Tripo
- Rank
- Score
- 80/149
- 40 out of 100
Tripo is an AI 3D model generator that turns text and images into 3D models, operated by Holymolly Limited. Its research team, VAST AI Research, released TripoSG, an image-to-3D foundation model that uses large-scale rectified flow transformers with 1.5B parameters to produce high-fidelity 3D shapes from single images.
Is Tripo safe?
Tripo scores 40 out of 100 and ranks 80 of 149. Its strongest category is Privacy, and its weakest category is Transparency.
How is Tripo scored?
Tripo is scored out of 100 on Safety (25%), Transparency (25%), Security (25%), and Privacy (25%). See how we score.
Safety framework
Average used24.4This outside rating doesn't cover this company, so the average of the companies it covers is used.
Pre-release testing
0Points for each confirmed yes.
- No
Was the model tested for dangerous capabilities, such as biological, chemical or cyber risks?
Company claim0/50huggingface.co (opens in a new tab) · 20 Oct 2026 - No
Did an outside organisation test the model before release?
Company claim0/50huggingface.co (opens in a new tab) · 20 Oct 2026
Safety test results
Average used74.1This outside rating doesn't cover this company, so the average of the companies it covers is used.
Incident record
Not enough dataProtecting children
50Points for each confirmed yes.
- No
Does the model card report child-safety tests or safeguards?
Company claim0/50huggingface.co (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy set a minimum age, or say the service is not directed at children?
Company claim50/50“The Service is not directed to children under 13, or any higher minimum age stated under “Additional Information for Certain Users” or requi…” MoreLess
“The Service is not directed to children under 13, or any higher minimum age stated under “Additional Information for Certain Users” or required by applicable law.”
tripo3d.ai privacy policy (opens in a new tab) · 20 Oct 2026
Model documentation
25Points for each confirmed yes.
- Yes
Does the model card describe what the model can do?
Company claim25/25“TripoSG is a state-of-the-art image-to-3D generation foundation model that leverages large-scale rectified flow transformers to produce high…” MoreLess
“TripoSG is a state-of-the-art image-to-3D generation foundation model that leverages large-scale rectified flow transformers to produce high-fidelity 3D shapes from single images.”
huggingface.co (opens in a new tab) · 20 Oct 2026 - No
Does the model card report test results?
Company claim0/25huggingface.co (opens in a new tab) · 20 Oct 2026 - No
Does the model card state the model's limitations?
Company claim0/25huggingface.co (opens in a new tab) · 20 Oct 2026 - No
Does the model card describe safety safeguards?
Company claim0/25huggingface.co (opens in a new tab) · 20 Oct 2026
Training-data disclosure
Average used29.9This outside rating doesn't cover this company, so the average of the companies it covers is used.
Independent transparency index
Average used40.7This outside rating doesn't cover this company, so the average of the companies it covers is used.
Transparency reports
Average used25This outside rating doesn't cover this company, so the average of the companies it covers is used.
Public safety commitments
0Average of the commitments signed.
- No
Has it signed the EU code of practice for general-purpose AI?
Company claim0/100European Commission (opens in a new tab) · 14 Oct 2026 - No
Did it sign only the safety and security chapter?
Company claim0/50European Commission (opens in a new tab) · 14 Oct 2026 - No
Has it signed the Frontier AI Safety Commitments (Seoul 2024)?
Company claim0/100Frontier AI Safety Commitments (opens in a new tab) · 14 Oct 2026
Security programme and certifications
33Points for each confirmed yes.
- No
Is there a way to report security flaws, such as a bug bounty?
Company claim0/34No document found - No
Does it state it holds a SOC 2 Type II report?
Company claim0/33tripo3d.ai (opens in a new tab) · 12 Nov 2026 - Yes
Does it state it holds ISO 27001 certification?
Company claim33/33“ISO/IEC 27001: 2022 certified information security”
tripo3d.ai (opens in a new tab) · 12 Nov 2026
Software vulnerabilities
Not enough dataData breaches
Not enough dataNo problems found in 1 public record. That is not proof.
Clear privacy policy
100Points for each confirmed yes.
- Yes
Does the privacy policy say what personal data is collected?
Company claim20/20“Depending on how you use the Service, information you provide may include: Contact and Account Data: Your name, email address, username, aut…” MoreLess
“Depending on how you use the Service, information you provide may include: Contact and Account Data: Your name, email address, username, authentication information and other contact details.”
tripo3d.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy say whether your data is used to train AI?
