Napkin AI Enterprise Risk Assessment | AI Tool Risk

Back to AI Tools

Napkin AI

Risk Overview

Minimal Risk

3.3

/10

UI Design

Top Risks

Newer company with less established security certification history — no confirmed SOC 2 or ISO 27001. US CLOUD Act jurisdiction. Visual content (potentially sensitive business diagrams, strategies, org charts) processed by OpenAI and Google sub-processors. API Terms of Service may have additional provisions not reviewed.

Mitigations

Zero-data-retention agreements with all AI inference sub-processors (OpenAI, Google Gemini/Vertex AI) — strong and explicit. DPO appointed. Data encrypted in transit and at rest. Generated content auto-deleted after 1 hour from servers. Account deletion triggers immediate data removal. DPA available for team/enterprise customers.

Get started

Is your team using

Napkin AI

safely?

Book a Demo Free Assessment

Highest Risk Categories

The highest-scoring risk categories identified in this assessment.

Legal Terms

API Terms (Second Layer, Inc.) last updated August 2025. Main privacy policy does not publish dispute resolution terms. DPO designated (Erwan Martin). Data Processing Agreement available for enterprise/team customers. US law governs (Los Altos, CA). Additional API-specific terms may contain arbitration provisions not reviewed in privacy policy alone.

/10

Data Sovereignty

US company (Los Altos, CA). Data hosted on US secure cloud infrastructure. US CLOUD Act applies. GDPR compliance maintained — DPO appointed, privacy rights honored. International data transfers noted with applicable safeguards. Standard US sovereignty risk profile.

/10

Security Posture

HTTPS/TLS for all data in transit. Sensitive data encrypted at rest. Role-based access controls. Access logs reviewed. ZDR agreements with AI sub-processors. DPO appointed. No public SOC 2 or ISO 27001 certifications found. Newer company (launched ~2023-2024) — security program may be less mature than established vendors.

/10