Compliance posture comparison
Side-by-side view of all 22 tools' SOC 2, zero-retention, SSO, SCIM, HIPAA BAA, and data-residency posture. Use this to filter your AI stack by compliance requirements (HIPAA BAA needed? EU residency required? Only enterprise-tier features qualify?).
⚠ Editorial data — verify before relying
Compliance posture data is editorially curated from each vendor's trust page or security docs and was last verified on the dates shown per row. Posture changes faster than we re-verify — always confirm against the vendor's live trust page before making a compliance-critical decision. The Toolkit's editorial team is not a substitute for your firm's legal + compliance review.
"Verify with vendor" means the vendor does not publish that information publicly — request it directly before relying on the tool for client-data or firm-data work.
| Tool | Stage | SOC 2 | Zero retention | SSO | SCIM | HIPAA BAA | Data residency |
|---|---|---|---|---|---|---|---|
| Claude (Anthropic) | Get started | SOC 2 Type II | Not offered | Business tier+ | Enterprise only | Enterprise only | US only |
| ChatGPT (OpenAI) | Get started | SOC 2 Type II | Not offered | Business tier+ | Enterprise only | Enterprise only | Configurable |
| Microsoft Copilot | Get started | SOC 2 Type II | Not offered | All paid tiers | All paid tiers | Available | Configurable |
| Gemini (Google) | Get started | SOC 2 Type II | Not offered | All paid tiers | All paid tiers | Available | US + EU |
| Perplexity | Get started | SOC 2 Type II | Verify with vendor | Enterprise only | Enterprise only | Verify with vendor | US + EU |
| Jump | Get faster | SOC 2 Type II | Verify with vendor | Enterprise only | Enterprise only | Available | Verify with vendor |
| Zocks | Get faster | SOC 2 Type II | Enterprise only | Verify with vendor | Verify with vendor | Enterprise only | Verify with vendor |
| Pulse360 | Get faster | SOC 2 Type II | Verify with vendor | Verify with vendor | Verify with vendor | Verify with vendor | Verify with vendor |
| FP Alpha | Get faster | Verify with vendor | Verify with vendor | Verify with vendor | Verify with vendor | Verify with vendor | Verify with vendor |
| Catchlight | Get faster | Verify with vendor | Verify with vendor | Verify with vendor | Verify with vendor | Verify with vendor | Verify with vendor |
| Otter.ai | Get faster | SOC 2 Type II | Verify with vendor | Enterprise only | Verify with vendor | Enterprise only | Verify with vendor |
| Loom (Atlassian) | Get differentiated | SOC 2 Type II | Verify with vendor | Enterprise only | Enterprise only | Not offered | Verify with vendor |
| Canva (Magic Studio) | Get differentiated | SOC 2 Type II | Verify with vendor | Enterprise only | Enterprise only | Not offered | Verify with vendor |
| NotebookLM | Get differentiated | SOC 2 Type II | Business tier+ | All paid tiers | All paid tiers | Enterprise only | Configurable |
| Descript | Get differentiated | Verify with vendor | Verify with vendor | Verify with vendor | Verify with vendor | Verify with vendor | Verify with vendor |
| Gamma | Get differentiated | SOC 2 Type II | Verify with vendor | Business tier+ | Verify with vendor | Not offered | Verify with vendor |
| HeyGen | Get differentiated | SOC 2 Type II | Verify with vendor | Enterprise only | Enterprise only | Not offered | US only |
| Synthesia | Get differentiated | SOC 2 Type II | Verify with vendor | Enterprise only | Verify with vendor | Not offered | EU only |
| ElevenLabs | Get differentiated | SOC 2 Type II | Verify with vendor | Enterprise only | Verify with vendor | Enterprise only | Configurable |
| Zapier | Get systemic | SOC 2 Type II | Verify with vendor | Enterprise only | Enterprise only | Not offered | US only |
| Reclaim.ai | Get systemic | Verify with vendor | Verify with vendor | Verify with vendor | Verify with vendor | Verify with vendor | Verify with vendor |
| n8n | Get systemic | SOC 2 Type II | Self-hosted only | Enterprise only | Enterprise only | Self-hosted only | Configurable |
Notes per tool
Nuance the matrix can't capture. Always read alongside the per-cheatsheet "Compliance gotchas" section for tier-specific configuration details.
