Alibaba
- Rank
- Score
- 52/149
- 47 out of 100
Alibaba is a Chinese technology company founded in 1999 by Jack Ma and based in Hangzhou. It is best known for its online shopping sites and its cloud business. Alibaba makes the Qwen family of AI models, many of them released openly, and the Qwen chat app.
Is Qwen safe?
Qwen scores 47 out of 100 and ranks 52 of 149. Its strongest category is Security, and its weakest category is Transparency.
How is Qwen scored?
Qwen is scored out of 100 on Safety (25%), Transparency (25%), Security (25%), and Privacy (25%). See how we score.
Compare
Outside evidence is stronger than its written policies.
Safety framework
Average used24.4This outside rating doesn't cover this company, so the average of the companies it covers is used.
Pre-release testing
0Points for each confirmed yes.
- No
Was the model tested for dangerous capabilities, such as biological, chemical or cyber risks?
Company claim0/50Qwen model card (opens in a new tab) · 15 Oct 2026 - No
Did an outside organisation test the model before release?
Company claim0/50Qwen model card (opens in a new tab) · 15 Oct 2026
Safety test results
72.1Average of three independent safety tests of the company's models: MLCommons AILuminate, Stanford HELM Safety and Stanford AIR-Bench. Each test is compared with the best company's result.
- 50
MLCommons AILuminate safety grades
Independent sourceMLCommons AILuminate (opens in a new tab) · 10 Nov 2026 - 94.1
Stanford HELM Safety mean score, averaged across the company's tested models: 92.1, against 97.9 for the top company of 13 tested
Independent sourcecrfm.stanford.edu (opens in a new tab) · 10 Nov 2026 - 72.2
Stanford AIR-Bench 2024 refusal rate, averaged across the company's tested models: 62.6, against 86.7 for the top company of 14 tested
Independent sourcecrfm.stanford.edu (opens in a new tab) · 10 Nov 2026
Incident record
62.8This check counts only when a source covers the company. With no events it holds the pillar, which is not proof of a clean record. Each recorded event takes points off the pillar, and serious or recent ones count most. Allegation checks, regulator actions and open investigations use half the severity load. AI Incident Database and AIAAIC Repository, last 24 months.
4 events
AllegationAI Incident Database (opens in a new tab) · 12 Nov 2026These are reports, not proven findings.
Date Event Severity 31 Jul 2025 AIID #1186 · Reported Public Exposure of Over 100,000 LLM Conversations via Share Links Indexed by Search Engines and Archived31 Jul 2025 · Medium (reported) Medium (reported) 10 Jul 2025 AIID #1220 · LAMEHUG Malware Reportedly Integrates Large Language Model for Real-Time Command Generation in a Purported APT28-Linked Cyberattack10 Jul 2025 · Medium (reported) Medium (reported) 1 Jul 2025 AIAAIC1974 · Top chatbots tricked into generating instructions on how to enrich uranium1 Jul 2025 · Low (reported) Low (reported) 17 Mar 2025 AIID #1001 · LLM Scrapers Allegedly Target Multiple Open Source Projects Disrupting the FOSS Ecosystem17 Mar 2025 · Low (reported) Low (reported)
Protecting children
50Points for each confirmed yes.
- No
Does the model card report child-safety tests or safeguards?
Company claim0/50Qwen model card (opens in a new tab) · 15 Oct 2026 - Yes
Does the privacy policy set a minimum age, or say the service is not directed at children?
Company claim50/50“The Alibaba Cloud Platform and the Cloud Services are not intended for minors (persons under the age of 18).”
Alibaba Cloud privacy policy (opens in a new tab) · 15 Oct 2026
Model documentation
25Points for each confirmed yes.
- Unverified
Does the model card describe what the model can do?
Company claim0/25Qwen model card (opens in a new tab) · 15 Oct 2026 - Yes
Does the model card report test results?
Company claim25/25“Benchmark Results” (results shown in a table on the source page)
Qwen model card (opens in a new tab) · 15 Oct 2026 - No
Does the model card state the model's limitations?
Company claim0/25Qwen model card (opens in a new tab) · 15 Oct 2026 - No
Does the model card describe safety safeguards?
Company claim0/25Qwen model card (opens in a new tab) · 15 Oct 2026
Training-data disclosure
15Average of two independent training-data checks: the Stanford index and an academic grading of EU AI Act training-data summaries.
