Is Perplexity AI Safe?

Is Perplexity AI Safe?

"Safe" is doing a lot of work in that question, and it is worth separating the strands before answering it.

There is whether the company will keep what you type, whether anyone can take it from them, and whether the thing running on your own machine can be turned against you by a web page it reads.

Perplexity publishes enough on its own pages to answer all three, and the answers are not the same. One is reassuring, one is a trade you can decide for yourself, and one is an open problem that Perplexity itself describes as unsolved.

Is Perplexity AI Safe? The Short Answer

For reading and researching, yes, with one setting you should change. For anything confidential, the answer depends entirely on which plan you are on, and the gap between plans is wider than the marketing suggests.

Business customers get an unconditional commitment. Perplexity's help center states that "Enterprise data is never used to train or fine-tune Perplexity's models," and its data processing addendum puts the same promise in contract language: "Personal Data will not be used for training of Perplexity's large language models."

Consumers get the opposite default. The control is called AI Data Retention, it lives under Preferences in account settings, and Perplexity's own documentation says it "is enabled by default" for Free, Pro and Max.

The part worth knowing before you go looking for it: switching it off is not retroactive. Perplexity states that "opt-outs only apply to data collected after the opt-out date" and that "previously collected training data cannot be deleted or removed."

So Perplexity is about as safe as its peers on the ordinary things, more candid than most about its limits, and less safe than it looks if you are on a consumer plan and have never opened the settings.

Curious whether AI answer engines are citing your site at all? Get a free audit and find out where you stand.

What Happens to What You Type

The Toggle, and Where to Find It

The one action that changes your position is a single switch. Perplexity's help center describes it plainly: some data "may be used to train AI models and improve search quality, unless you opt out through Account Settings," and the instruction is to "toggle off to opt out of AI training data collection."

Turning it off does not break anything. Perplexity says "core Perplexity features remain fully functional," which is useful to have in writing, since the usual fear about privacy toggles is that they quietly degrade the product.

Read the next sentence carefully, though. Perplexity adds that data "may still be processed for service operation, legal compliance, and product improvement." The opt-out covers AI training data collection specifically, not all product improvement, and those are not the same scope.

One oddity to be aware of while you look for it: Perplexity's own help center currently uses two names for this control. The newer article calls it AI Data Retention; an older one tells you to find an "AI Data Usage toggle under Settings." Expect either label.

The Privacy Policy Does Not Mention It

Here is the finding that does most to explain why this question keeps getting asked. Perplexity's consumer privacy policy, last updated October 23, 2026, never names the opt-out and does not use the word "training" for consumer data. Under how data is used it says only that Perplexity may "improve or create services and products, including our AI models."

The only unconditional no-training promise in that document covers one feature: "we do not use the content of emails to create, train, improve, or fine-tune AI models."

That is a real gap between the binding agreement and the help article. The control exists and is documented, but it lives in support content rather than in the contract, which makes it a product decision rather than a commitment.

What Is Promised About Other Companies' Models

Perplexity runs on models from third parties, and here the commitment is stronger than you might assume: its help center says its agreements with those providers "prohibit using Perplexity data for training their models." Do not let the two promises blur together, though. That is a statement about what OpenAI, Anthropic and the rest may do with your data, not about what Perplexity may do with it.

The Enterprise Gap: What Business Customers Get That You Do Not

Setting the two tiers side by side is the clearest way to see what you are actually buying.

• Training on your data: Enterprise is never used for it, by contract. Consumer tiers are opted in by default and the opt-out is not retroactive.
• Zero data retention: documented for eligible Enterprise and API accounts "through an account-level configuration under a written agreement," with no equivalent option published for Free, Pro or Max.
• Default on the API: Perplexity states that "under the API Terms of Service, Perplexity does not use Customer Content to train generative AI models." The API gets by default what the consumer app asks you to switch off by hand.
• Configurable retention and audit logging: available to Enterprise organizations at 50 or more seats, or with at least one Enterprise Max seat.
• Published thread retention: Perplexity publishes numbers for uploaded files, incognito sessions and account deletion, and no retention period at all for an ordinary consumer thread.
• Legal footing: the consumer privacy policy explicitly "does not apply to data collected through Perplexity's Enterprise and API offerings," which are governed by the addendum instead.