- Claude (Anthropic)· Last verified 2026-05-29
- Also ISO 27001 + ISO/IEC 42001 certified. Anthropic states the claude.ai Team and Enterprise interfaces are NOT zero-data-retention (ZDR) eligible — chat retention follows your org's retention setting (Enterprise adds custom retention controls). ZDR is offered by arrangement for the Claude API. HIPAA-ready configurations with a BAA: see Anthropic's HIPAA Implementation Guide (Trust Center) for Claude Enterprise requirements.
- ChatGPT (OpenAI)· Last verified 2026-05-29
- Also ISO 27001 + ISO 27701. Data residency available in US/EU/UK/JP/CA/KR/SG/AU/IN/UAE for eligible Enterprise + Edu + API customers. OpenAI does not offer a BAA for ChatGPT Business; a BAA requires ChatGPT Enterprise with a Regulated Workspace, or ChatGPT for Healthcare. Retention: OpenAI states Business/Enterprise workspace admins control how long data is retained and deleted conversations are removed within 30 days (unless legally required); zero data retention (ZDR) is an approval-based API arrangement, not a ChatGPT plan feature. OpenAI does not train on Business/Enterprise data by default.
- Microsoft Copilot· Last verified 2026-05-29
- Inherits M365 stack: SOC 2 + ISO 27001 + ISO 42001 + FedRAMP High. Advanced Data Residency + Multi-Geo add-ons; EU Data Boundary for EU customers. Existing M365 BAA covers Copilot. Web-search queries are NOT covered by the BAA. Retention: Microsoft stores Copilot prompts and responses as activity history under your organization's Microsoft 365 commitments (admins set retention via Microsoft Purview) — it is not zero-retention; Microsoft states prompts, responses and Graph data aren't used to train foundation LLMs.
- Gemini (Google)· Last verified 2026-10-19
- SOC 1/2/3 + ISO 27001/27017/27018/27701/42001 + FedRAMP High. Workspace tiers inherit Google BAA when properly enabled; consumer Gemini sits OUTSIDE the BAA boundary, and Google states Gemini Notebook is not covered by the BAA. Retention: per Google's Workspace privacy hub, Gemini app conversations are kept for up to 36 months (18 months by default) as set by admins (not zero-retention), and content isn't human-reviewed or used to train generative AI models outside your domain without permission.
- Perplexity· Last verified 2026-05-29
- SOC 2 Type II covering security, availability, processing integrity, confidentiality, privacy. 2025 HIPAA Gap Assessment completed but no public BAA. Retention: check Perplexity's current data-retention terms — its help center describes Enterprise data as not used for model training, 7-day auto-deletion of uploaded files, and custom retention periods for larger Enterprise organizations.
- Jump· Last verified 2026-10-19
- Vendor describes configurable per-firm data retention and no model training on client data — check Jump's current data-retention terms directly. No-recording / summary-only capture available. Zero data retention available on request. Audit trail per interaction. FA-specific compliance settings.
- Zocks· Last verified 2026-10-19
- SOC 2 Type II since Nov 2023. No-recording stance built in. AES-256 on AWS S3. Smarsh + Global Relay archive integrations. User-controlled retention at object level (per-meeting deletion). BAA and zero data retention are Enterprise-plan only. Confirm SSO/SCIM plan availability with Zocks.
- Pulse360· Last verified 2026-05-29
- SOC 2 Type II. AWS infrastructure supports HIPAA/HITECH. CaptureGenius meeting recorder stores per SEC/FINRA compliance. Check Pulse360's current data-retention and AI-training terms for its third-party AI providers. Verify SSO/SCIM/BAA terms directly with Pulse360 before adoption.
- FP Alpha· Last verified 2026-05-29
- FP Alpha does not publish detailed compliance documentation publicly. Request SOC 2 report + BAA terms + data-residency posture directly before uploading client tax returns, estate documents, or insurance dec pages.
- Catchlight· Last verified 2026-05-29
- Incubated in Fidelity Labs (compliance-aware lineage) but Catchlight does not publish detailed posture publicly. Request SOC 2 report + DPA + prospect-data handling terms directly. Especially relevant in strict-privacy states (CA, etc.) given inferred-financial-signal data.
