Data privacy
What happens to the prompts, files and personal data you put in.
SafeScore: the AI risk management score for every AI tool
Before you paste client data into an AI tool, you should know how it handles that data and its risks. SafeScore turns each tool’s privacy policy, security certifications and AI policies into one number from 0 to 100, with the evidence for every point.
- 20 fixed checks
- 5 risk pillars
- 51 tools rated
100/100
SynthesiaStrong
SynthesiaStrongWhat the score means
0–49Limited
Little public evidence of risk controls. Review carefully before sharing sensitive data.
50–64Fair
Some important controls are missing or not documented.
65–79Good
Solid basics; a few controls are missing or unclear.
80–100Strong
Most risk controls are documented in public.
Tools with too little public information to judge fairly show no shield (“not rated”) instead of a low score.
What we look at
Every tool is reviewed against the same internal checklist, built on the AI risk frameworks companies already use, so two tools with the same public evidence get the same score.
Security & compliance
Independent security audits, encryption and enterprise controls.
Transparency
Who is behind the tool, which AI models it uses, and what its limits are.
AI governance
Published AI policies, risk frameworks, human oversight and incident reporting.
User safeguards
Protection against harmful content, misuse, deepfakes and copyright problems.
Where the evidence comes from
- We read the tool’s own public pagesHomepage, privacy policy, terms of service, security or trust center and AI or acceptable use policy.
- Each area is reviewed against our checklistEvery answer keeps the sentence it was based on and a link to the page. Missing evidence is never guessed.
- The score follows fixed rulesIt isn’t an opinion: the same evidence always gives the same score.
- People check itOur editors correct answers when a page was misread, and makers can send evidence such as a SOC 2 report or an ISO/IEC 42001 certificate. Payment never changes a score.
AI tools with the highest SafeScore
- 1
SynthesiaAvatars
100
- 2
IntercomSupport
100 - 3
ChatGPTChatbots
98 - 4
ClaudeChatbots
98 - 5
GeminiChatbots
98 - 6
Microsoft CopilotChatbots
98 - 7
CanvaDesign
98 - 8
ZendeskSupport
97 - 9
OneTrustAI governance
97 - 10
Adobe FireflyImages
95 - 11
NotebookLMResearch
95 - 12
Adobe PhotoshopPhoto editing
95 - 13
HarveyLegal
95 - 14
HubSpotMarketing
94 - 15
ZapierAgents
94 - 16
Le Chat by MistralChatbots
93 - 17
GrammarlyWriting
92 - 18
Notion AIProductivity
92 - 19
FigmaDesign
92 - 20
ElevenLabsVoice
91
AI safety risks to know before you use an AI tool
These are the dangers AI risk management frameworks focus on, what can go wrong, and what to look for.
Your data trains someone else’s model
Prompts, files and customer data you paste in can be kept and used to train future models, and may resurface in other people’s answers.
What to check: Look for a “we don’t train on your data” promise or an opt-out, and check it applies to your plan.
Data leaks and breaches
AI tools store conversations and uploads. A breach or a misconfigured share link can expose confidential client or company information.
What to check: Ask for SOC 2 or ISO/IEC 27001, encryption at rest and in transit, and SSO with access roles.
Hallucinations
Language models state wrong facts, made-up citations and invented numbers with full confidence.
What to check: Prefer tools that cite sources, explain their limits and let a person review output before it is used.
Bias and unfair outcomes
Models can treat people differently by gender, age, ethnicity or language — a serious problem in hiring, lending, insurance and healthcare.
What to check: Check for a responsible AI policy, bias testing and human review for decisions about people.
Prompt injection and AI security
Hidden instructions in web pages, emails or files can hijack AI agents to leak data or take actions you didn’t ask for.
What to check: Limit what agents can access, require approval before they act, and look for a security page and bug bounty.
Copyright and IP
Generated text, images, code and music can copy protected work, and ownership of the output may be unclear.
What to check: Read who owns the output, and look for IP indemnity on business plans.
Deepfakes and impersonation
Voice cloning and face-swap tools can be used to impersonate people for fraud or harassment.
What to check: Look for consent checks, watermarking or C2PA content credentials.
Over-reliance on automation
People stop checking AI output once it is usually right — until the one time it isn’t.
What to check: Keep a human in the loop for anything sent to customers, filed, published or paid.
Breaking AI and privacy laws
The EU AI Act, GDPR, CCPA and sector rules (HIPAA, financial regulators) put duties on the companies that use AI, not only on the makers.
What to check: Check for GDPR/CCPA rights, a DPA, and the vendor’s work towards EU AI Act and ISO/IEC 42001.
Unknown vendors and shadow AI
Staff sign up for unknown tools with company data. If the company behind a tool is unclear, so is who is responsible when something goes wrong.
What to check: Keep a list of approved tools, and check the company, terms and contact details before anyone uploads data.
How to run an AI risk assessment for your team
A practical seven-step process for small businesses and professional firms, in line with NIST AI RMF and ISO/IEC 42001.
- List the AI tools in useAsk each team which AI tools they use, including free ones and browser extensions. You can’t manage risks you don’t know about.
- Classify each use by riskNote what each tool is used for. Decisions about people (hiring, credit, health) are high risk under the EU AI Act; drafting a blog post is not.
- Map the data that goes inWrite down what data each tool sees: public, internal, confidential, personal or regulated (health, financial). This decides how strict you need to be.
- Check the vendorUse SafeScore as a first screen, then read the privacy policy, data training terms, security certifications and DPA for the plan you will actually buy.
- Set rules and controlsDecide what data may be shared, turn on training opt-outs and SSO, and require human review for high-impact output.
- Train peopleShow staff what not to paste in, how to spot hallucinations and how to report a problem.
- Monitor and reviewRe-check tools when their policies change, keep an incident log, and review the list every quarter. ISO/IEC 42001 and NIST AI RMF both expect this loop.
SafeScore questions
What is SafeScore?
SafeScore is a 0–100 AI risk rating for each AI tool on KurateAI. It covers data privacy, security and compliance, transparency, AI governance and user safeguards, based on what the tool publishes about how it handles your data and its risks.
Is SafeScore a certification or a security audit?
No. It is an independent summary of public evidence: privacy policies, terms, security and trust pages and AI policies. A high score means the tool documents its risk controls well. It does not replace your own vendor assessment, a SOC 2 report or legal advice.
How is the score calculated?
Our team reviews each tool’s public privacy policy, terms, security and AI policy pages against a fixed internal checklist built on recognised AI risk frameworks. The same evidence always gives the same score, and missing evidence is never guessed. Tools with too little public information are shown as not rated instead of getting a low score.
How often is SafeScore updated?
Scores are re-checked regularly and whenever a tool changes its policies. Each tool page shows the date of the last check and the evidence behind every answer.
Can a tool improve its SafeScore?
Yes. Makers can publish clearer privacy, security and AI governance information, or send us evidence such as a SOC 2 report, an ISO/IEC 42001 certificate or a data processing agreement. Payment never changes a score.
Does a high SafeScore mean a tool is safe for any use?
No tool is risk-free. Always check the plan you use (free plans often have weaker data terms), what data you share, and whether the use falls under rules such as the EU AI Act, GDPR or HIPAA.
SafeScore summarises public information and is not a certification, audit or legal advice. Always review the terms for the plan you use. Spotted a mistake? Tell us.