AI detectors by compliance claims: SOC Type 2, FERPA, GDPR, HIPAA and ISO 27001
An AI detector vendor names a security or privacy standard for 12 of the 72 cards in the index, by the compliance field compiled on 9 November 2026 and extended on 10 November 2026 (Paperpal, then Trinka): SOC Type 2 on 8 cards, GDPR on 10, ISO 27001 on 7, HIPAA on 5, PCI on 3, FERPA on 3 (GPTZero, Paperpal, Trinka), CCPA on 1 (GPTZero), and FedRAMP on none. Every entry is a vendor statement read on the vendor's own page, and the index has inspected no certificate, audit report or attestation letter; the table says where each claim was read and when, and a reader who needs the document should request it from the vendor. Five of the ten were read on trust or security pages fetched live on 9 November 2026 at the card's official domain (grammarly.com/compliance, sapling.ai/security, writer.com/trust, trust.truthscan.com, sightengine.com/security), and five on pages already cited on the card (GPTZero's and ZeroGPT's privacy policies, Compilatio's support centre, Resemble's pricing page). Forty cards name no standard on any page read, including Turnitin, whose trust centre at turnitin.com/trust-center was read on 9 November 2026 and names none. This page is one of the views under AI detectors by feature; the government view reads these claims beside deployment and data region, the data retention ranking sorts the periods, and the full index shows all 72 cards.
- Field 1Standards named
- Field 2Claim as stated
- Field 3Page read
- Field 4Read date
One field, compliance, a list of named standards with the sentence each was read in, the page and the read date, and two routes into it. The first is a vendor trust, security, trust-center or compliance page at the card's official domain, fetched live on 9 November 2026; pages that returned 403 (Copyleaks, Scribbr, QuillBot, Phrasly), a script shell with no readable text (Hive, Deploy) or a redirect to the home page (ZeroGPT) count as not read, and the card's field stays empty on that route. The second is a page already cited on the card, where the standard is named in a sentence the card quotes. A named standard is SOC Type 2, ISO 27001 (or 27701, 42001), FERPA, GDPR, HIPAA, CCPA, PCI or FedRAMP, with the type or year where the vendor gives one; "a range of US, UK and EU certifications" (Reality Defender), "Military Grade Security and Compliance" (Codeleaks), "audited hosting" (Codequiry) and "enterprise-grade security" (Surfer) name no standard and do not qualify. The AICPA standard is written here as SOC Type 2 or SOC Type II; the vendors' pages print it in its shorter form. Field rules are in the methodology.
Which field decides whether a detector claims a standard?
| Detector | Standards named | Claim as stated | Page read | Read date |
|---|---|---|---|---|
 Writer | SOC Type II; ISO/IEC 27001, 27701, 42001; HIPAA; PCI | annual SOC Type II evaluations and ISO/IEC 27001, 27701 and 42001 certifications, in the vendor's words "confirming our implemented controls for security, privacy, and responsible AI management"; "certifications for HIPAA Type 1 and PCI compliance"; detector withdrawn 22 December 2025 | writer.com/trust | 9 November 2026 |
 Grammarly | SOC Type 2; ISO/IEC 27001:2022; GDPR; HIPAA | a SOC Type 2 report that "validates our controls"; "meets the requirements of ISO 27001 and 27002"; "Yes, Grammarly is GDPR-compliant"; "Yes, Grammarly is HIPAA compliant" | grammarly.com/compliance | 9 November 2026 |
 Grammarly Authorship | SOC Type 2; ISO/IEC 27001:2022; GDPR; HIPAA | Same page as Grammarly's AI Detector; the statements cover the Grammarly service, not Authorship by name | grammarly.com/compliance | 9 November 2026 |
 Sapling | SOC Type II; GDPR; HIPAA and PCI support | "GDPR compliant" and SOC Type II certified; "supports customers with HIPAA and PCI compliance requirements" | sapling.ai/security | 9 November 2026 |
 TruthScan | SOC Type 2; GDPR; ISO 27001:2022 | trust portal headings reading SOC Type 2 compliant, "GDPR Compliant" and "ISO 27001 v2022 Compliant" | trust.truthscan.com | 9 November 2026 |
