Upstage
- Rank
- Score
- 114/149
- 33 out of 100
Upstage is a South Korean artificial intelligence company founded in 2020 by Sung Kim, who previously led Naver's Clova team. It develops the Solar family of large language models, including open-weight Solar Open models, and document AI products that read and extract information from business documents.
Is Solar safe?
Solar scores 33 out of 100 and ranks 114 of 149. Its strongest category is Privacy, and its weakest category is Security.
How is Solar scored?
Solar is scored out of 100 on Safety (25%), Transparency (25%), Security (25%), and Privacy (25%). See how we score.
Safety framework
Average used24.4This outside rating doesn't cover this company, so the average of the companies it covers is used.
Pre-release testing
0Points for each confirmed yes.
- No
Was the model tested for dangerous capabilities, such as biological, chemical or cyber risks?
Company claim0/50huggingface.co (opens in a new tab) · 20 Oct 2026 - No
Did an outside organisation test the model before release?
Company claim0/50huggingface.co (opens in a new tab) · 20 Oct 2026
Safety test results
Average used74.1This outside rating doesn't cover this company, so the average of the companies it covers is used.
Incident record
Not enough dataProtecting children
50Points for each confirmed yes.
- No
Does the model card report child-safety tests or safeguards?
Company claim0/50huggingface.co (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy set a minimum age, or say the service is not directed at children?
Company claim50/50“The Company's services are not intended for individuals under the age of 18.”
upstage.ai privacy policy (opens in a new tab) · 20 Oct 2026
Model documentation
50Points for each confirmed yes.
- Yes
Does the model card describe what the model can do?
Company claim25/25“Solar Open 2 is a reasoning-capable model.”
huggingface.co (opens in a new tab) · 20 Oct 2026 - Yes
Does the model card report test results?
Company claim25/25“English Benchmarks” (results shown in a table on the source page)
huggingface.co (opens in a new tab) · 20 Oct 2026 - No
Does the model card state the model's limitations?
Company claim0/25huggingface.co (opens in a new tab) · 20 Oct 2026 - No
Does the model card describe safety safeguards?
Company claim0/25huggingface.co (opens in a new tab) · 20 Oct 2026
Training-data disclosure
Average used29.9This outside rating doesn't cover this company, so the average of the companies it covers is used.
Independent transparency index
Average used40.7This outside rating doesn't cover this company, so the average of the companies it covers is used.
Transparency reports
Average used25This outside rating doesn't cover this company, so the average of the companies it covers is used.
Public safety commitments
0Average of the commitments signed.
- No
Has it signed the EU code of practice for general-purpose AI?
Company claim0/100European Commission (opens in a new tab) · 14 Oct 2026 - No
Did it sign only the safety and security chapter?
Company claim0/50European Commission (opens in a new tab) · 14 Oct 2026 - No
Has it signed the Frontier AI Safety Commitments (Seoul 2024)?
Company claim0/100Frontier AI Safety Commitments (opens in a new tab) · 14 Oct 2026
No problems found in 1 public record. That is not proof.
Security programme and certifications
0Points for each confirmed yes.
- No
Is there a way to report security flaws, such as a bug bounty?
Company claim0/34No document found - No
Does it state it holds a SOC 2 Type II report?
Company claim0/33No document found - No
Does it state it holds ISO 27001 certification?
Company claim0/33No document found
Software vulnerabilities
70This check counts only when a source covers the company. With no events it holds the pillar, which is not proof of a clean record. Each recorded event takes points off the pillar, and serious or recent ones count most. Allegation checks, regulator actions and open investigations use half the severity load. Known-exploited flaws (CISA list) in the company's official software, last 24 months. A disclosed and fixed flaw does not lower the score.
No events
Independent sourceGitHub Advisory Database (opens in a new tab) · 12 Nov 2026
Data breaches
Not enough dataClear privacy policy
100Points for each confirmed yes.
- Yes
Does the privacy policy say what personal data is collected?
Company claim20/20“However, if you sign up without a password with Google OAuth, we collect email as a required field and password as an optional field.”
upstage.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy say whether your data is used to train AI?
Company claim20/20“※ User-input data is subject to personal information masking upon storage and may be used for AI model training.”
upstage.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy say how long data is kept?
