Skip to content
Book a meeting

Trust Center

Bynn Intelligence secures customer data and the models that process it, with controls monitored continuously in Vanta.

View the trust centerRequest reports

Certifications and attestations.

Reports and audits

  • Maintained for the term

    ISO/IEC 27001 certification and a SOC 2 attestation, or successor frameworks of at least equivalent rigour, for the term of the agreement.

    DPA §6.2

  • Available to customers

    The certificate and the report, each with the scope stated in it, through the trust center and on request at security@bynn.com, subject to confidentiality.

    Request reports (opens in a new tab)

  • Questionnaires and audits

    Security documentation and answers to a reasonable security questionnaire not more than once in any twelve months, and an audit where that information is not enough.

    DPA §12

Frameworks and laws.

The frameworks the controls are mapped to, the laws the contract terms address and the card-data self-assessment. None of them is a certification.

Controls mapped

Frameworks and laws the controls are mapped to.

Laws and self-assessment

Addressed in the contract terms, or self-assessed.

Security and privacy practices.

What Bynn commits to, in the words of the Privacy Policy and the Data Processing Addendum (DPA), which is part of every account and engagement. The controls behind them are listed in the trust center (opens in a new tab).

  • Encryption

    Customer Personal Data is encrypted in transit over public networks and at rest.

    • Encryption keys and credentials are managed, including their rotation.

    Read in: DPA §6.1Privacy Policy §7

  • Access control

    Need-to-know access with individual accounts, and production access logged and monitored.

    • Each customer's data is logically separated.
    • Everyone authorised to process Customer Personal Data is bound by confidentiality and trained in handling personal data.

    Read in: DPA §6.1DPA §5

  • Sub-processors

    30 days' notice before a new sub-processor, with a right to object.

    • Five categories: cloud computing and hosting, computing infrastructure for running models, payment processing, email delivery and customer support.
    • Each is bound in writing to data protection obligations no less protective than the DPA, as appropriate to its services.
    • The current list, with each sub-processor's function and location, is available to customers on request at privacy@bynn.com.

    Read in: DPA §7

  • Data location and transfers

    Transfers from the EEA, the UK and Switzerland under the Standard Contractual Clauses.

    • Customer Personal Data may be processed outside the European Economic Area, the United Kingdom and Switzerland, including in the United States.
    • The clauses are those of Implementing Decision (EU) 2021/914, with the UK Addendum for the United Kingdom and the same clauses, as adapted, for Switzerland.
    • A request from a public authority is notified to the customer where legally permitted, challenged where unlawful and answered with the minimum information it requires.

    Read in: DPA §13Privacy Policy §9

  • Incident notification

    Breach notice without undue delay, within 72 hours at the latest.

    • The notice describes the breach, the people and records concerned, its likely consequences and the measures taken, with a contact point at security@bynn.com.
    • Bynn contains, investigates and mitigates the breach, and assists with the notifications the customer must make.

    Read in: DPA §10

  • Retention and deletion

    Deleted when the retention period ends, and confirmed in writing on request.

    • The retention period is the one the customer sets, or the one its order form provides.
    • When an account closes, its data can be exported for 30 days and is then deleted.

    Read in: DPA §11Terms of Use §8.8

Responsible AI.

How our models are measured and the limits on how customers may use them. The AI management controls are mapped to ISO/IEC 42001:2023 and the EU AI Act, listed with the other frameworks and laws.

Independent evaluation

72.53%

True-positive rate, ages 13–16

The proportion of people aged 13 to 16 correctly estimated within that age band.

#1 for true-positive rate in NIST's Child Online Safety evaluation for ages 13–16.

Model
Bynn's facial age-estimation model, which powers Agemin
  • Measured by NIST in its ongoing evaluation program. NIST evaluation is not certification or endorsement.
  • The result measures age estimation within the 13 to 16 band. It does not measure a reduction in online harm.

NIST FATE Age Estimation & Verification. Submission bynn-000.

View the NIST results (opens in a new tab)Read the research

  • Decisions about people

    Customers may use the Services to support decisions with legal or similarly significant effects on people only where a qualified person reviews each one before it takes effect. A person refused by an automated age or identity check must have a way to obtain that review and contest the result.

    Acceptable Use Policy §3

  • Regulated AI systems

    Where a customer's use forms part of an AI system the law regulates, such as a high-risk system under the EU AI Act, the customer is its deployer or provider and carries the obligations the law places on it. Bynn provides the information about the Services that the customer reasonably requests for that purpose.

    Terms of Use §6.4

  • Training on customer data

    Bynn uses Customer Data to develop, train or improve its models only where an order form or the product terms permit it, or, for Agemin, to improve liveness detection unless the customer opts out. Otherwise it does not.

    Terms of Use §8.3

Policies and agreements.

All legal documents

Contacts.

Where to send security reports, privacy requests and requests for the certificate and the report.

Security
security@bynn.com

Security issues and incidents, and requests for the ISO/IEC 27001 certificate and the SOC 2 report.

Privacy
privacy@bynn.com

Requests about personal data, countersigned copies of the Data Processing Addendum and the current list of sub-processors.

Postal address
Bynn Intelligence, Inc.2261 Market Street STE 22340San Francisco, CA 94114, United States
Representatives

Bynn's representatives in the European Union and the United Kingdom under Article 27 of the GDPR are named in Privacy Policy §14.

Discuss your security review.

Book a meeting to go through the trust center, the reports and the Data Processing Addendum with your security, privacy and procurement teams.

Book a meeting

Necessary cookies run the site. Analytics and marketing need your consent.Necessary cookies run the site. Others need your consent. Privacy policy

Privacy policy