Ethyca vs Privado AI: how they compare in 2026

Without its models, Ethyca is still a data governance platform. Fides is a taxonomy and policy language, Janus manages consent and preferences, and Lethe fulfills data rights requests and deidentifies data. The data inventory can be filled from existing data security tools and catalogs. None of that needs a model. The models power two core features. Helios classifies discovered data with a large language model applied to database metadata. Astralis runs ongoing agentic risk assessment and enforces purpose based access at runtime, including rewriting an agent's query when its inferred purpose is not allowed. Ethyca positions itself as a governance harness for AI, not as a model product.

The model drives a core capability, on a product the vendor also sells without it. Wren is a named AI agent that runs the privacy assessment cycle: watching internal tools for activity to review, checking it against the customer's playbook, researching the question, reading documents, contracts, interview transcripts, code and connected apps, generating evidence, filling in the assessment and routing it to approvers. That is model work at the center of the assessment product. But the pricing page confirms the platform includes a base assessment module that can be bought without Wren. The web auditor, app auditor and code scanner are separately priced products that work by live scanning, static analysis and simulated consent journeys, not models. A large, separately sold part of what Privado offers does not depend on a model.

Ethyca publishes measured accuracy for its classifier, with the test set and method. An engineering post dated 23 December 2025, by a named author, reports precision, recall and F1 for Helios. Accuracy rose from about 50% at baseline to over 80% on an adversarial benchmark suite and over 95% on benchmarks drawn from real systems. Validation on customer provided datasets is reported at over 90%. Positive AI labels were wrong 5% of the time, against 14% for human labels. The test set is described: about 2,000 tagging tasks across 43 data categories, benchmark examples for 46 categories, and fully synthetic schemas built without customer data. The labeling method is described too, including a disagreement review that grew the labeled set from 449 to 825 fields. Three failure modes are named and fixed: laziness, shallowness and credulity. Ethyca also shows why naive accuracy misleads: a classifier that does nothing scores 98.6% on a typical enterprise data mix. The product cites no legal authority, so checks against primary law and citators do not apply. Two limits: no accuracy figure appears on a product page, only in the engineering post, and the category breakdown is shown in screenshots, not text.

Grounding is real and the retrieval path is described, but nothing is measured. The vendor names the sources Wren reads to fill in an assessment: imported documents such as product requirement documents, technical specifications, support documents, interview transcripts and notes; contracts, from which data processing terms are extracted; source code through a source control connection; connected apps through API connections; and internet research, with a cookie agent that checks cookie categories by searching in real time. The output includes evidence excerpts traced to their source, and gaps Wren could not fill are flagged rather than filled. There is no accuracy rate for completed assessments, no evaluation, test set or error analysis, and nothing on how often an evidence excerpt actually supports the conclusion drawn from it. The outputs are assessments and data maps, not legal assertions citing authority.

What the system does alone is set out, and customers get review surfaces, but not the thresholds. Astralis checks every agent call through an MCP gateway before it runs, rewrites a query whose inferred purpose is not allowed, rechecks the risk register nightly, and drafts assessments and mitigations for approval. Customers set the limits through a purposes taxonomy, policy definitions and the Fides ontology, which they version themselves. Review happens in the risk register, the assessment report and an audit record of how and why each access decision was made. What is not published: when the gateway blocks rather than rewrites, what happens when an enforcement decision is wrong, and whether a person approves a mitigation before it applies. The classifier post's discussion of human review concerns Ethyca's own evaluation work, not customer oversight of the product.

A real division of labor is published, with review points, but the boundary is not settled. Wren triages incoming activity and starts the right assessment or record of processing based on risk and on the playbook and privacy policies the customer's team defines, so the constraint is the buyer's own document. Assessments go to approvers, gaps Wren cannot fill are passed to a person in chat, and risks it finds are tracked alongside those raised by privacy staff. That is a workflow with a person at named points. What is missing is where the boundary sits. The vendor says Wren eliminates manual threshold assessments and immediately gives privacy guidance for low risk activity, so it does answer some questions without review. Nothing defines low risk, what Wren may finalize unattended, or what happens when an assessment it filled in turns out wrong after a decision was made on it.

