Secure by design. Certified at every layer.

Ultralytics aligns its security program with industry-recognized frameworks, including SOC 2 and ISO 27001.

Our security program includes:

• Formal security policies and procedures
• Role-based access controls and least-privilege access
• Encryption of data in transit and at rest
• Continuous monitoring, logging, and vulnerability management
• Incident response and business continuity processes

In addition, we conduct independent third-party security testing, including penetration tests, to continuously assess and improve the security of the Ultralytics Platform.

The Ultralytics YOLO codebase is maintained using secure development practices, including:

• Version-controlled repositories with access controls
• Peer-reviewed code changes
• Automated testing and vulnerability scanning before release

The curated datasets used for training our Enterprise products are derived from publicly available sources. These datasets are subject to internal review, curation, and filtering to align with applicable privacy, ethical, and licensing standards with particular attention to excluding sensitive or identifiable content such as personal data, protected imagery, or content that may disproportionately affect protected groups.

Our dataset governance framework incorporates risk controls that align with the data management expectations outlined in Article 10 of the EU AI Act, particularly in regard to transparency, licensing integrity, and downstream traceability.

Importantly, Ultralytics YOLO models are released as open-source vision AI frameworks and may be adapted, fine-tuned, or deployed across a wide range of domains. Accordingly, deploying entities are responsible for evaluating model behavior and performance within their specific context and for conducting a use-case-specific risk assessment where required, particularly where high-risk use cases are implicated (as outlined in Annex III of the EU AI Act).

Ultralytics collects only anonymous information from open-source users for performance monitoring and usage analytics. We ensure that this data remains anonymized and is used solely to improve our tools. For hosted services, we follow strict data privacy practices, clearly outlined in our privacy policy, and maintain transparency on all data usage.

Ultralytics maintains a formal incident response process supported by continuous monitoring. In the event of a service disruption or security incident, we provide transparent and timely updates via our public status page, where users can subscribe to receive real-time notifications.

Enterprise customers get dedicated support and custom SLAs, legal protections for datasets and model training, and the flexibility to deploy on your infrastructure or ours. See Ultralytics License for details.

When using Ultralytics YOLO models outside of the Ultralytics Platform, data is stored and processed entirely within customer-managed environments. Because the customer is responsible for deploying and operating the models, Ultralytics does not process or store inference data, ensuring customers retain full control over their data and governance.

The Ultralytics Platform runs on multi-region infrastructure with EU, US, and APAC data residency options for datasets and model content data. Data handling, processing, and retention practices are documented in the Data Processing Agreement (DPA).