Is crewAI safe with your data?

Trains on customer data with no opt-out

Terms of Use section 1.5 licenses CrewAI to use uploaded Customer Data and Outputs to "improve and develop products and services, including by training and developing models and/or algorithms" with no opt-out anywhere in the text. The only no-training promise covers Google user data alone.

Concrete commitments are Google-scoped

The 30-day post-unlinking deletion, the 5-business-day deletion confirmation and the minimum-scopes pledge all sit inside the Google Account section, so platform-wide retention, access, portability and correction rights remain unstated.

Rights framework largely silent

No access, portability or correction right appears in the global policy, there is no sub-processor list or DPA reference, no named international transfer safeguard, no legal-bases mapping and no breach-notification commitment.

Security named but unquantified

Encryption in transit and at rest plus role-based access controls are named under an "industry-standard" framing, with no cipher, protocol, certification or audit named anywhere in either document.