Sixteen customers are named, each with a profile page, including The New York Times, Ramp, SurveyMonkey, WeTransfer, Vercel, Lush, Zola, Casper and American City Business Journals. Platform figures are specific: 744m preferences processed a year, more than 4m access requests, 200+ global brands, $74m+ saved by automation, subject requests cut from 15 hours to 17.2 seconds, 1 PB governed daily and 150,000 policy decisions a second. None is tied to a named customer, and no method is given. The New York Times profile page shows the paper's own business figures (11.7m subscribers, $2.59bn revenue, 139 Pulitzer Prizes) and a chief executive quote about subscription strategy, not about Ethyca.

Three deployments are published with attributed quotes and linked case studies. At HP, a Privacy Innovation and Assurance Leader describes seeing personal data across the technology stack and automating manual controls such as privacy reviews. At HERE Technologies, a Director and Head of Product Trust says compliance reports keep pace with data flows as the product changes. At Headspace Health, a chief information security officer describes building privacy into software development to prevent accidental sharing or tracking. The quotes carry no figure for review time, assessment volume, issues found or cost, no dates, and no method behind any claim. The full case studies sit on a separate customers page.

Confidentiality commitments sit in a contract a buyer can read before signing, but privilege goes unmentioned. MSA section 4.1 licenses Customer Data only to provide the Service and meet Ethyca's obligations. A separate narrow license over Audit Data, three listed fields, is for legal compliance only. Section 4.2 limits use of Customer Data to operational needs such as audit trails and system monitoring, or where law requires. Section 9 sets mutual confidentiality, with need to know limits and written duties on staff. DPA section 3(f) commits to deletion or return within 90 days of termination. The CCPA schedule bars retention, use or disclosure beyond the business purpose, and bars sale. The classifier reads metadata only and, in Ethyca's words, needs no access to sensitive data. Two gaps: nothing addresses privilege or work product, and no model provider's retention terms are stated, since the inference platform is not named. MSA last modified 10 February 2023, DPA dated 17 October 2024.

The published commitments are substantial and backed by real enforcement, but separation and model providers are not addressed. The subscription terms make Customer Content, including source code, data elements and the reports generated from them, the customer's Confidential Information. They set aside the agreement's standard five year limit for that material, so the duty lasts until an exception applies. Privado's use is confined to what is needed to provide the services, and all intellectual property in the generated reports belongs to the customer. Enforcement is real: a penalty of twelve months' fees for any confidentiality breach, which does not release Privado from performance or replace the customer's damages claim, and a liability cap that falls away entirely for confidentiality and privacy breaches. The security page adds role based access control and an internal procedure that blocks employee or administrator access to user data except for limited support needs, with staff under confidentiality agreements. Two things are missing: nothing addresses separation between customers or between matters within one account, and nothing says what the model providers behind Wren may keep, since none is named.

Legal advice is plainly excluded in the agreement that governs the product. MSA section 10.4, headed No Legal or Regulatory Advice, says Ethyca does not provide legal, accounting, tax or regulatory services. It does not advise on complying with or interpreting any privacy or security law. Any recommendation concerns how the Service works, is given from a business view, and should not be relied on as legal advice. The customer alone is responsible for identifying and meeting its own obligations. Section 10.3 adds that Ethyca does not warrant that using the Service will result in legal compliance. Use is limited to Authorized Users under an Order Form for internal business purposes. What is missing: nothing on a supervising lawyer's competence or supervision duties, and no jurisdiction limit on the guidance the product gives. There is no public advice surface, so consumer facing limits do not apply.

A disclaimer sits in the terms while the product gives guidance, and nothing addresses where output stops and legal judgment begins. The vendor says Wren eliminates manual threshold assessments and immediately gives privacy guidance for low risk activity. That means a model tells a business stakeholder that an activity does not need a data protection impact assessment. Nothing published says such guidance is not legal advice, that privacy counsel or the data protection officer stays responsible for the decision, or what happens if the call was wrong. The agreement has related but different provisions. Section 5 records the customer's acknowledgment that it relied on its own skill and judgment to check the software's fit for its intended use, and section 9 disclaims fitness for a particular purpose. Those concern suitability and warranties, not the advice line.

