
SCB 10X
- Rank
- Score
- 77/149
- 40 out of 100
SCB 10X is the venture capital and innovation arm of SCBX, the Thai financial technology group. Its Typhoon team builds large language models and multimodal models optimized for the Thai language, with open model weights on Hugging Face. Typhoon2.5 models are Thai instruct models based on Qwen3 with a 256K context length.
Is Typhoon safe?
Typhoon scores 40 out of 100 and ranks 77 of 149. Its strongest category is Privacy, and its weakest category is Safety.
How is Typhoon scored?
Typhoon is scored out of 100 on Safety (25%), Transparency (25%), Security (25%), and Privacy (25%). See how we score.
Safety framework
Average used24.4This outside rating doesn't cover this company, so the average of the companies it covers is used.
Pre-release testing
0Points for each confirmed yes.
- No
Was the model tested for dangerous capabilities, such as biological, chemical or cyber risks?
Company claim0/50huggingface.co (opens in a new tab) · 20 Oct 2026 - No
Did an outside organisation test the model before release?
Company claim0/50huggingface.co (opens in a new tab) · 20 Oct 2026
Safety test results
Average used74.1This outside rating doesn't cover this company, so the average of the companies it covers is used.
Incident record
Not enough dataProtecting children
0Points for each confirmed yes.
- No
Does the model card report child-safety tests or safeguards?
Company claim0/50huggingface.co (opens in a new tab) · 20 Oct 2026 - No
Does the privacy policy set a minimum age, or say the service is not directed at children?
Company claim0/50opentyphoon.ai privacy policy (opens in a new tab) · 20 Oct 2026
Model documentation
75Points for each confirmed yes.
- Yes
Does the model card describe what the model can do?
Company claim25/25“Typhoon2.5-Qwen3-30B-A3B is a instruct Thai 🇹🇭 large language model with 3 billion active parameters, a 256k context length, and function-…” MoreLess
“Typhoon2.5-Qwen3-30B-A3B is a instruct Thai 🇹🇭 large language model with 3 billion active parameters, a 256k context length, and function-calling capabilities.”
huggingface.co (opens in a new tab) · 20 Oct 2026 - Yes
Does the model card report test results?
Company claim25/25“Performance” (results shown as an image on the source page)
huggingface.co (opens in a new tab) · 20 Oct 2026 - Yes
Does the model card state the model's limitations?
Company claim25/25“It incorporates some level of guardrails, but it still may produce answers that are inaccurate, biased, or otherwise objectionable in respon…” MoreLess
“It incorporates some level of guardrails, but it still may produce answers that are inaccurate, biased, or otherwise objectionable in response to user prompts.”
huggingface.co (opens in a new tab) · 20 Oct 2026 - No
Does the model card describe safety safeguards?
Company claim0/25huggingface.co (opens in a new tab) · 20 Oct 2026
Training-data disclosure
Average used29.9This outside rating doesn't cover this company, so the average of the companies it covers is used.
Independent transparency index
Average used40.7This outside rating doesn't cover this company, so the average of the companies it covers is used.
Transparency reports
Average used25This outside rating doesn't cover this company, so the average of the companies it covers is used.
Public safety commitments
0Average of the commitments signed.
- No
Has it signed the EU code of practice for general-purpose AI?
Company claim0/100European Commission (opens in a new tab) · 14 Oct 2026 - No
Did it sign only the safety and security chapter?
Company claim0/50European Commission (opens in a new tab) · 14 Oct 2026 - No
Has it signed the Frontier AI Safety Commitments (Seoul 2024)?
Company claim0/100Frontier AI Safety Commitments (opens in a new tab) · 14 Oct 2026
Security programme and certifications
34Points for each confirmed yes.
- Yes
Is there a way to report security flaws, such as a bug bounty?
Company claim34/34“Customers, users, researchers, partners and any other person that interacts with SCB 10X’s products and services are encouraged to report id…” MoreLess
“Customers, users, researchers, partners and any other person that interacts with SCB 10X’s products and services are encouraged to report identified vulnerabilities and errors by using the form present on the Vulnerability Disclosure Policy platform.”
scb10x.com (opens in a new tab) · 20 Oct 2026 - No
Does it state it holds a SOC 2 Type II report?
Company claim0/33No document found - No
Does it state it holds ISO 27001 certification?
Company claim0/33No document found
Software vulnerabilities
Not enough dataData breaches
Not enough dataNo problems found in 1 public record. That is not proof.
Clear privacy policy
100Points for each confirmed yes.
- Yes
Does the privacy policy say what personal data is collected?
Company claim20/20“Contact details • Mailing address • E-mail address • Phone number • Mobile number”
opentyphoon.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy say whether your data is used to train AI?
Company claim20/20“To train and evaluate Model during the pre-training and fine-tuning phases, we collect and compile publicly available online datasets extrac…” MoreLess
“To train and evaluate Model during the pre-training and fine-tuning phases, we collect and compile publicly available online datasets extracted from unrestricted public internet. These public databases may incidentally reflect certain personal information originally posted online.”
opentyphoon.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy say how long data is kept?
Company claim20/20“We will maintain and keep your personal data for a period of time that is appropriate and necessary for each type of personal data and for t…” MoreLess
“We will maintain and keep your personal data for a period of time that is appropriate and necessary for each type of personal data and for the purposes as specified by the PDPA.”
opentyphoon.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy say who your data is shared with?
