T

TrustArc

TrustArc's Terms of Use for AI Features state that use of any AI enabled feature is strictly optional, that no customer data is processed by AI technologies unless the customer uses such a feature, and that the customer may discontinue them at any time. Table 1 lists the features as assistants, lookups, autofill, similarity search, bulk record creation, translations and summaries layered onto PrivacyCentral, Data Mapping, Assessment Manager, Cookie Consent Manager, Trust Center and Nymity Research, each of which functions as a privacy management, assessment or research product without them. Arc Intelligence reached general availability in December 2025 on a platform in operation for decades.

The AI Terms say TrustArc takes measures designed to ensure accuracy but is not responsible for the quality, accuracy or effectiveness of AI output, and that every output must be reviewed, with a subject matter expert if needed, before use. The NymityAI research chatbot answers from the Nymity library of regulatory summaries and templates, which is licensed content rather than primary law that can be verified without a subscription.

No accuracy figure, test set, evaluation or description of how answers cite their sources is published in the AI Terms or on the product pages.

AI Terms section 2.1 requires the customer to review and validate AI outputs and not rely on them for decision making without human oversight. Section 1.1 requires notice before any AI technology processes customer data and makes every AI feature optional and revocable on request. The features themselves are assistive, with suggestions, lookups, autofill and an evidence analyzer that a user accepts into an assessment or record.

No threshold at which the system acts without a person, no description of what executes automatically, and no route back after an output is wrong beyond the customer's own review is published.

A published case study names the New England Journal of Medicine and its data protection officer, Sean McInnis, describing a migration of a cookie consent tool and the support received, with no measured outcome. A second case study attributes figures to an unnamed Fortune 500 consumer products company: time to compliance cut by up to fifteen percent, privacy program operating expenses reduced by sixteen to thirty percent, and more than three quarters of privacy processes automated, with no method stated. Nothing joins a named customer to a figure, and the AI features are not the subject of either study.

AI Terms section 1.1(b), incorporated into the customer agreement, states that customer data will not be used for AI model training, model improvement or any similar purpose, and 1.1(d) that the third party AI technologies are explicitly opted out of LLM training and used solely to generate responses for authenticated users within the TrustArc environment. Table 1 names the third party providers feature by feature. The subscription agreement gives a thirty day retrieval window after termination followed by deletion, and the AI Terms commit to ceasing AI processing promptly on request.

No statement on segregation between customers or matters, and no treatment of privilege or work product, appears in the AI Terms or on the trust center.

AI Terms section 1.2(b) requires the customer to review all AI output before use, suggesting consultation with an internal or external subject matter expert, and section 2.1 bars relying on outputs for decisions without human oversight. The buyer is stated as privacy and compliance teams. The Nymity library publishes legal summaries and the research chatbot answers from them, and no page says whether those outputs are or are not legal advice. No jurisdiction limit is named.

The AI Terms are substantive on data use, provider transparency, opt out and change notice, but they say nothing about who inside TrustArc is accountable for the AI features, what is tested before a feature ships, or what has been found about uneven output. No responsible AI page, ISO 42001 or equivalent certification, or model evaluation is published in the legal center or on the trust center. The Assessment Manager product sells AI risk assessment to customers, which is governance of the customer's AI rather than TrustArc's own.

On retention, the subscription agreement keeps customer data for thirty days after termination for retrieval and then permits deletion, except for copies the law requires. The trust center privacy notice keeps personal information only as long as necessary and leaves data about people named in customer assessments under customer control. On deletion, the AI Terms commit to stopping AI processing on request. A public subprocessor list gives each one's location, purpose and transfer mechanism, with emailed notice thirty days before any addition and a separate list of affiliates.

On incidents, AI Terms section 1.3 commits to prompt notice of any security incident involving AI processing under the agreement or DPA. The legal center publishes a technical and organizational measures document and a DPA of February 2024. The trust center security page states TLS 1.2 in transit and AES 256 at rest, with intrusion detection and logging.

Section 8.1 of the subscription agreement gives a TrustArc defense and indemnity for third party claims, stated to be its entire liability and the customer's exclusive remedy, with exclusions for modifications, combinations and use that does not comply. Section 8.2 has the customer indemnify TrustArc for customer data and other matters, and section 7.2 warrants core functionality against documentation, no material decrease during the term, measures against malicious code and diligent services.

The terms for users on partner channels cap either party's liability at fees paid for the solution in the previous twelve months. AI Terms section 2.1 gives the AI features the same warranties and exclusions as the solutions, and section 1.2(b) disclaims responsibility for the quality and accuracy of AI output.

The subscription agreement contemplates Third Party Applications the customer enables, exchanging data on its behalf, and the Trust Center product page describes pushing documents from content systems, notifying Slack and creating ServiceNow tasks through TrustArc Integrations. No practice, document or matter system is named in either, and nothing describes what syncs or in which direction for the privacy applications.

The subprocessor disclosure gives a location for each processor, including Microsoft in Washington and Canada Central for logging and messaging and Mailgun in Texas for research alerts. The AI Terms place one feature, Ask Arc, on Anthropic in the United States or Bedrock in the EU, which is a region choice stated for that feature alone. The trust center security page refers to an enterprise grade cloud hosting provider without naming it.

Nothing states whether customers share infrastructure or where the platform's primary data store sits, and no residency option is described for the platform as a whole.

The trust center security page states an annual assessment by a qualified outside auditor against the AICPA SOC 2 Type II standard, alongside TLS 1.2 in transit, AES 256 at rest, intrusion detection, logging and incident response plans. The trust center has privacy, security, availability and legal sections. No auditor is named and no coverage period is stated. The report sits behind the trust center's permissions, which TrustArc's own Trust Center product page describes as keeping SOC 2 reports behind confidentiality requirements. No ISO certification is stated on the trust center.

Table 1 of the AI Terms maps every AI feature to its AI technology and outside provider, and the models themselves are not named. The Azure AI Platform from Microsoft runs the Nymity research chatbot and lookups. The OpenAI API runs autofill, similarity search, bulk record creation, evidence analysis, summaries and cookie research, and the Gemini API from Google Cloud runs translations and assisted upload. Ask Arc runs on either Anthropic in the United States and Amazon Bedrock in the EU, or on the OpenAI API, depending on which of two versions of the table the page shows; the two versions disagree.

Section 2.2(b) commits to thirty days' notice and a right to object before any change that materially and adversely affects the customer, including changes to provider relationships. Section 1.1(d) says the providers are opted out of training language models. The technology column names platforms and APIs rather than models.

No pricing information is published in the legal center, the subscription agreement or the AI Terms. The legal center lists agreements and policies with no pricing document, the subscription agreement refers fees to the order, and the AI Terms mention usage limits such as daily query caps without a charge.

The buyer is stated as privacy, legal, security and compliance teams in enterprises, with the Nymity library covering privacy regulations, legal summaries and operational templates globally. Product navigation names the EU AI Act, India's data protection law and the EU US Data Privacy Framework among covered regimes. Case studies span healthcare, publishing and consumer products, and the TRUSTe assurance programs serve a separate certification market.

Nothing states where the product stops: no jurisdiction or regulation is named as unsupported and no law firm use is described.