Two details deserve emphasis. On zero data retention, Perplexity's developer documentation is unusually direct about the default, telling customers not to "assume that Perplexity or its model providers apply zero data retention" when it has not been enabled. And the protection does not travel with you: if an organization downgrades to a non-enterprise plan, the standard consumer policy applies with AI Data Retention enabled by default, and users have to opt out by hand again.

Want to know which of your pages AI search engines are actually reading? Request a free audit.

How to Lock Down Your Own Account, Step by Step

1. Open account settings and find Preferences. Turn AI Data Retention off, or the AI Data Usage toggle if that is the label you see.
2. Accept that the switch is forward-looking only. Anything already collected for training stays collected, by Perplexity's own statement, so treat the date you flip it as the start of the clean period.
3. Decide what never gets typed in at all. This is the control that actually works, and on a consumer plan it is the only one that covers the past as well as the future.
4. Use incognito for anything you do not want in your history, and read the next section on what it does and does not do.
5. Delete what you no longer need. Perplexity documents a "delete all sessions" action in History, and individual sessions, Projects and Pages can be deleted one at a time. None of it is reversible.
6. If you need the whole account gone, request deletion and expect a wait. Perplexity states that account data "will be removed from our servers within 30 days," and that signing in afterward creates a new, empty account with no restored data.
7. If this is work data, stop and check the plan. On the evidence above, the plan you are on matters more than any setting you can reach.

Incognito Is Not What Most People Assume

Perplexity deserves credit for how bluntly it describes this. Its privacy policy says incognito "increases your privacy by not saving your search activity across use sessions," then adds: "if you use incognito mode, note that we, and third parties like the websites that you visit, may still be able to track you."

So incognito is a control over who can see your history on a shared device, not a control over what reaches Perplexity. The company says so itself. Sessions expire within 24 hours and are not recoverable, and in Comet, closing an incognito window clears local history, cookies and form data while downloaded files, bookmarks and changed site permissions remain. Enterprise administrators can enforce incognito across an organization; individuals cannot.

Comet Is the Part That Deserves Real Caution

If there is a reason to be careful with Perplexity, it is not the search box. It is the agentic browser, and the evidence here is public, specific, and comes from named researchers rather than from speculation.

In August 2025, Brave's security team published research on indirect prompt injection in Comet, describing a browser that "feeds a part of the webpage directly to its LLM without distinguishing between the user's instructions." The consequence, in their words, is that attackers can "embed indirect prompt injection payloads that the AI will execute as commands." Brave followed it in October 2025 with a second class of attack using instructions hidden in images as nearly invisible text.

Other researchers found adjacent problems. Hacktron reported a cross-site scripting path to full agent takeover in August 2025, which Perplexity hot-patched inside 24 hours and paid a bounty for. Zenity Labs published research in March 2026 describing a calendar invite that could steer the agent into a connected password manager, which Perplexity mitigated and which the password manager vendor concluded was not a flaw in its own product.

Perplexity has responded publicly rather than ignoring it. Its October 2025 post describes classifier checks on retrieved content, prompts that label external content as untrusted, and user confirmation before sensitive actions, reasoning that "even if one defense is circumvented, multiple additional safeguards remain to protect users."

The sentence to take away is Perplexity's own, and it is the most useful thing on the page: "malicious prompt injection remains an unsolved problem across the industry." Nobody involved claims this is fixed. Brave's own update says the first issue was still not fully mitigated when it published.

The practical reading is straightforward. Browsing and summarizing with Comet is a reasonable risk. Letting an agent operate a session that is already authenticated to your email, your calendar or your password vault is a different category of decision, and the published research is about exactly that case.

Want the same clarity about how AI tools treat your own website's content? Request a free audit.

Limitations: What Perplexity Does Not Publish

A fair answer has to include the questions the documentation does not settle.