Company claim20/20“We may disclose your personal data to the following parties under the provisions of the PDPA: companies in SCBX Group, business partners and…” MoreLess
“We may disclose your personal data to the following parties under the provisions of the PDPA: companies in SCBX Group, business partners and/or other persons that we have the legal relationship, including our directors, executives, employees, staffs, contractors, representatives, advisors and/or such persons’ directors, executives, employees, staffs, contractors, representatives, advisors; governmental authorities and/or supervisory or regulatory authorities (e.g. the Bank of Thailand, Ministry of Digital Economy and Society, Thai Revenue Department); suppliers, agents and other entities (e.g. professional associations to which we are member, external auditors, depositories, document warehouses, overseas financial institutions, clearing houses, shareholder registrar, shareholder representatives) where the disclosure of your personal data has a specific purpose and under lawful basis, as well as appropriate security measures; any relevant persons as a result of activities relating to selling rights of claims and/or assets, restructuring or acquisition of any of our entities, where we may transfer their rights to; any persons with whom we are required to share data for a proposed sale, reorganization, transfer, financial arrangement, asset disposal or other transaction relating to our business and/or assets held by our business; other banks, financial institutions and third parties where required by law; lawyers, fraud prevention agencies, courts, authorities or any persons whom we are required or permitted by laws, regulations, or orders to share personal data; third parties providing services to us (e.g. IT service providers, market analysis and benchmarking service providers, cloud computing service providers, agents, subcontractors acting on our behalf); social media service providers (in a secure format) or other third-party advertisers so they can display relevant messages to you and others; other persons that provide you with relevant benefits or services; and/or your attorney, sub-attorney, authorized persons or legal representatives who have lawfully authorized power.”
opentyphoon.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy explain your privacy rights?
Company claim20/20“You have the right to access and obtain copy of your personal data holding by us, unless we are entitled to reject your request under the la…” MoreLess
“You have the right to access and obtain copy of your personal data holding by us, unless we are entitled to reject your request under the laws or court orders, or if such request will adversely affect the rights and freedoms of other individuals.”
opentyphoon.ai privacy policy (opens in a new tab) · 20 Oct 2026
Training-data defaults
0100 if training is opt-in only, 50 if you can opt out, 0 if neither.
- No
Is your data used for training only if you opt in?
Company claim0/100opentyphoon.ai privacy policy (opens in a new tab) · 20 Oct 2026 - No
Can you stop your data being used for training?
Company claim0/50opentyphoon.ai privacy policy (opens in a new tab) · 20 Oct 2026
Export and delete your data
100Points for each confirmed yes.
- Yes
Can you get a copy of your data?
Company claim50/50“You have the right to access and obtain copy of your personal data holding by us, unless we are entitled to reject your request under the la…” MoreLess
“You have the right to access and obtain copy of your personal data holding by us, unless we are entitled to reject your request under the laws or court orders, or if such request will adversely affect the rights and freedoms of other individuals.”
opentyphoon.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Can you delete your data?
Company claim50/50“You have the right to request us to delete, destroy or anonymize your personal data, unless there are certain circumstances where we have th…” MoreLess
“You have the right to request us to delete, destroy or anonymize your personal data, unless there are certain circumstances where we have the legal grounds to reject your request.”
opentyphoon.ai privacy policy (opens in a new tab) · 20 Oct 2026
Privacy fines
Not enough dataIndependent privacy ratings
Average used52.9This outside rating doesn't cover this company, so the average of the companies it covers is used.
Risk governance
Average used26.6This outside rating doesn't cover this company, so the average of the companies it covers is used.
Regulator actions
70This check counts only when a source covers the company. With no events it holds the pillar, which is not proof of a clean record. Each recorded event takes points off the pillar, and serious or recent ones count most. Allegation checks, regulator actions and open investigations use half the severity load. UK competition regulator cases, US Justice Department settlements, last 5 years, and regulator actions and open investigations into the company's AI products at half severity, last 3 years.
No events
RegulatorUS Justice Department (opens in a new tab) · 12 Nov 2026
Court judgments
Not enough dataPrivacy contact and complaints
100Points for each confirmed yes.
- Yes
Is there a privacy contact, such as an email or a data protection officer?
Company claim50/50“If you have any questions or would like more details about our privacy notice, please contact us through the following channels: SCB DataX C…” MoreLess
“If you have any questions or would like more details about our privacy notice, please contact us through the following channels: SCB DataX Co., Ltd., our head office located at 18 Rutchadapisek Road, Chatuchak, Chatuchak, Bangkok 10900. our Data Protection Officer by writing to E-mail: dpo@data-x.ai or our address as specified above.”
opentyphoon.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does it tell you that you can complain to a regulator?
Company claim50/50“You have the right to make a complaint with the Personal Data Protection Committee or their office in the event that we do not comply with t…” MoreLess
“You have the right to make a complaint with the Personal Data Protection Committee or their office in the event that we do not comply with the PDPA.”
opentyphoon.ai privacy policy (opens in a new tab) · 20 Oct 2026
Score history
Newest first. Only days when the score changed are listed.
2 Nov 2026
Score 40
Method 2 Nov 2026
+1
28 Oct 2026
Score 39
Method 28 Oct 2026, update 2
-1
23 Oct 2026
Score 40
Method 21 Oct 2026
+2
21 Oct 2026
Score 38
Method 21 Oct 2026
-2
20 Oct 2026
Score 40
Method Not recorded
+2
14 Oct 2026
Score 38
Method Not recorded
-