posture.
Which AI tools are HIPAA compliant?
Of the 165 items tracked, 35% state HIPAA compliance or offer a BAA. Filter the matrix by HIPAA to see them. We only mark HIPAA when a vendor explicitly states it or offers a BAA — marketing phrases like "HIPAA-ready" are not counted.
What is the difference between SOC 2 Type I and Type II?
Type I attests controls at a single point in time; Type II attests they operated effectively over a period (usually 3–12 months). We record the type where the vendor states it.
How is compliance verified here?
Each claim is read from the vendor's own trust / security / transparency page and re-checked on a schedule. We reject marketing language ("SOC 2 in progress", "GDPR-friendly") and show a — when a claim is not explicitly stated rather than implying a false negative.