Jump to the comparison
Data Annotation Services

Data annotation security and compliance

With data annotation, people tag your photos, video, text or audio so that AI software can learn from this material. Check three things before those files go to another company. Was its security checked by an outside firm, for example through SOC 2 or ISO 27001? In the company's words, which privacy laws does it follow? Could the work happen on computers you own? This page compares 15 labeling companies and 12 labeling platforms, meaning programs for doing the labeling yourself; every one links to the page its claim comes from.

SOC 2 named
10 out of 15labeling firms
ISO 27001 named
11 out of 15labeling firms
HIPAA named
6 out of 15labeling firms

Audits and laws explained in plain language

  • SOC 2: an outside firm checks how well a company protects the files of its clients. Type I reviews a single day; Type II covers several months, making it the stronger check.
  • ISO 27001: a global set of rules about keeping data safe, with an outside firm checking that the company follows them.
  • ISO 27701: sits on top of ISO 27001 and adds checks on personal data, like names and addresses.
  • ISO 9001: examines whether a company follows set steps so its work is done the same way on every job. Because it's a quality standard, not a security audit, the tables do not treat it as one.
  • HIPAA: a US law guarding the medical records of patients.
  • TISAX: car companies ask that their suppliers pass this security check.
  • GDPR: the European Union's law that guards personal details about people.
  • CCPA: a California law protecting people's personal information.
  • NIST 800-171: rules from the US government for keeping sensitive files secure.

With a security check, an outside firm has examined the business. A law is a rule that the company says it follows. Because nobody checks the claim for you, ask for proof.

Chest CT scan on a radiology monitor with one region outlined

Annotation companies and their security audits

"Not mentioned" means the company does not state it on its own pages. The company may still have it, so ask them.

Each annotation company and the security audits and laws it names
CompanySOC 2ISO 27001HIPAAGDPROther checksSource
Scale AI logoScale AIType IINot mentionedNot mentionedNot mentionedNo other namedscale.com
Appen logoAppenType IIYesYesYesNo other namedappen.com
TELUS Digital logoTELUS Digital(the type isn't stated)YesNot mentionedNot mentionedTISAXtelusdigital.com
iMerit logoiMeritType IIYesYesYesISO 9001, TISAXimerit.ai · imerit.ai/compliance-and-certifications
Sama logoSamaNot mentionedYesNot mentionedYesISO 9001, TISAXsama.com
CloudFactory logoCloudFactory(the type isn't stated)YesYesYesISO 9001cloudfactory.com/certifications-and-compliance · cloudfactory.com/pricing
Label Your Data logoLabel Your DataNot mentionedYesNot mentionedYesNo other namedlabelyourdata.com
Shaip logoShaipType IIYesYesNot mentionedISO 9001shaip.com · shaip.com/security-and-compliance
Cogito Tech logoCogito TechType IIYesYesYesISO 9001, CCPAcogitotech.com
Mindy Support logoMindy Support(the type isn't stated)Not mentionedNot mentionedYesNo other namedmindy-support.com · mindy-support.com/data-engineering-services
Toloka logoToloka(the type isn't stated)YesNot mentionedNot mentionedISO 27701 (personal data)toloka.ai · toloka.ai/soc-2
Surge AI logoSurge AINot mentionedNot mentionedNot mentionedYesNo other namedsurgehq.ai
Innodata logoInnodataNot mentionedYesNot mentionedNot mentionedISO 9001innodata.com
Keymakr logoKeymakrNot mentionedYesYesYesISO 9001keymakr.com
Anolytics logoAnolyticsType INot mentionedNot mentionedNot mentionedNo other namedanolytics.ai

Labeling platforms and their security

When staff from your company will do the labeling, look at where the platform runs. Your files never leave you if the platform runs on your own computers. "Online" means you reach it through the internet, while the platform company's computers run it. Online space that only your company controls is a private cloud. The highest plan costs the most; it is often called Enterprise.