Testing of Ethyca's own classifier is real and published, but no owner is named and no findings on uneven output across people are disclosed. Its published evaluation framework defines and defends an accuracy metric and uses an adversarial benchmark suite. It reports metrics by category in a purpose built workbench, reports findings on model size, and explains the precision and recall tradeoffs between more conservative and more creative models. What is missing is governance structure. No accountable owner is named. No AI policy, model card, governance committee or review board is published. No finding is disclosed on uneven output across populations or data subject groups, as opposed to data categories. Ethyca sells AI governance and publishes solid testing, but no governance structure of its own.

Wren, the vendor's agent, drafts data protection impact assessments. The product pages do not name who is accountable for Wren's behavior, describe what is tested before it ships or changes, report any test result, say whether output varies across legal regimes, languages or document types, or offer a model card. The promise that customer data and code are never used to train models is a data use commitment, and the SOC 2 program with continuous control monitoring is security assurance. An assessment Wren fills in becomes the customer's record of its own compliance reasoning, shown to regulators and auditors. A separate product documentation site is published.

Ethyca publishes contract terms on all five areas: retention, deletion, access control, subprocessors and incidents. Processing is limited to the term of the Agreement. Controls in the product let the customer retrieve, correct, delete or restrict Personal Data, and the Audit Data license that survives covers three listed fields only. DPA section 3(f) commits to deleting or returning all Personal Data within 90 days of termination. Backups are carved out but must be isolated, kept from further processing and deleted under stated practices. Annex 2 sets out access control item by item. It covers authentication, permissions checked against each data set's attributes, API access by key or OAuth, VPC and firewall segmentation, and intrusion detection. It also covers static code analysis, annual third party penetration testing, a responsible disclosure program, least privilege staff access reviewed quarterly, and background checks. Annex 1.H names subprocessors with purpose and location: Amazon Web Services for cloud infrastructure in Virginia and Twilio SendGrid for transactional email. Customers are notified of changes and have a 30 day objection right for European and Colorado data. Incidents are notified without undue delay, with information and help for the customer's own notice duties. The agreements are dated 10 February 2023 and 17 October 2024.

Retention, deletion, access control, subprocessors and incident practice are all published in specific terms in the data processing addendum and security page. Annex II of the addendum sets out the measures: background checks on new employees, annual security training, written confidentiality and security terms with every vendor, role based access control, and a password policy with credentials held in AWS Cognito. It also covers change management with review before production, TLS in transit and strong encryption at rest, vulnerability assessment and penetration testing twice a year, and backups every fifteen minutes to an encrypted S3 bucket, restore tested twice a year. Retention has periods. Personal data is deleted when an administrator deletes the user and within six months if the customer leaves, and clause 12 requires its return or deletion within at least thirty days of the end of the agreement. Clause 11 covers incidents: breach procedures, notice without undue delay unless the breach is unlikely to put rights at risk, and help notifying the authority and data subjects. Annex II lists each subprocessor with purpose, data center locations and products supported.

The liability position is specific, but nothing covers wrong output. MSA section 8.1 defends and indemnifies against third party claims that the Service infringes a US patent, trademark, copyright or trade secret. It lists six excluded activities and says this is the sole and exclusive remedy. Section 11 caps each party's liability at 150% of fees paid in the twelve months before the act or omission, and at 300% of those fees for the section 8.1 indemnity. Gross negligence, willful misconduct, payment obligations and the customer's own indemnity are carved out. Section 10.2 warrants that the Service conforms in material respects to the Documentation, with notice, correction and a right to terminate if it cannot be fixed. A buyer can actually use that warranty. What is missing: no indemnity covers wrong output, and section 10.3 disclaims all warranty on the Service and its reports or outputs. It also expressly disclaims that use will result in compliance with law. No insurance is named.

The liability position is published in full, including an insurance schedule. The indemnity at section 12 goes beyond intellectual property: it covers third party claims from Privado's breach of law, from infringement or misappropriation by the software or the customer's lawful use of it, and from Privado's breach of confidentiality. It has three named exclusions and the standard remedies of modifying, procuring, or terminating with a refund. Section 13 caps liability at twelve months of subscription fees. Section 13(b) lifts both the cap and the exclusion of indirect damages for privacy and security breaches, confidentiality breaches, indemnities, and death or personal injury, so the indemnity sits outside the cap. Section 11(f) adds a fixed penalty of twelve months' fees for any confidentiality breach, without releasing Privado from performance and without prejudice to damages. Section 14 requires $1,000,000 each of general liability, technology errors and omissions, cyber and privacy liability, and umbrella cover, with four years of tail on claims made policies. Section 5 warrants material conformance to the documentation and no material loss of functionality. Annexure B commits to 99.9 percent uptime with service credits from 5 to 30 percent, and to support response and resolution goals with a named escalation path.