- 15
Stanford Foundation Model Transparency Index: training-data indicators met
Independent sourceStanford FMTI (opens in a new tab) · 14 Oct 2026
Independent transparency index
26Stanford Foundation Model Transparency Index total, out of 100.
- 26
Transparency index score
Independent sourceStanford FMTI (opens in a new tab) · 14 Oct 2026
Transparency reports
025 points for each area where Partnership on AI names the company a leader in reporting on real-world impacts.
- 0
Partnership on AI practice-leader areas
Company claimPartnership on AI (opens in a new tab) · 10 Nov 2026
Public safety commitments
0Average of the commitments signed.
- No
Has it signed the EU code of practice for general-purpose AI?
Company claim0/100European Commission (opens in a new tab) · 14 Oct 2026 - No
Did it sign only the safety and security chapter?
Company claim0/50European Commission (opens in a new tab) · 14 Oct 2026 - No
Has it signed the Frontier AI Safety Commitments (Seoul 2024)?
Company claim0/100Frontier AI Safety Commitments (opens in a new tab) · 14 Oct 2026
No problems found in 2 public records. That is not proof.
Security programme and certifications
100Points for each confirmed yes.
- Yes
Is there a way to report security flaws, such as a bug bounty?
Company claim34/34“Alibaba VDP (vulnerability disclosure programme, no bounty)”
hackerone.com (opens in a new tab) · 2 Nov 2026 - Yes
Does it state it holds a SOC 2 Type II report?
Company claim33/33“Service Organization Controls - SOC 2 Type 2 Report”
Alibaba Cloud security page (opens in a new tab) · 22 Oct 2026 - Yes
Does it state it holds ISO 27001 certification?
Company claim33/33“ISO 27001”
Alibaba Cloud security page (opens in a new tab) · 22 Oct 2026
Software vulnerabilities
70This check counts only when a source covers the company. With no events it holds the pillar, which is not proof of a clean record. Each recorded event takes points off the pillar, and serious or recent ones count most. Allegation checks, regulator actions and open investigations use half the severity load. Known-exploited flaws (CISA list) in the company's official software, last 24 months. A disclosed and fixed flaw does not lower the score.
No events
Independent sourceGitHub Advisory Database (opens in a new tab) · 12 Nov 2026
Data breaches
70This check counts only when a source covers the company. With no events it holds the pillar, which is not proof of a clean record. Each recorded event takes points off the pillar, and serious or recent ones count most. Allegation checks, regulator actions and open investigations use half the severity load. Confirmed data breaches, last 36 months.
No events
Independent sourceHave I Been Pwned (opens in a new tab) · 12 Nov 2026
No problems found in 1 public record. That is not proof.
Clear privacy policy
80Points for each confirmed yes.
- Yes
Does the privacy policy say what personal data is collected?
Company claim20/20“If you are (i) an individual or (ii) a representative of a business organisation at the time you register to become a user of the Alibaba Cl…” MoreLess
“If you are (i) an individual or (ii) a representative of a business organisation at the time you register to become a user of the Alibaba Cloud Platform and/or purchase Cloud Services, you may be asked to complete registration forms which require you to provide information such as your email address, mobile number, country, preferred language, name, contact address, and screen nickname.”
Alibaba Cloud privacy policy (opens in a new tab) · 15 Oct 2026 - No
Does the privacy policy say whether your data is used to train AI?
Company claim0/20Alibaba Cloud privacy policy (opens in a new tab) · 15 Oct 2026 - Yes
Does the privacy policy say how long data is kept?
Company claim20/20“Unless we are obligated to preserve your personal information by applicable laws and regulations, we will retain and use your personal infor…” MoreLess
“Unless we are obligated to preserve your personal information by applicable laws and regulations, we will retain and use your personal information until your Alibaba Cloud account is deregistered.”
Alibaba Cloud privacy policy (opens in a new tab) · 15 Oct 2026 - Yes
Does the privacy policy say who your data is shared with?
Company claim20/20“When you make purchases of cloud services or transact online through the Alibaba Cloud Platform, Alibaba Cloud (Singapore) Private Limited,…” MoreLess
“When you make purchases of cloud services or transact online through the Alibaba Cloud Platform, Alibaba Cloud (Singapore) Private Limited, as the provider of the Alibaba Cloud Platform, may need to share your personal data provided in connection with the contracting process (including the identity information of the signatory, the email address and mobile phone number of the signatory, invoicing information and address, and other related information) with the Alibaba Cloud contracting entity applicable to you as listed in the Alibaba Cloud International Website Membership Agreement.”