There is no retention period published for ordinary consumer threads. Files, incognito sessions, account deletion and enterprise sessions all have numbers attached. A Pro user's search history does not, and the absence is the finding.

There is no documented data residency commitment at any tier that we could locate on Perplexity's own pages. Claims about regional hosting circulate on third-party vendor profiles; they are not on the privacy policy, the security page, the addendum or the developer documentation.

Deletion and training do not line up. Perplexity's deletion articles do not say that data already used for training is removed, and its own help center says previously collected training data cannot be removed. Read together, deleting your account clears your account, not the training set.

Partial erasure is not offered. Under its GDPR guidance, Perplexity states that erasure requests mean deleting the whole account, not specific sessions, projects or date ranges.

The certification claims are not all the same strength. Perplexity's security page carries a HIPAA badge while its own body text describes HIPAA-aligned safeguards, and its developer documentation lists a 2025 HIPAA gap assessment. An assessment is not a certification, and the weakest wording is the accurate one. The firmer claims are a SOC 2 Type II report and ISO/IEC 27001:2022, plus a FedRAMP 20x Class C authorization listed in October 2026 for the Enterprise and API platform, which does not extend to consumer plans.

The sub-processor list is hard to read. Both the addendum and the security page name a trust center as the authoritative source, and that page renders nothing without JavaScript.

On the Lawsuits, Briefly

Perplexity is a defendant in several active cases, and none should be presented as settled fact. News Corp's Dow Jones and the New York Post sued in October 2024 over alleged copying, and a court denied Perplexity's motion to dismiss and transfer, so the case continues. Encyclopaedia Britannica and Merriam-Webster sued in September 2025, including a claim about hallucinated text being attributed to them. Reddit sued in October 2025 alleging large-scale scraping through intermediaries. Separately, Cloudflare published research in August 2025 reporting what it called "stealth crawling behavior from Perplexity," and Perplexity answered the same day, attributing the traffic largely to a third-party cloud browser service and saying "the technical facts tell a different story."

These are allegations and contested findings, not rulings, and as of November 2026 none has produced a judgment on the merits. They go to the company's posture toward other people's data, not to the security of yours.

Perplexity vs the Other AI Answer Engines on Safety

Compared with its peers, Perplexity's position has a consistent shape: candid documentation, a consumer default that favors the company, and strong enterprise contracts.

On candor it does better than most. Writing down that incognito does not stop the company tracking you, that training data already collected cannot be removed, and that prompt injection is unsolved are three admissions many vendors omit.

On consumer defaults it does worse than you would hope. An on-by-default training setting the privacy policy does not mention, and that cannot be applied retroactively, is a weaker starting position than a documented off-by-default control.

On enterprise terms it is competitive, with a public addendum, standard contractual clauses for transfers, a no-training commitment in the contract, gated zero data retention and a recent government authorization.

On agentic risk nobody in this category is comfortable, and Perplexity is unusual mainly in having been tested in public more often, which is partly a consequence of shipping an agentic browser earlier than most.

Wondering how your own site shows up when these tools answer questions about your market? Start with a free audit.

Final Thoughts

Perplexity is safe enough to use, and the single most valuable thing in its documentation is the sentence that tells you it is not safe in the way you might have assumed.

Change AI Data Retention today if you are on a consumer plan, and understand that the change starts from today rather than reaching backward. If the material is confidential, the setting is not the control that matters; the plan is, because only the enterprise agreement carries a no-training promise you could hold anyone to.

Treat Comet as two different products. As a browser that reads and summarizes, it is fine. As an agent with standing access to your accounts, it is a live research area where the vendor itself says the problem is unsolved, and the sensible posture is to keep sensitive sessions out of its reach.

If you want the wider picture of what the tool does well before deciding how much of your work to put through it, our breakdown of Perplexity against ChatGPT covers the capability side of the same decision.

Quote the dates when you write any of this into a policy, because Perplexity's pages carry effective dates and they move. The posture described here is the one published as of November 13, 2026.