Ethyca's pages name Snowflake and BigQuery, AWS, identity providers, website cookies, tags and SDKs, third party apps, and data intake by API, SFTP, manual and web upload. The MSA prices Connector Integrations as a separate line, which points to a connector catalog. The Fides core and its connectors are public on GitHub, the API docs and release changelog need no login, and Astralis offers an MCP gateway that checks agent calls against policy. Ethyca also publishes an integrations catalog and a documentation site. The home page and the agreement do not say what each connector moves or in which direction. The product, bought by privacy counsel, connects to warehouses and identity systems; no connection to document or practice management systems is named.

Wren connects to Jira, Confluence, Linear and procurement tools to catch activity needing a privacy review, and pushes development tickets back into Jira and Linear. Data maps are built from source code through a source control connection, from third party apps (customer data platforms, tag managers, CRM, contract management, HR, marketing, procurement and database tools) through API connections, and from imported documents. The OneTrust integration has a stated direction: the data inventory, assessments and risks in OneTrust are updated automatically from Privado. Setup effort is published per module. The web auditor needs only URLs and scan locations, the app auditor needs the app store URL or the APK and IPA files, and neither needs implementation. Wren takes a few days to connect tools, set up playbooks and import documents, and the full platform usually takes one to three weeks. Documentation for each connector sits on the documentation site.

Delivery is stated, with some residency detail. There are two paths: the open source Fides core, which a customer can run on its own infrastructure, and Hosted Fides, the subscription service. For the hosted service, DPA Annex 2 says Customer Data sits in shared, multitenant storage reachable only through application interfaces and APIs, with no direct customer access to the infrastructure. The subprocessor annex places cloud hosting with Amazon Web Services in Virginia, United States. DPA section 6 says Personal Data goes to Ethyca, Inc. in the United States and to other places where its affiliates and subprocessors operate, under the EU Standard Contractual Clauses. Not published: a list of regions, any choice of region, what differs between the four tiers, or where processing happens as opposed to storage.

Regions are stated; the deployment model is not. The data processing addendum's subprocessor annex gives a data center location for each entry. Amazon Web Services, the main cloud host where all Privado applications run and all product data sits, is listed for the United States, the European Economic Area and India, and MongoDB, the main product database, for the same three. So a buyer can tell which countries its data may be in. Transfers out of the EEA use the 2021 Standard Contractual Clauses, set out in full in Schedule 1, under Irish law with the Irish Data Protection Commission as the authority, and clause 8.8 restricts onward transfers. Nothing covers deployment: no tenancy model, no single tenant or self hosted option, no way to choose or pin a region, and nothing separating where processing happens from where data is stored beyond the transfer mechanism. The web and app auditors let a customer choose where a scan runs from, but that is where the simulated user appears, not where data is held.

No certification badge appears on Ethyca's pages or in its agreements. The only standards named are SOC 2 Type II and ISO 27001, and the DPA assigns both to Ethyca's data center partners, not to Ethyca. Those cover the hosting provider, not this product. Ethyca's own assurance is assessment rather than certification: annual penetration testing by recognized third parties, with a summary report shared in confidence on request, plus a responsible disclosure program and static code analysis, all in DPA Annex 2. A trust center at trust.ethyca.com, hosted by Vanta, is open without a sales call and says audit reports and security policies are available there. The DPA has a drafting slip: its Virginia and Colorado section says ISO 29001 where the European section says ISO 27001.

There is a badge and a monitoring tool, with no scope, date or report route. The footer and security page show a SOC 2 mark with the AICPA logo, and the security page says Privado uses Drata to monitor more than one hundred internal security controls continuously, with automated alerts and evidence collection. Nothing lets a buyer check it: no type is stated, so Type I and Type II are not distinguished; no trust services criteria are named; no auditor, examination period or report date appears; and there is no route to a report, questionnaire response or portal, since there is no trust center. Continuous control monitoring is real practice, but it shows a program, not an attestation. The security page says it was last updated on 17 February 2022.