Company claim20/20“If there is a remaining debt or credit relationship due to the service use until the settlement of the debt or credit relationship B. Provis…” MoreLess
“If there is a remaining debt or credit relationship due to the service use until the settlement of the debt or credit relationship B. Provision of goods or services: Until the completion of the supply of goods or services and the payment and settlement of fees C. Non-member services: Information collected through non-member services will be retained for one year and deleted thereafter in accordance with our Privacy Policy.”
upstage.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy say who your data is shared with?
Company claim20/20“The Company entrusts the following personal information processing tasks to external service providers for efficient personal information ma…” MoreLess
“The Company entrusts the following personal information processing tasks to external service providers for efficient personal information management.”
upstage.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy explain your privacy rights?
Company claim20/20“The right to request the disclosure of personal information and the right to request the correction, deletion, and suspension of processing…” MoreLess
“The right to request the disclosure of personal information and the right to request the correction, deletion, and suspension of processing may be limited by Article 35 (4) and Article 37 (2) of the Personal Information Protection Act.”
upstage.ai privacy policy (opens in a new tab) · 20 Oct 2026
Training-data defaults
0100 if training is opt-in only, 50 if you can opt out, 0 if neither.
- No
Is your data used for training only if you opt in?
Company claim0/100upstage.ai privacy policy (opens in a new tab) · 20 Oct 2026 - No
Can you stop your data being used for training?
Company claim0/50upstage.ai privacy policy (opens in a new tab) · 20 Oct 2026
Export and delete your data
100Points for each confirmed yes.
- Yes
Can you get a copy of your data?
Company claim50/50“If located in the EEA, the United Kingdom, or Switzerland, you have the following rights: Right of access (Article 15 of the GDPR) - To veri…” MoreLess
“If located in the EEA, the United Kingdom, or Switzerland, you have the following rights: Right of access (Article 15 of the GDPR) - To verify whether personal data has been processed and to request a copy Right of rectification (Article 16 of the GDPR) - To correct inaccurate or incomplete data Right of erasure (Article 17 of the GDPR) - To request the deletion of personal data under certain conditions Right to limit processing (Article 18 of the GDPR) - To limit processing under certain circumstances.”
upstage.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Can you delete your data?
Company claim50/50“However, if a non-member user requests deletion through a personal information access request, it will be deleted without delay.”
upstage.ai privacy policy (opens in a new tab) · 20 Oct 2026
Privacy fines
Not enough dataIndependent privacy ratings
Average used52.9This outside rating doesn't cover this company, so the average of the companies it covers is used.
Risk governance
Average used26.6This outside rating doesn't cover this company, so the average of the companies it covers is used.
Regulator actions
Not enough dataCourt judgments
Not enough dataPrivacy contact and complaints
100Points for each confirmed yes.
- Yes
Is there a privacy contact, such as an email or a data protection officer?
Company claim50/50“For inquiries about behavioral information, please contact the Personal Information Protection Officer (Tel: 070-8098-3023, Email: infosec@u…” MoreLess
“For inquiries about behavioral information, please contact the Personal Information Protection Officer (Tel: 070-8098-3023, Email: infosec@upstage.ai).”
upstage.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does it tell you that you can complain to a regulator?
Company claim50/50“Right to file a complaint (Article 77 of the GDPR) - To file a complaint with the relevant regional supervisory authority (UK: ICO, Switzerl…” MoreLess
“Right to file a complaint (Article 77 of the GDPR) - To file a complaint with the relevant regional supervisory authority (UK: ICO, Switzerland: FDPIC)”
upstage.ai privacy policy (opens in a new tab) · 20 Oct 2026
Score history
Newest first. Only days when the score changed are listed.
2 Nov 2026
Score 33
Method 2 Nov 2026
-10 · Method update
28 Oct 2026
Score 43
Method 28 Oct 2026, update 2
-2
23 Oct 2026
Score 45
Method 21 Oct 2026
+2
21 Oct 2026
Score 43
Method 21 Oct 2026
-2
20 Oct 2026
Score 45
Method Not recorded
+2
14 Oct 2026
Score 43
Method Not recorded
-