The hosting, audits and laws each labeling platform names
PlatformWhere it runsSOC 2ISO 27001HIPAAGDPROther checksSource
Labelbox logoLabelboxOnlineType IINot mentionedNot mentionedNot mentionedNIST 800-171labelbox.com
Encord logoEncordA private cloud, online, or your own computers as the top-plan option(the type isn't stated)Not mentionedYesYesNo other namedencord.com · encord.com/pricing
V7 Darwin logoV7 DarwinOnline, or your own private cloudType IINot mentionedYesNot mentionedNo other namedv7labs.com
SuperAnnotate logoSuperAnnotateOnlineType IIYesNot mentionedNot mentionedNo other namedsuperannotate.com
Kili Technology logoKili TechnologyOnline, or your own computers (top plan)Type IIYesYesNot mentionedNo other namedkili-technology.com · kili-technology.com/pricing
Label Studio logoLabel StudioYour own computers, or online(the type isn't stated)Not mentionedYesNot mentionedNo other namedgithub.com · humansignal.com
CVAT logoCVATOnline, or on your own computers, even ones with no internet connectionNot mentionedNot mentionedNot mentionedYesCCPAcvat.ai
SageMaker Ground Truth logoSageMaker Ground TruthYour files remain in your own Amazon account; service is only online at AmazonNot mentionedNot mentionedNot mentionedYesNo other namedaws.amazon.com · docs.aws.amazon.com
Roboflow logoRoboflowOnline; your own computers on the top plan(the type isn't stated)Not mentionedYesNot mentionedNo other namedroboflow.com · security.roboflow.com
Dataloop logoDataloopRuns online, though it can work with files kept on your own computers, even those with no internet connectionType IIYesNot mentionedYesNo other nameddataloop.ai · docs.dataloop.ai
Segments.ai logoSegments.aiReading files from your own Amazon account is possible; it runs onlineNot mentionedYesNot mentionedYesNo other nameddocs.segments.ai/security.md · docs.segments.ai/cloud-integration.md
Supervisely logoSuperviselyYour own computers under the top plan, or onlineNot mentionedNot mentionedYesYesNo other namedsupervisely.com

Keeping files on systems you own: VPN, private cloud and on-premises

Where files must stay on your own computers, operate the labeling platform there yourself; people often use the name on-premises for that setup. According to these platforms, you can run them on computers you own or inside a private cloud, meaning online space controlled by you alone: Roboflow, Encord, Dataloop, V7 Darwin, Supervisely, Label Studio, CVAT, Kili Technology.

When you want a company's staff to do the work, ask whether they can reach your computers over a safe connection (a VPN, which is a private, locked link across the internet) and do the work there. This keeps your files with you; they are never copied to the company's machines. Appen, iMerit and Cogito Tech describe secure offices for private data.

Wide monitor showing labeling software with boxes around warehouse pallets

Before you send files: papers to ask for

  • Get the SOC 2 Type II report in full. In most cases, a company sends it once you have agreed to keep it private. See which months it covers, and which services of theirs were checked.
  • Ask for the certificate for ISO 27001. Look at the work it covers, which firm issued it and when it runs out.
  • Before any patient records move, a contract covering them, called a business associate agreement. HIPAA, the US medical privacy law, requires that protection, and the company commits to it under this contract.
  • When your files hold personal details of people in Europe: a contract about those details, called a data processing agreement. It sets out what the company may do with them; the European privacy law requires one under the GDPR rule.
  • Ask where the people doing the labeling are based, and whether any of the work is passed to other companies.
  • Ask how your files are deleted once the job ends, and what proof you receive.

Another option is a small trial job first, to see whether the labels are right: follow the steps to check labels. For medical files, begin with medical data annotation.

Want companies to quote against these rules? Describe the job once, and up to three annotation companies reply with prices.

Get quotes from three companies