The models are named in an engineering post rather than on a product page. The classifier was built and benchmarked against models including Qwen's QwQ-32B and DeepSeek-V3. The post finds that accuracy stops improving above about 32B parameters and that models below 18B make errors that cannot be corrected. The design is described in detail: one request per field so fields are not skipped, written reasoning about tagging, prompt caching, prompt optimization rather than fine tuning, and metadata only inputs. What is missing: no inference provider is named, the post says only cloud inference platforms, and nothing commits to telling customers when the model supply chain changes. Ethyca's contract subprocessor list names only AWS and Twilio SendGrid, so no model or inference provider is on the list customers are notified about. Post dated 23 December 2025.

The vendor sells a named AI agent and publishes a subprocessor list, and no model provider appears on it. Annex II of the data processing addendum lists five subprocessors with purpose, data center locations and the products each supports: Amazon Web Services for infrastructure, MongoDB as the main database, SendGrid for email, Intercom for support and Amplitude for product analytics. None is a model provider, and no model, model family, provider, hosting arrangement or inference location for Wren is named anywhere read. Wren clearly runs on a model, since the pricing FAQ says customer data and code are never used to train AI or ML models. So either an unlisted third party sees the documents, contracts, transcripts and source code Wren reads, or the models run inside the AWS setup already listed, and nothing published says which. No commitment to notify customers of changes is given. The subprocessor mechanism at clause 10 offers an objection route with no advance notice period, though the incorporated Standard Contractual Clauses require thirty days' notice of changes for EEA transfers.

A pricing structure is set out, with no prices. The site has no pricing page and no figure, and every call to action is a demo request, a free trial request or a contact form. The structure is in the agreement. MSA section 6.1 names four tiers: Fides True, Fides Team, Fides Plus and Fides Enterprise. Connector Integrations are charged separately, and tier changes or added connectors are charged pro rata for the time used. Section 6.2 sets monthly invoicing in advance on 30 day terms, and fees are not refundable except on Ethyca's breach. Section 6.3 allows price increases only at renewal, with at least 60 days' notice, and only when applied to all customers. The open source core is free to self host. No rate, price band or implementation figure was found.

A rate card is published with figures, units, minimums and what each product includes. The web auditor starts at $600 per website per month billed annually, with a four website minimum and bulk pricing by page available. The app auditor is $800 per app per month billed annually, with iOS and Android counted as two apps. Wren is $4,200 per month billed annually for up to 500 assessments. Only the full platform is priced on request, and the page says what it adds. Each tier lists its features, and volume discounts are disclosed. Annexure A of the subscription terms defines the units: a developer is a user who has committed to a scanned repository in the last ninety days, a website is each unique URL entered, an app is each platform version, and a scan is one run against one website from one location, so the same site from three locations is three scans. The agreement adds fees in advance, a twelve month initial term, nonrefundable fees and 1.5 percent monthly interest on late payment.

Named customers show who Ethyca serves, but not where its coverage stops. Its customers page labels customers by industry: publishing (The New York Times, Axios, American City Business Journals), internet software (WeTransfer, SurveyMonkey, Vercel, Podium), fintech (Ramp), retail and consumer brands (Lush, Casper, Away, Parachute, Zola), and marketplaces and services (JustPark, Slice, Snackpass). It targets enterprises, with a separate enterprise page, and says it works as a technical partner rather than selling an off the shelf SaaS tool. Its workflows show who buys, though the site has no page by role or buyer segment. Not stated: any jurisdiction limit, which regimes are unsupported, or who the product is not for. Practice area and firm segment coverage do not apply to a data infrastructure product bought by in house privacy and legal teams.

Coverage is described in substance across buyers, legal regimes and systems, and the limits are left open. Buyers are addressed by function and confirmed by customer quotes: privacy teams for assessments and records of processing, engineering for code scanning, and security leaders. The three named customers are a technology manufacturer, a mapping company and a digital health provider. Regulatory coverage is named: CCPA, CIPA and GDPR, more than fifty prebuilt compliance checks, dedicated GDPR and CCPA pages, and support for the GPP, TCF and TAG consent frameworks. The systems covered are listed: websites, mobile apps, internally built software, third party apps and business processes. No limit is stated. No jurisdiction, sector or company size is ruled out, the compliance checks have no stated boundary, and nothing says what a law firm, rather than an in house privacy team, would do with the platform.