Content Studio's SOC 2 and PCI DSS certifications belong to its cloud hosts, not the company itself

Content Studio, a social-media management platform, runs its infrastructure on Google Cloud and Hetzner. Its security page states that "ContentStudio utilizes Google Cloud and Hetzner as its primary data centers to host the ContentStudio Services, selected for their robust physical and technological security measures," and that "these facilities are compliant with international standards such as ISO 27017 for cloud security, ISO 27018 for cloud privacy, and are certified for SOC 1, SOC 2, and SOC 3, PCI DSS Level 1, among others," according to the page, retrieved Sept. 19.

Those are certifications held by the hosting providers, not by Content Studio itself; the company's own compliance-certification field carries no public information in AI Dispatch's index.

The company does describe testing it commissions directly. It says "both the web and mobile platforms of ContentStudio undergo rigorous annual penetration testing conducted by independent third parties to identify and rectify potential vulnerabilities," and that it "secures a Cloud App Security Assessment (CASA) from Google annually to ensure the application manages data securely and can adequately delete user data upon request."

On incident response, the company "commits to notifying affected customers promptly and without undue delay about any unauthorized disclosure of their Customer Content by ContentStudio or its agents, in compliance with legal requirements."

The security page does not mention insurance, an indemnification clause, a liability cap or an audit trail for the platform's own AI-generated content. The pattern echoes one AI Dispatch has documented in other vendors' security pages before: certifications belonging to infrastructure providers, cited alongside a company's own testing regime, without the company claiming any compliance certification in its own name.