 Sightengine | GDPR (DPA); ISO 27001, SOC Type 2 and PCI DSS for data-centre partners | data-centre partners the page describes as ISO 27001, SOC Type 2 and PCI DSS compliant; "GDPR-ready: Restrict end-user data processing to a specific region of your choice (Enterprise plans only)" | sightengine.com/security | 9 November 2026 |
 GPTZero | FERPA; GDPR; CCPA | "Compliant with FERPA, GDPR, and CCPA; personal data is deleted on request" | gptzero.me/privacy-policy.html | 8 November 2026 |
 Resemble Detect | SOC Type 2 (documentation on Enterprise) | Enterprise plan: "SOC type 2 documentation" | resemble.ai/pricing | 9 November 2026 |
 ZeroGPT | GDPR | "Infrastructure hosted in Germany under GDPR" | zerogpt.com/privacy-policy | 8 November 2026 |
 Compilatio | GDPR | GDPR page: "Submitted documents are not used for commercial purposes or reused outside the terms of the agreement with your institution" | support.compilatio.net | 9 November 2026 |
 Paperpal | ISO 27001:2022; ISO 42001:2023; GDPR; FERPA | "Paperpal's Information Security Management System (ISMS) is certified to the ISO/IEC 27001:2022 international standard"; "Paperpal's Artificial Intelligence Management System (AIMS) is certified to the ISO/IEC 42001:2023 international standard"; "operates in accordance with the EU General Data Protection Regulation (GDPR)"; "aligns with the Family Educational Rights and Privacy Act (FERPA)"; also CSA STAR Level 1 listed and facilities described as SSAE 18 certified | paperpal.com/data-security | 10 November 2026 |
 Trinka | SOC Type 2; ISO 27001:2022; HIPAA; FERPA; GDPR | "Trinka is SOC [Type] 2 certified, independently verifying that we meet the trust services criteria for security, privacy, availability, and confidentiality"; "Trinka's information security management system is ISO 27001 certified"; "Trinka is HIPAA compliant"; "Trinka is FERPA compliant, protecting student educational records"; "Trinka is GDPR compliant" | trinka.ai/trust-center, fetched live at the card's official domain | 10 November 2026 |
Claims as each vendor states them, read 8 and 9 November 2026, ordered by the number of standards named; the Writer row records a company's statements for a detector that was withdrawn on 22 December 2025, and the Grammarly Authorship row repeats the Grammarly page because both cards sit on the same service. The live fetch covered the /trust, /security, /trust-center and /compliance paths at every card's official domain and found readable pages at six vendors' domains: five named a standard (Grammarly, Sapling, Writer, TruthScan through the trust subdomain its /trust path redirects to, and Sightengine) and Turnitin's did not; BrandWell's /security path redirected to a blog post about security questionnaires and is not counted. Pages the index could not read are not evidence of absence: Copyleaks' security page exists and returned 403 to the fetch, and a reader with a browser may find standards there that this table cannot carry.
Why each card is in this view
- AIDI-D-0023Writer
the longest list in the index, SOC Type II, three ISO/IEC standards, HIPAA and PCI, on a live trust page (writer.com/trust, read 9 November 2026); the AI content detector the card describes was sunset on 22 December 2025 with its API endpoint, so the statements describe the company's platform and not a detector a reader can buy.
- AIDI-D-0008Grammarly
SOC Type 2, ISO/IEC 27001:2022, GDPR and HIPAA on the compliance page, with a HIPAA note that users "should not store, transmit, or otherwise process" protected health information through the services without a BAA (grammarly.com/compliance, read 9 November 2026); no study record for the detector, a RAID leaderboard entry of 9 February 2026.
- AIDI-D-0026Grammarly Authorship
the same four standards from the same page, read 9 November 2026; the Authorship product stores report data for up to 10 years, the longest period on the data retention ranking, and the compliance page does not name Authorship.
