Trunk Tools shows mixed risk signals with strong security practices (SOC 2 Type II) but concerning data rights terms. While they don't access source code directly, they collect extensive test data and grant themselves broad perpetual licenses to user content. The privacy policy is consumer-focused and lacks enterprise-specific protections, though they do provide clear data retention periods and deletion rights.

AI Transparency Facts

Input Data Ownership

Moderate Risk

Users retain ownership of their content, but Trunk claims extremely broad, perpetual license rights that survive account termination. The license grant is concerning for enterprise use as it includes sublicensing rights.

Confidence

90%

Output Data Ownership

Moderate Risk

The documents don't explicitly address AI-generated outputs or test analysis results ownership. The broad content license could potentially apply to any outputs derived from user data.

Confidence

40%

Training Data Usage

Moderate Risk

No explicit statements about using customer data for model training or improvement. However, the perpetual license grant is broad enough to potentially allow such use without additional consent.

Confidence

30%

Data Retention & Deletion

Low Risk

Clear data retention policies with 45-day retention for test results and user deletion rights. They commit to deleting data when no longer needed and provide mechanisms for users to request deletion.

Confidence

85%

Third-Party Data Sharing

Moderate Risk

Limited third-party sharing primarily for service delivery and legal compliance. They use digital marketing providers and may share data during business transfers. No indication of selling data to unrelated parties.

Confidence

80%

Opt-Out Rights

Low Risk

Multiple opt-out mechanisms provided including email unsubscribe, cookie controls, and CCPA rights for California residents. Users can request data deletion and opt out of marketing communications.

Confidence

85%

Compliance & Certifications

Low Risk

SOC 2 Type II certified with annual audits. Claims compliance with GDPR, CCPA, and other privacy frameworks. Uses AWS infrastructure with strong security controls.

Confidence

90%

Model Explainability & Auditability

Moderate Risk

Limited information about AI model transparency or auditability. They provide test analytics and flakiness detection but don't discuss how these analyses work or allow auditing of algorithmic decisions.

Confidence

25%

Security Practices & Breach History

Low Risk

Strong security practices including encryption at rest/transit, MFA, vulnerability scanning, penetration testing, and continuous monitoring. No breach history mentioned. SOC 2 audit confirmed no significant incidents.

Confidence

95%

Enterprise vs. Consumer Risk Delta

Moderate Risk

No clear distinction between enterprise and consumer terms. The privacy policy appears consumer-focused while the service is clearly enterprise-oriented. No mention of enterprise agreements or enhanced protections for business users.

Confidence

70%

Human Review of User Inputs

Moderate Risk

They reserve broad rights to monitor and investigate content for policy violations and legal compliance. Access is claimed to be limited to authorized personnel with business need, but specific restrictions on viewing customer data aren't detailed.

Confidence

75%

Regulatory & Litigation Exposure

Low Risk

Standard legal compliance disclosures with no indication of current litigation or regulatory issues. They will cooperate with law enforcement as required but don't indicate any ongoing matters.

Confidence

80%

PII & SPI Data Inventory

Low Risk

They collect minimal PII (email, IP addresses, identifiers) primarily for account management and service delivery. No indication of collecting SPI like financial data beyond payment processing, health information, or biometric data.

Confidence

85%

You've read all 15 risk ratings for Trunk Tools. Create a free account to see the exact policy wording behind each rating.