AI Tool Safety Ratings

Verdicts and the data-handling fields already on each tool page, from the vendor's published pages. Unknown means that page did not answer.

Side-by-side data handling
Field	AssemblyAIAssemblyAI	CartesiaCartesia	DeepgramDeepgram	ElevenLabsElevenLabs
Verdict	Careful	Careful	Careful	Careful
Trains on your data by default	Yes	Yes	Yes	Yes
Training detail	The terms say AssemblyAI may use customer data to develop its products and to train its artificial intelligence and machine learning models. The opt-out is described as applying to the extent of the customer's pricing plan. Customers are also forbidden from using AssemblyAI output to train their own speech models.	Cartesia says it uses content to generate output and to train and enhance the models that power the services. Voice or audio recordings are listed as content. You can ask that selected categories of content not be used for future training by submitting Cartesia's online form.	The notice says Deepgram uses Content to develop products, including AI model training, unless you opt out. It also says Deepgram may use Content to train and improve its models. When a customer submits other people's audio, Deepgram says it is the processor and this controller notice does not apply.	The privacy policy says you can opt out of use of your personal information for training in the Data use menu, and that this only affects training use after you opt out. The terms also say you may opt out of use of your content for training. They also say ElevenLabs obtains publicly available or licensed information to train models. That is separate from customer audio.
How to opt out	AssemblyAI points customers to its documentation on opting out of the model improvement program, and says availability depends on the pricing plan. We did not treat that help page as a fact about which plans are included, because this review used the terms for the rule itself.	Submit the opt-out form linked from the privacy policy. Cartesia says that after the request is processed, the selected categories are not used to train models in the future. Uses before that date remain.	For the APIs, set the training opt-out parameter on the request. That request is then excluded. For Saga, use the opt-out in settings. After that, new Content is not used to train models. Content from before the opt-out is not described as removed from training.	In the ElevenLabs account, open Terms and Privacy, then Data use, and opt out of training. The privacy policy says the opt-out does not undo training use from before that change.
Data retention	Unknown for audio. The privacy policy says personal data is kept as long as needed to provide the services or for the purposes it was collected. It does not state a number of days for recordings.	Unknown. The privacy policy we read does not state a retention period for voice recordings, voice models, or generated audio.	Deepgram says it keeps personal information for as long as needed for the purposes it was collected, unless a law says otherwise. It does not give a number of days for audio.	Unknown for voice recordings and voice models. The privacy policy describes access, correction, and deletion rights. It does not state a number of days for audio or voice models.
BAA / HIPAA	Yes	Unknown	Unknown	Unknown
BAA detail	AssemblyAI publishes a business associate agreement and says paid customers can sign it from the Data Controls page in the dashboard. Signing is not automatic.	The privacy policy does not offer a business associate agreement.	The privacy notice we read does not offer a business associate agreement.	The pages we read do not offer a business associate agreement. The data processing addendum covers personal data in content that business clients provide. It does not say that content is excluded from training.
Certifications	Unknown	Unknown	Unknown	Unknown
Enterprise and admin controls	The customer is responsible for the legality of uploaded audio. A data processing addendum is incorporated into the terms. The training opt-out is plan-dependent rather than described as off for every organization.	Unknown. The policy describes Cartesia as the controller of information covered by that page. It does not describe an admin control that turns training off for an organization.	Customers who send end-user audio are treated as the controller, and Deepgram says individual questions should go to that customer. The notice does not describe an organization-wide training lock beyond the per-request API opt-out and the Saga setting.	Business clients have a data processing addendum. The addendum we read does not describe an admin switch that turns training off for the whole organization. Voice cloning can require a recording to confirm the voice belongs to you. A ban on cloning someone else was not stated in the privacy policy or terms we read.
Last checked	10 Nov 2026	10 Nov 2026	10 Nov 2026	10 Nov 2026

Compare Voice AI