Vendors · Questionnaire · StepFun
Read StepFun’s own answers to nine buyer questions
StepFun Open Platform, international site. Each answer quotes StepFun’s own page or feed as kept on the day shown. Each question cites the NIST text that asks it. The answers are not a score and not a verdict.
Q1
Does the vendor train its models on business and API customers’ data?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
May train: the terms license prompts, outputs and API call logs to StepFun for any purpose
When you use the Services in accordance with these Terms, you grant us, to the fullest extent permitted under the applicable law, a nonexclusive, worldwide, royalty-free, fully paid up, transferable, sublicensable, perpetual, irrevocable license to copy, display, upload, perform, distribute, transmit, make available, store, access, modify, exploit, commercialize and otherwise use all Output, Prompts and associated API call logs (“Usage Data”) elicited by you for any purpose in any form, medium or technology now known or later developed, including but not limited to (i) facilitating other users’ ability to elicit Output, and (ii) promoting the Services.
The terms also say the Services “MAY BE IMPROVED THROUGH THE USE OF USAGE DATA FOR MODEL TRAINING AND FINE-TUNING”. For the StepFun Startup Program and other early access programs, the license “specifically includes the right to use Usage Data for training, fine-tuning, and otherwise improving StepFun’s artificial intelligence models and systems.” Terms of Service, kept 4 Nov 2026 · sha256 ba64e4507c3f
Q2
Does the vendor train its models on free and consumer use of its products?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
Not read
The vendor record does not read this point for StepFun.
Q3
How long does the vendor keep the data that customers send?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
Customer Data is deleted within 30 days after the agreement ends, with exceptions
Within 30 days of termination or expiration of the Agreement, StepFun will:
StepFun will “delete all copies of Customer Data, including Customer Personal Data, processed by StepFun or any subprocessors”, except where law requires storage, to resolve a dispute, or “to combat harmful use of the Services”. The terms also give StepFun a perpetual, irrevocable license to store and use prompts, outputs and API call logs. For its Startup Program and other early access programs, the privacy policy says StepFun may use and retain such data as a controller. Data Processing Agreement, kept 4 Nov 2026 · sha256 4f6547754c82
Q4
Can a customer have the vendor keep none of its data?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
Not published in the pages kept
Searched: User Privacy; Terms of Service; Data Processing Agreement; Pricing and rate limits.
Q5
Where does the vendor process and store customer data?
NIST AI 600-1, action GV-6.1-009: “Update and integrate due diligence processes for GAI acquisition and procurement vendor assessments to include intellectual property, data privacy …”
NIST AI RMF 1.0, GOVERN 6.1
Privacy policy: servers in the United States; affiliates and providers elsewhere may access data
Our servers are located in the United States. Meanwhile, due to the international nature of our business, your personal information may also be accessed by our affiliates or be transferred to third-party service providers and business partners, in connection with the purposes set out in this Policy.
The sentence is about personal information. The policy “does not apply when we act as a data processor” for commercial customers, and the DPA names no processing location for Customer Data. User Privacy, kept 4 Nov 2026 · sha256 cb0c3efb4fe3
Q6
Which other companies process customer data for the vendor?
NIST AI 600-1, action GV-6.1-007: “Inventory all third-party entities with access to organizational content and establish approved GAI technology and service provider lists.”
NIST AI RMF 1.0, GOVERN 6.1; NIST AI RMF 1.0, MANAGE 3.1
The customer gives StepFun general authorization to engage subprocessors
Customer grants StepFun general authorization to engage subprocessors.
StepFun will put a contract with each subprocessor and will “remain liable to Customer, subject to the liability limitations in the Agreement, for each subprocessor’s acts and omissions”. Data Processing Agreement, kept 4 Nov 2026 · sha256 4f6547754c82
Q7
Which independent audits or certifications does the vendor name?
NIST AI 600-1, Appendix A.1.3: “statement on standards for attestation engagement (SSAE) reports to help with third-party transparency and risk management for GAI systems”
NIST AI RMF 1.0, GOVERN 6.1
Not published in the pages kept
Searched: User Privacy; Terms of Service; Data Processing Agreement; Pricing and rate limits.
Q8
Does the vendor publish a history of its service incidents?
NIST AI 600-1, action GV-6.2-007: “Service Level Agreements (SLAs) in vendor contracts that address incident response, response times, and availability of critical support.”
NIST AI RMF 1.0, GOVERN 6.2
No answer kept
StepFun links no status page; status.stepfun.ai did not resolve on 2026-11-04. The page.
Q9
Does the vendor publish the dates on which it retires its models?
NIST AI 600-1, action GV-6.2-007: “Review vendor contracts and avoid arbitrary or capricious termination of critical GAI technologies or vendor services …”
NIST AI RMF 1.0, GOVERN 6.2
Not read
This site reads no retirement page for StepFun.
- StepFun, Terms of Service, kept 4 Nov 2026.
- StepFun, Data Processing Agreement, kept 4 Nov 2026.
- StepFun, User Privacy, kept 4 Nov 2026.
- NIST, NIST AI 600-1, 2024-07. Republished courtesy of the National Institute of Standards and Technology.