Back to AI Tools
Kapwing
Risk Overview
Moderate Risk
4
/10
Video Generation
·
Video Editing
·
Top Risks
Voice Cloning feature stores voice data for R&D/product improvement without opt-out; data subprocessors may use anonymized data for training (Kapwing requests but cannot guarantee opt-out clauses); promotional use of content is default; no SOC 2 or ISO 27001 certifications; CLOUD Act jurisdiction.
Mitigations
Avoid Voice Cloning feature for sensitive or proprietary voice content. Use private project settings (Pro/Enterprise). Delete projects after export (7-day deletion guarantee). Enterprise plan includes security review. Strong product-level privacy FAQ shows transparency commitment. California court jurisdiction (not arbitration) is user-favorable.
Get started
Is your team using
Kapwing
safely?
Highest Risk Categories
The highest-scoring risk categories identified in this assessment.
Legal Terms
ToS (last modified Sept 2024) specifies California law governs without arbitration reference in accessible text. 'Choice of law and jurisdiction: governed by California law... suit must be in San Francisco, California.' No mandatory arbitration found in ToS text. No class action waiver found explicitly. California court jurisdiction is more user-accessible than arbitration. Standard disclaimer of warranty and limitation of liability present. No specific damages cap found in ToS text.
5
/10
3rd-Party Sharing
Privacy policy states service providers used under written contracts may receive personal data. CCPA section acknowledges potential sharing for advertising (sharing with advertising partners may be considered 'sale' under CCPA with opt-out available). Does not 'sell user data.' Subprocessors listed separately (GDPR-compliant vendors only per security FAQ). Google Cloud Platform hosting (US East/West). No major ad data sales. Targeted advertising possible per privacy policy.
4
/10
Data Retention
Projects deleted by user are removed from servers within 7 days. Workspace deletion removes all data. Account deletion removes all data and cannot be reversed. Voice Cloning data retained for R&D—no specific deletion timeline stated for cloned voice. Retains customer data 'only for as long as necessary to provide services, comply with legal obligations, or as per stated policies.' Secure disposal processes documented.
4
/10
Unlock the complete assessment
Run a free assessment to access the full AI tool risk analysis.
Updated July 2026 • AI-assisted research • Reviewed by Verax • Report an issue
Reference Documentation
Official documentation and policies referenced as part of this assessment.
Terms of Service
https://www.kapwing.com/policies/terms-of-service
Privacy Policy
https://www.kapwing.com/policies/privacy
End User License Agreement (EULA)
https://www.kapwing.com/help/security-and-data-privacy-faq/