Compliance

Customers across the world trust Lightning AI with their most sensitive data because we have put controls in place to meet the unique needs of the most highly regulated industries such as financial services, biotech, healthcare, and businesses where data is their differentiation.

Due diligence package

For self-service security reviews, you can request our due diligence package. It includes common compliance documents such as our ISO certifications and our annual pen test confirmation letter. You can also reach out to your Lightning AI account team for copies of our Enterprise Security Guide, HIPAA and SOC 2 Type II report.

Email [email protected] to request a due diligence package.

Data retention policy

Customer data is retained according to the data retention policy.

Read the data retention policy

Data Processing Addendum (DPA)

In specific domains or legal jurisdictions, additional compliance controls are necessary. Lightning AI can execute a Data Processing Addendum (DPA). A DPA formalizes safeguards for sensitive data and establishes a legal framework to ensure all parties are held accountable for complying with data privacy standards.

Read the in-depth guide for the DPA

Subprocessors

Lightning AI uses third-party services to process personal data on their behalf and under their instructions.

Read the in-depth guide for the subprocessors

Privacy Policy

Lightning AI collects and uses personal data according to the privacy policy.

Read the privacy policy

Health Insurance Portability and Accountability Act (HIPAA)

Lightning AI is HIPAA certified. Request our report by contacting [email protected].

Read the in-depth guide for HIPAA

System and Organization Controls (SOC2)

Lightning AI is SOC2 certified. Email [email protected] to request our SOC 2 Type II report for self-serve diligence.

Read the in-depth guide for SOC2

California Privacy Rights Act

Lightning AI is compliant with the 2020 ruling on Prop 24. This means our customers can:

1. Restrict sharing of personal information
2. Correct inaccuracies
3. Limit the use of sensitive data such as geolocation, race, religion, genetics, communications, sexual orientation, and health details