- Otter.ai· Last verified 2026-05-29
- SOC 2 Type II since Jan 2022. HIPAA compliance achieved July 2025 — Enterprise plan only, BAA via account manager. Customer-defined retention; secure deletion on request. 2FA + AES-256 + TLS. CRM integrations Enterprise-only.
- Loom (Atlassian)· Last verified 2026-05-29
- SOC 2 Type II + GDPR + CCPA. Enterprise via Atlassian Guard Standard for SAML SSO + SCIM + advanced content privacy + custom data retention + 99.95% uptime SLA. Loom CANNOT sign BAAs — do NOT transmit or store PHI.
- Canva (Magic Studio)· Last verified 2026-05-29
- SOC 2 Type II + ISO 27001 + GDPR + CCPA. SAML 2.0 SSO with Okta/OneLogin/Google Workspace at Enterprise. SCIM provisioning + role-based access + audit logs at Enterprise. Canva does NOT sign BAAs for HIPAA-regulated uses.
- NotebookLM· Last verified 2026-05-29
- NotebookLM Enterprise: check Google's current BAA coverage before any PHI use. SOC 2 + VPC-SC + ISO 27001 + Cloud Audit Logs. Per Google's Workspace privacy hub, NotebookLM uploads, queries and responses are not human-reviewed or used to train generative AI models, and prompts/responses are not retained after the session (uploaded sources stay in your notebooks). US/EU/Global multi-regions configurable. Workspace + Enterprise tiers inherit Google identity stack. Consumer NotebookLM (free/Plus/Pro/Ultra) sits OUTSIDE this boundary.
- Descript· Last verified 2026-05-29
- Descript does not publish detailed compliance documentation publicly. Enterprise tier exists with SSO + dedicated support + security review per Descript marketing, but specifics need direct vendor confirmation. Verify SOC 2 + retention + BAA terms before client-data work.
- Gamma· Last verified 2026-05-29
- SOC 2 Type II since Oct 2025. GDPR DPA. SSO at Business tier ($40/seat, 10-seat min). Training opt-out for business data. PHI explicitly prohibited per Gamma terms — NOT a HIPAA-compliant solution.
- HeyGen· Last verified 2026-05-29
- SOC 2 Type II + GDPR + CCPA + EU-US Data Privacy Framework + EU AI Act compliance. US-only data storage on AWS; DPF enables lawful EU-to-US transfer. NO published HIPAA, NO BAA available as of early 2026 — verify directly before any PHI-adjacent use.
- Synthesia· Last verified 2026-05-29
- SOC 2 Type II since 2022. ISO 27001 + ISO 42001 (first GenAI company to achieve 42001, Sept 2024). EU-only storage (Ireland primary, Frankfurt secondary backup). SAML SSO at Enterprise. 90-day deletion timeline on request.
- ElevenLabs· Last verified 2026-05-29
- SOC 2 Type II + ISO 27001 + PCI DSS Level 1. HIPAA via Enterprise BAA (vendor describes a Zero Retention Mode requirement — check ElevenLabs' current data-retention terms). US/EU/India data residency options. 2FA + end-to-end encryption.
- Zapier· Last verified 2026-05-29
- SOC 2 Type II + SOC 3. SAML SSO + SCIM at Enterprise (Okta/Azure AD/OneLogin). AES-256 encryption + multi-region redundancy. Zapier CANNOT sign BAAs — PHI handling is NOT supported. No EU-only data storage option.
- Reclaim.ai· Last verified 2026-05-29
- Reclaim does not publish detailed compliance documentation publicly. Request SOC 2 report + DPA + retention terms directly before granting full calendar read/write access — Reclaim sees all event titles + attendees + descriptions.
- n8n· Last verified 2026-05-29
- SOC 2 Type II. n8n Cloud is EU-hosted (Azure). Self-hosting enables your-choice region + SAML/OIDC SSO + SCIM + RBAC + VPC + IP allowlist + HIPAA (Cloud cannot sign BAA). AES-256 at rest + TLS in transit.
Color key
- Green — Strong posture; available on most or all tiers.
- Amber — Available but with conditions (specific tier, configuration, or geography).
- Blue — Available via a non-standard path (e.g. self-hosting required).
- Red — Not offered; the vendor explicitly does not support this requirement.
- Grey — Vendor doesn't publish this publicly; verify directly before relying.