Question 1

Is Ultralytics SOC 2 compliant?

Accepted Answer

Ultralytics is SOC 2 compliant. On SOC2C this listing is Listed.

Question 2

Is Ultralytics ISO 27001 certified?

Accepted Answer

According to Ultralytics's public trust center, Ultralytics is ISO 27001 certified. On SOC2C this listing is Listed.

Question 3

Can I use Ultralytics's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. Ultralytics's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 4

Is Ultralytics penetration tested?

Accepted Answer

Ultralytics hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Question 5

Is Ultralytics secure?

Accepted Answer

Security isn't a single yes/no, but Ultralytics is SOC 2 compliant. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 6

Does Ultralytics have a bug bounty or vulnerability disclosure program?

Accepted Answer

Ultralytics hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@ultralytics.com or via a /security page (Ultralytics lists a security contact).

Question 7

Who are Ultralytics's subprocessors?

Accepted Answer

Ultralytics lists 3 subprocessors on its trust center, including Google, MongoDB Atlas, Mailersend. Buyers use this for fourth-party risk review.

Question 8

Where does Ultralytics host or store data?

Accepted Answer

Ultralytics hosts on GCP, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Question 9

Where is Ultralytics's trust center or security page?

Accepted Answer

Ultralytics's trust center is at https://trust.ultralytics.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 10

What measures does Ultralytics take to ensure compliance with evolving regulations?

Accepted Answer

Ultralytics actively monitors changes in global data protection and AI regulations, updating our policies and practices to ensure compliance. We work closely with legal and technical experts to maintain adherence to standards such as GDPR, CCPA, EU AI Act or other applicable AI-specific guidelines.

Question 11

Is Ultralytics HIPAA compliant?

Accepted Answer

Ultralytics does not currently provide compliance certifications or documentation specific to the medical or healthcare sector (e.g., HIPAA). For the Ultralytics Platform (SaaS), we implement robust security and data protection practices aligned with industry standards, including strong access controls, encryption, and monitoring. While these controls support secure handling of data, customers are responsible for ensuring that their specific use of the platform meets applicable regulatory requirements, such as HIPAA. For Ultralytics YOLO models (open source), Ultralytics operates as a model provider rather than a hosted clinical system. These models are deployed and run entirely within customer-controlled environments, meaning customers retain full responsibility for how data is processed, secured, and governed. This is typically where sector-specific compliance (e.g., HIPAA or medical device regulations) is implemented. Across both offerings, Ultralytics focuses on ensuring the security, integrity, and reliability of its technology, enabling customers to build compliant solutions within their own environments where required.

Question 12

What security and compliance standards do you follow?

Accepted Answer

Ultralytics aligns its security program with industry-recognized frameworks, including SOC 2 and ISO 27001. Our security program includes: - Formal security policies and procedures - Role-based access controls and least-privilege access - Encryption of data in transit and at rest - Continuous monitoring, logging, and vulnerability management - Incident response and business continuity processes In addition, we conduct independent third-party security testing, including penetration tests, to continuously assess and improve the security of the Ultralytics Platform.

Question 13

What support does Ultralytics offer for enterprise customers?

Accepted Answer

Ultralytics provides enterprise customers with dedicated support, including priority issue resolution, custom integrations, and tailored training programs to maximize the value of our AI solutions in their specific use cases.

Question 14

How does Ultralytics ensure AI model fairness and mitigate bias?

Accepted Answer

Ultralytics approaches fairness and bias mitigation as part of both model development and responsible deployment. During development, we evaluate model performance across different scenarios to identify limitations and potential sources of bias. This includes testing model outputs, monitoring performance, and iterating on model design to improve robustness and reliability. Because Ultralytics YOLO models are open-source and highly customizable, model behavior ultimately depends on how they are trained, fine-tuned, and deployed. As such, customers are responsible for validating model performance within their specific datasets and use cases, and for conducting any required risk assessments, particularly in regulated or high-risk environments. Ultralytics focuses on providing transparent, well-documented, and flexible models, enabling users to understand model behavior and apply appropriate safeguards in their own applications.

Question 15

Do you use customer data to train models?

Accepted Answer

No. Customer data uploaded to the Ultralytics Platform is used to provide platform functionality (e.g., dataset management, training, evaluation) and is not used to train shared or public models.

Question 16

How does Ultralytics ensure the privacy and security of user data?

Accepted Answer

We protect customer data using: - Encryption in transit (TLS 1.2+) and at rest - Role-based access controls (RBAC) and least-privilege access - Continuous monitoring, logging, and vulnerability scanning - Regular penetration testing and security assessments

Question 17

Where is customer data stored and processed?

Accepted Answer

Customer data is stored in secure, managed cloud infrastructure using providers such as Google Cloud Platform and MongoDB Atlas, with multi-region replication, encrypted backups, and high availability. Object storage, including datasets and model artefacts, is hosted in the EU data centers.

Question 18

How is customer data isolated from other users?

Accepted Answer

The platform operates as a multi-tenant SaaS with project-level and user-level isolation, ensuring that customer data is logically segregated and not accessible across accounts.

Question 19

What is Ultralytics' approach to incident response and downtime communication?

Accepted Answer

Ultralytics maintains a formal incident response process supported by continuous monitoring of the Ultralytics Platform. In the event of a service disruption or security incident, we provide transparent and timely updates via our public status page (https://status.ultralytics.com), where users can subscribe to receive real-time notifications.

Question 20

Are datasets used with Ultralytics YOLO models shared with Ultralytics?

Accepted Answer

No. Datasets used with Ultralytics YOLO models remain entirely within your own environment. Ultralytics does not collect, process, or transmit any training or inference data when Ultralytics YOLO models are used outside of the Ultralytics Platform.

Question 21

What data does Ultralytics collect from users of its open-source projects?

Accepted Answer

Ultralytics collects only non-PII (Personally Identifiable Information) anonymous information from open-source users for performance monitoring through Sentry and usage analytics via Google Analytics. We ensure that this data remains anonymized and is used solely to improve our tools. For hosted services, we follow strict data privacy practices, clearly outlined in our privacy policy, and maintain transparency on all data usage.

Ultralytics

About

Compliance & infrastructure

Documents

Subprocessors

Compliance leadership

Penetration test

Recent updates

This listing is partial

Frequently asked

Technology peers that completed SOC 2

Action1

ELJUN LLC

equipifi

IntelligentSystems Corp