Import.io Enterprise Risk Assessment | AI Tool Risk

Back to AI Tools

Import.io

Risk Overview

Moderate Risk

4.6

/10

Web Scraping

Data Extraction

Top Risks

Privacy policy severely outdated (October 2016) — predates GDPR, CCPA, and modern AI privacy considerations. Third-party advertising network tracking for interest-based ads unusual for a B2B data tool. No confirmed security certifications. Broad consent to US data transfers embedded in outdated policy language.

Mitigations

DPA with EU Standard Contractual Clauses available for enterprise customers. Acceptable Use Policy published. Managed enterprise service model limits broad public data exposure. Security findings reporting page exists. B2B focus limits consumer privacy exposure.

Get started

Is your team using

Import.io

safely?

Book a Demo Free Assessment

Highest Risk Categories

The highest-scoring risk categories identified in this assessment.

Data Retention

Retains 'for as long as an account is active or as needed to provide the Service' with right to keep for 'other purposes set forth in this Policy.' Privacy policy from October 2016 — significantly outdated and likely not reflecting current GDPR/CCPA practices. No specific post-deletion timeline stated. Indefinite retention implied for some uses.

/10

Security Posture

Privacy policy from 2016 describes 'commercially reasonable means to protect personal information' but acknowledges inability to guarantee security. No public SOC 2 or ISO 27001 certifications found. Security findings reporting page exists (legal/reporting-security-findings). No public bug bounty program. Outdated security documentation.

/10

3rd-Party Sharing

Shares with affiliates, third-party service providers, and advertisers for online advertising. Uses third-party online advertising networks to collect user behavior data across sites over time for interest-based advertising. Business transfer clause included. Active third-party ad tracking is above average for a B2B scraping tool.

/10