Company claim20/20“We do not use personal information to train our models.”
tripo3d.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy say how long data is kept?
Company claim20/20“We retain saved Inputs and Outputs, including conversation history, so that you can return to conversations, continue tasks and work on asse…” MoreLess
“We retain saved Inputs and Outputs, including conversation history, so that you can return to conversations, continue tasks and work on assets, and delete them when the conversation, relevant asset or account is deleted, subject to applicable law and our deletion process.”
tripo3d.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy say who your data is shared with?
Company claim20/20“Service Providers: Vendors that perform services for us, such as technology operations, email delivery, customer support, security and analy…” MoreLess
“Service Providers: Vendors that perform services for us, such as technology operations, email delivery, customer support, security and analytics.”
tripo3d.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy explain your privacy rights?
Company claim20/20“Access and Update: Update available account details or ask whether we hold personal information about you and request access to it.”
tripo3d.ai privacy policy (opens in a new tab) · 20 Oct 2026
Training-data defaults
0100 if training is opt-in only, 50 if you can opt out, 0 if neither.
- No
Is your data used for training only if you opt in?
Company claim0/100tripo3d.ai privacy policy (opens in a new tab) · 20 Oct 2026 - No
Can you stop your data being used for training?
Company claim0/50tripo3d.ai privacy policy (opens in a new tab) · 20 Oct 2026
Export and delete your data
100Points for each confirmed yes.
- Yes
Can you get a copy of your data?
Company claim50/50“Subject to applicable conditions and exemptions, you may request access to, correction or deletion of personal data; request restriction of…” MoreLess
“Subject to applicable conditions and exemptions, you may request access to, correction or deletion of personal data; request restriction of processing; object to processing; receive certain personal data in a portable format; and withdraw consent at any time, without affecting the lawfulness of prior processing.”
tripo3d.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Can you delete your data?
Company claim50/50“Deletion: Ask us to delete your account or personal information, subject to applicable law.”
tripo3d.ai privacy policy (opens in a new tab) · 20 Oct 2026
Privacy fines
Not enough dataIndependent privacy ratings
Average used52.9This outside rating doesn't cover this company, so the average of the companies it covers is used.
Risk governance
Average used26.6This outside rating doesn't cover this company, so the average of the companies it covers is used.
Regulator actions
70This check counts only when a source covers the company. With no events it holds the pillar, which is not proof of a clean record. Each recorded event takes points off the pillar, and serious or recent ones count most. Allegation checks, regulator actions and open investigations use half the severity load. UK competition regulator cases, US Justice Department settlements, last 5 years, and regulator actions and open investigations into the company's AI products at half severity, last 3 years.
No events
RegulatorUS Justice Department (opens in a new tab) · 12 Nov 2026
Court judgments
Not enough dataPrivacy contact and complaints
100Points for each confirmed yes.
- Yes
Is there a privacy contact, such as an email or a data protection officer?
Company claim50/50“If you have questions or concerns about this Privacy Policy or wish to exercise a privacy right, contact Holymolly Limited at privacy@tripo3…” MoreLess
“If you have questions or concerns about this Privacy Policy or wish to exercise a privacy right, contact Holymolly Limited at privacy@tripo3d.ai.”
tripo3d.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does it tell you that you can complain to a regulator?
Company claim50/50“You may also lodge a complaint with the Information Commissioner’s Office in the United Kingdom or with the competent supervisory authority…” MoreLess
“You may also lodge a complaint with the Information Commissioner’s Office in the United Kingdom or with the competent supervisory authority in the European Economic Area, including the authority where you live or work or where the alleged infringement occurred.”
tripo3d.ai privacy policy (opens in a new tab) · 20 Oct 2026
Score history
Newest first. Only days when the score changed are listed.
3 Nov 2026
Score 40
Method 3 Nov 2026
-3 · Method update
2 Nov 2026
Score 43
Method 2 Nov 2026
+1
28 Oct 2026
Score 42
Method 28 Oct 2026, update 2
-2
23 Oct 2026
Score 44
Method 21 Oct 2026
+2
21 Oct 2026
Score 42
Method 21 Oct 2026
-2
20 Oct 2026
Score 44
Method Not recorded
+10 · Reason not recorded
14 Oct 2026
Score 34
Method Not recorded
-