- AIDI-D-0010Sapling
SOC Type II and GDPR stated as the company's own, HIPAA and PCI as customer support, with annual penetration testing (sapling.ai/security, read 9 November 2026); 0 of 42 human papers in Walters 2023 with 31% uncertain, and a self-hosted Enterprise plan on the government view.
- AIDI-D-0034TruthScan
SOC Type 2, GDPR and ISO 27001:2022 as headings on a trust portal that also lists controls and subprocessors (trust.truthscan.com, read 9 November 2026); no study record, 30-day default retention with Zero Data Retention on Business and above.
- AIDI-D-0036Sightengine
GDPR with a Data Processing Addendum, and ISO 27001, SOC Type 2 and PCI DSS stated for its data-centre partners rather than for Sightengine itself, a distinction the table keeps (sightengine.com/security, read 9 November 2026); 1 image record, RAID image 2025.
- AIDI-D-0001GPTZero
FERPA, GDPR and CCPA in the privacy policy of 20 May 2026, the one FERPA statement in the index (gptzero.me/privacy-policy.html, read 8 November 2026); 16 study records, the most in the index. No live trust page at gptzero.me/trust or /security (404 on 9 November 2026).
- AIDI-D-0042Resemble Detect
SOC Type 2 documentation listed as an Enterprise plan feature (resemble.ai/pricing, read 9 November 2026); on-prem, air-gapped and private VPC deployment and Carahsoft contract vehicles on the same card; no indexed record.
- AIDI-D-0011ZeroGPT
GDPR through hosting in Germany, stated in the privacy policy of 7 October 2026 (zerogpt.com/privacy-policy, read 8 November 2026); its /trust and /security paths redirected to the home page on 9 November 2026. 7 study records, 0 of 18 human documents in Weber-Wulff 2023.
- AIDI-D-0032Compilatio
a GDPR page quoted in the support centre's privacy article, with servers in France and a 5-year storage period after the contract (support.compilatio.net, read 9 November 2026); 0 of 18 in Weber-Wulff 2023.
- AIDI-D-0050Paperpal
ISO 27001:2022 and ISO 42001:2023 stated as certifications, GDPR and FERPA as alignment, on a data security page read live at the card's domain (paperpal.com/data-security, read 10 November 2026), the second FERPA statement in the index after GPTZero's; the detector page states no storage of drafts; no study record.
- AIDI-D-0055Trinka
five named standards on a trust centre fetched live at trinka.ai/trust-center, the second-longest list in the index after Writer's (trinka.ai/trust-center, read 10 November 2026); the same page states AWS servers in the US and a 90-day deletion default; no study record.
What the evidence says about compliance claims
A compliance statement is a claim about the vendor's controls, and none of the 35 records in the studies index tested one; the studies measured detection, and the standards above describe data handling, so the two kinds of evidence do not overlap. The one indexed document that sets a data standard against a detector is Vanderbilt University's statement of 16 August 2023, which gave as two of its four reasons for disabling Turnitin's indicator that "Turnitin gives no detailed information as to how it determines if a piece of writing is AI-generated or not" and the privacy risk of "taking student data and entering it into a detector that is managed by a separate company" (vanderbilt.edu, read 9 November 2026; Vanderbilt 2023 record), an argument about disclosure rather than certification. FERPA, the standard a US school district asks about first, is named by two cards, GPTZero in a privacy policy sentence and Paperpal on its data security page (added 10 November 2026); Turnitin, the detector most districts license, names no standard on its trust centre or its AI writing FAQ as read on 8 and 9 November 2026, and the school districts view reads its student data statement instead.
The claims cluster where the vendors sell to enterprises and thin out where they sell to individuals. Writer, Grammarly and Sapling, the three with SOC Type 2 and ISO or HIPAA together, sell writing platforms to companies and treat the detector as one feature; TruthScan and Resemble Detect sell to businesses with Enterprise tiers; and the 32 cards with no named standard include every free consumer detector in the no-account view except Grammarly, as well as the three open-source research tools, which have no vendor to make a claim. The standards also do not predict the retention terms: Sightengine deletes content on processing and Grammarly Authorship keeps report data for up to 10 years, both under a GDPR statement, as the do AI detectors store your text question sets out.
