Data annotation security and compliance
Before your files leave the building, check three things: the outside audits a vendor has passed, the laws it says it follows, and whether the work can happen on your own systems. The tables cover all 15 companies and 12 platforms we compare, each linked to the page the claim comes from.
- Name SOC 2
- 10 of 15annotation companies
- Name ISO 27001
- 11 of 15annotation companies
- Name HIPAA
- 6 of 15annotation companies
Security audits by annotation company
"Not named" means the company's own pages do not mention it; it may still hold it, so ask. SOC 2 Type II is the stronger form of SOC 2.
| Company | SOC 2 | ISO 27001 | HIPAA | GDPR | Other | Source |
|---|---|---|---|---|---|---|
 Scale AI | Type II | Not named | Not named | Not named | None | scale.com |
 Appen | Type II | Yes | Yes | Yes | None | appen.com |
 TELUS Digital | Yes, type not stated | Yes | Not named | Not named | TISAX | telusdigital.com |
 iMerit | Type II | Yes | Yes | Yes | ISO 9001, TISAX | imerit.ai · imerit.ai |
 Sama | Not named | Yes | Not named | Yes | ISO 9001, TISAX | sama.com |
 CloudFactory | Yes, type not stated | Yes | Yes | Yes | ISO 9001 | cloudfactory.com · cloudfactory.com |
 Label Your Data | Not named | Yes | Not named | Yes | None | labelyourdata.com |
 Shaip | Type II | Yes | Yes | Not named | ISO 9001 | shaip.com · shaip.com |
 Cogito Tech | Type II | Yes | Yes | Yes | ISO 9001, CCPA | cogitotech.com |
 Mindy Support | Yes, type not stated | Not named | Not named | Yes | None | mindy-support.com · mindy-support.com |
 Toloka | Yes, type not stated | Yes | Not named | Not named | ISO 27701 (personal data) | toloka.ai · toloka.ai |
 Surge AI | Not named | Not named | Not named | Yes | None | the surgehq.ai |
 Innodata | Not named | Yes | Not named | Not named | ISO 9001 | innodata.com |
 Keymakr | Not named | Yes | Yes | Yes | ISO 9001 | keymakr.com |
 Anolytics | Type I | Not named | Not named | Not named | None | anolytics.ai |
Security by labeling platform
For software you run your own team on, where it runs matters as much as its audits: a platform on your own servers keeps the files inside your walls.
| Platform | Runs on | SOC 2 | ISO 27001 | HIPAA | GDPR | Other | Source |
|---|---|---|---|---|---|---|---|
 Labelbox | Cloud | Type II | Not named | Not named | Not named | NIST 800-171 | labelbox.com |
 Encord | Cloud, VPC or on-premises (Enterprise) | Yes, type not stated | Not named | Yes | Yes | None | encord.com · encord.com |
 V7 Darwin | Cloud or your private cloud | Type II | Not named | Yes | Not named | None | v7labs.com |
 SuperAnnotate | Cloud | Type II | Yes | Not named | Not named | None | superannotate.com |
 Kili Technology | Cloud or on-premises (Enterprise) | Type II | Yes | Yes | Not named | None | kili-technology.com · kili-technology.com |
 Label Studio | Self-host or cloud | Yes, type not stated | Not named | Yes | Not named | None | github.com · humansignal.com |
 CVAT | Self-host, cloud or air-gapped | Not named | Not named | Not named | Yes | CCPA | cvat.ai |
 SageMaker Ground Truth | AWS cloud only; your data stays in your own Amazon S3 buckets | Not named | Not named | Not named | Yes | None | aws.amazon.com · docs.aws.amazon.com |
 Roboflow | Cloud; models can also run on your own devices; on-premises install for Enterprise | Yes, type not stated | Not named | Yes | Not named | None | roboflow.com · security.roboflow.com |
 Dataloop | Cloud; can connect to storage on your own servers, including air-gapped setups | Type II | Yes | Not named | Yes | None | dataloop.ai · docs.dataloop.ai |
 Segments.ai | Cloud; can read data from your own AWS S3 bucket | Not named | Yes | Not named | Yes | None | docs.segments.ai · docs.segments.ai |
 Supervisely | Cloud, or self-hosted on your own servers with Enterprise Edition | Not named | Not named | Yes | Yes | None | supervisely.com |
The audits and laws, in plain words
- SOC 2 a check by an outside auditor of how a company protects its clients' files. Type I looks at one day; Type II watches several months, so it is the stronger check.
- ISO 27001 a worldwide data-safety standard; an independent auditor confirms the company follows it.
- ISO 27701 adds checks on personal details, such as names and addresses, on top of ISO 27001.
- ISO 9001 checks the steps a company uses to keep its work consistent. It is a quality standard rather than a security audit, so the tables do not count it as an audit.
- HIPAA a US law that protects patients' medical records.
- TISAX a security check that car manufacturers ask their suppliers to pass.
- GDPR the EU's data protection law.
- CCPA a California law on consumer privacy.
An audit means an outside firm checked the company. A law is a rule the company says it follows, and nobody checks that claim for you.
Keeping files on your own systems: on-premises, private cloud and VPN
If files must not leave your systems, run the labeling software yourself. These platforms state a self-hosted, on-premises or private-cloud option: Encord (cloud, vpc or on-premises (enterprise)), V7 Darwin (cloud or your private cloud), Kili Technology (cloud or on-premises (enterprise)), Label Studio (self-host or cloud), CVAT (self-host, cloud or air-gapped), Roboflow (cloud; models can also run on your own devices; on-premises install for enterprise), Dataloop (cloud; can connect to storage on your own servers, including air-gapped setups), Supervisely (cloud, or self-hosted on your own servers with enterprise edition).
If you want people to do the work, ask whether their labelers can work inside your systems over a VPN or a virtual desktop, so files never sit on their own machines. Some companies describe secure offices for private data: Appen, iMerit, Cogito Tech.
Papers to ask for before you send files
- The SOC 2 Type II report itself, usually shared under a non-disclosure agreement; check the period it covers and the services in scope.
- The ISO 27001 certificate, with its scope, the certifying body and the expiry date.
- A business associate agreement (BAA) before any patient data moves, if HIPAA applies to you.
- A data processing agreement for personal data of people in the EU: GDPR requires a contract with any processor (GDPR Article 28).
- Where the labelers sit and which other companies (subcontractors) touch the files.
- How files are deleted at the end of the job, and the proof you get.
To test quality as well as security in one pilot, follow the QA workflow. For medical files, start with medical data annotation.
More buyer guides
- Annotation quality metrics: Accuracy against a gold set, IoU for boxes and masks, and agreement between labelers, with worked examples.
- Data annotation QA workflow: From the label guide to an accepted batch, and what to test in a vendor pilot.
- Data labeling outsourcing: Costs, pilots and contracts when another company labels your data.
Want companies to quote against these rules? Describe the job once, and up to three annotation companies reply with prices.
Get quotes from three companies