Alibaba Cloud privacy policy (opens in a new tab) · 15 Oct 2026 - Yes
Does the privacy policy explain your privacy rights?
Company claim20/20“H. RIGHT TO ACCESS/CORRECT PERSONAL DATA; CONTACTING US You have the right to request access to your personal data held by us (or on our beh…” MoreLess
“H. RIGHT TO ACCESS/CORRECT PERSONAL DATA; CONTACTING US You have the right to request access to your personal data held by us (or on our behalf) and to request correction or deletion of such personal data.”
Alibaba Cloud privacy policy (opens in a new tab) · 15 Oct 2026
Training-data defaults
0100 if training is opt-in only, 50 if you can opt out, 0 if neither.
- No
Is your data used for training only if you opt in?
Company claim0/100Alibaba Cloud privacy policy (opens in a new tab) · 15 Oct 2026 - No
Can you stop your data being used for training?
Company claim0/50Alibaba Cloud privacy policy (opens in a new tab) · 15 Oct 2026
Export and delete your data
100Points for each confirmed yes.
- Yes
Can you get a copy of your data?
Company claim50/50“In addition to the above-discussed rights as provided under Part F of the Privacy Policy, You have the right to be informed of the processin…” MoreLess
“In addition to the above-discussed rights as provided under Part F of the Privacy Policy, You have the right to be informed of the processing of your personal data, the right to object to the processing of your personal data (in which case, you may have to cease using our services), and the right to be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data, and the right to obtain a copy of your personal data, which has been stored in electronic or structured format.”
Alibaba Cloud privacy policy (opens in a new tab) · 15 Oct 2026 - Yes
Can you delete your data?
Company claim50/50“You have the right to request access to your personal data held by us (or on our behalf) and to request correction or deletion of such perso…” MoreLess
“You have the right to request access to your personal data held by us (or on our behalf) and to request correction or deletion of such personal data.”
Alibaba Cloud privacy policy (opens in a new tab) · 15 Oct 2026
Privacy fines
Not enough dataIndependent privacy ratings
60.4Incogni's 2026 privacy-risk ranking: 100 is the lowest-risk platform rated, 0 the highest.
- 60.4
Incogni privacy-risk ranking
Independent sourceIncogni privacy ranking (opens in a new tab) · 10 Nov 2026
Risk governance
Average used26.6This outside rating doesn't cover this company, so the average of the companies it covers is used.
Regulator actions
70This check counts only when a source covers the company. With no events it holds the pillar, which is not proof of a clean record. Each recorded event takes points off the pillar, and serious or recent ones count most. Allegation checks, regulator actions and open investigations use half the severity load. UK competition regulator cases, US Justice Department settlements, last 5 years, and regulator actions and open investigations into the company's AI products at half severity, last 3 years.
No events
RegulatorUS Justice Department (opens in a new tab) · 12 Nov 2026
Court judgments
Not enough dataPrivacy contact and complaints
100Points for each confirmed yes.
- Yes
Is there a privacy contact, such as an email or a data protection officer?
Company claim50/50“To request removal of your personal data from our community forums, contact us at DPO_Intl@alibabacloud.com.”
Alibaba Cloud privacy policy (opens in a new tab) · 15 Oct 2026 - Yes
Does it tell you that you can complain to a regulator?
Company claim50/50“You may lodge a complaint with a supervisory authority if you consider that our processing of your personal data infringes applicable law.”
Alibaba Cloud privacy policy (opens in a new tab) · 15 Oct 2026
Score history
Newest first. Only days when the score changed are listed.
28 Oct 2026
Score 47
Method 28 Oct 2026, update 2
-7 · combines both 28 Oct updates (28 Oct 2026 - Update 1 and 28 Oct 2026 - Update 2)
23 Oct 2026
Score 54
Method 21 Oct 2026
+4 · Data fix
22 Oct 2026
Score 50
Method 21 Oct 2026
+1
21 Oct 2026
Score 49
Method 21 Oct 2026
-5 · Method update
19 Oct 2026
Score 54
Method Not recorded
-3 · Reason not recorded
15 Oct 2026
Score 57
Method Not recorded
+6 · Reason not recorded
14 Oct 2026
Score 51
Method Not recorded
-