What a reader can do with the table is ask for the document. A SOC Type 2 report, an ISO 27001 certificate and a signed BAA or DPA are papers a vendor sends under NDA, and each of the 10 rows names a page where the vendor says it has one; the index records the saying, not the paper. Where a vendor's page could not be read, the field is empty and the page is named in the notes, so a reader can try it in a browser. No detector score should be the only evidence in a misconduct, hiring or publishing decision, and a compliance statement changes what happens to the text, not what the score means.
Resemble Detect's SOC Type 2 line is read beside Pindrop's statements in the Pindrop vs Resemble Detect comparison, and the team seats and SSO view lists which cards state single sign-on beside a named standard, both read 10 November 2026.
Sources
- https://writer.com/trust/ (read 9 November 2026)
- https://www.grammarly.com/compliance (read 9 November 2026)
- https://sapling.ai/security (read 9 November 2026)
- https://trust.truthscan.com/ (read 9 November 2026)
- https://sightengine.com/security (read 9 November 2026)
- https://gptzero.me/privacy-policy.html (read 8 November 2026)
- https://www.resemble.ai/pricing (read 9 November 2026)
- https://www.zerogpt.com/privacy-policy (read 8 November 2026)
- https://support.compilatio.net/hc/en-us/articles/4416953631505 (read 9 November 2026)
- https://www.turnitin.com/trust-center (read 9 November 2026)
- https://www.vanderbilt.edu/brightspace/2023/08/16/guidance-on-ai-detection-and-why-were-disabling-turnitins-ai-detector/ (read 9 November 2026)
Revision log: 2026-11-09: view created at index version 2026.11.92026-11-10: Paperpal added (ninth wave), 11 cards; GDPR 9, ISO 27001 6, FERPA 22026-11-10: Trinka added (tenth wave), 12 cards; SOC Type 2 8, GDPR 10, ISO 27001 7, HIPAA 5, FERPA 3; the other eleven tenth-wave cards name no standard on any page read2026-11-10: nine eleventh-wave cards checked, none names a standard; 12 cards2026-11-10: twelfth-wave pages linked
FAQ: AI detector compliance claims
Which AI detectors publish SOC Type 2 or FERPA statements?
Seven cards name SOC Type 2 (Writer, Grammarly, Grammarly Authorship, Sapling, TruthScan, Resemble Detect, and Sightengine for its data-centre partners) and two name FERPA (GPTZero in its privacy policy, Paperpal on its data security page), as read on 8, 9 and 10 November 2026. Each is a vendor statement on the vendor's page; the index inspected no report.
Which detectors claim GDPR compliance?
Nine: Grammarly, Grammarly Authorship, Sapling, TruthScan, Sightengine (with a DPA) and Paperpal on live trust or data security pages, and GPTZero, ZeroGPT (hosting in Germany) and Compilatio (its GDPR page quoted in the support centre) on pages cited on the cards, read 8, 9 and 10 November 2026.
Does any AI detector state FedRAMP?
No card names FedRAMP or StateRAMP on any page read on 8 or 9 November 2026, including the five trust pages fetched live and every privacy policy cited on the cards.
Which vendor trust pages could not be read?
Copyleaks, Scribbr, QuillBot and Phrasly returned 403 at their /security paths; Hive's and Deploy's pages served a script shell with no text; ZeroGPT's /trust and /security redirected to its home page; every other card's domain returned 404 at every path tried, all on 9 November 2026. Those cards carry an empty field, not a negative finding.
Does Turnitin name a security standard?
Not on the pages read: turnitin.com/trust-center, read 9 November 2026, describes the company's approach to AI and names no SOC Type 2, ISO or FERPA statement, and the AI writing detection FAQ read 8 November 2026 names none. Turnitin is absent from this view for that reason.
Is a compliance claim evidence that a detector is accurate?
No. The standards describe how data is handled and audited, and none of the 35 indexed studies tested one; GPTZero, with FERPA, GDPR and CCPA, records false positive results from 9 of 18 in Weber-Wulff 2023 to 0 of 495 in Epoch AI 2026 across 16 records, independent of any standard.
