Tiptap
Tiptap is a headless editor framework that enables developers to build content editing experiences like Notion in weeks instead of years. It combines an open-source core with 100+ extensions and paid features including real-time collaboration, AI agents, document conversion, and inline comments. Teams use Tiptap to create custom, production-ready editors with flexible UX while handling document storage, version control, and multi-user workflows.
Tiptap is a headless editor framework that lets development teams build custom rich-text editors with production-ready features in weeks rather than years. The open-source core supports 100+ extensions and integrates with paid platform features including real-time collaboration, AI agents, document conversion, and inline comments—enabling workflows similar to Notion or Google Docs. Teams can choose between self-hosted documents or Tiptap's secure cloud storage, with support for offline editing, live cursors, track changes, and DOCX/Markdown import-export. The AI Toolkit add-on enables developers to build AI agents that edit documents directly, including chatbots, proofreaders, and multi-document workflows with context-aware selections and streaming responses. Tiptap is enterprise-ready with SOC 2 Type II certification, GDPR compliance, EU hosting, and flexible deployment options—from a free tier with the open-source editor to tiered cloud plans starting at $49/month, with custom enterprise pricing for on-premises deployment and integrated authentication or storage systems.
Tiptap explicitly states it does not provide AI models but only infrastructure connecting to third-party AI models. Howe
No training opt-out mechanism was identified in the legal documents.
High risk across multiple dimensions. Only use with public, non-sensitive data.
Tiptap explicitly states it does not provide AI models but only infrastructure connecting to third-party AI models. However, the terms are unclear about whether user content/prompts fed into third-party AI systems may be used for training by those providers. The document disclaims control over third-party AI but doesn't explicitly prohibit training on user content.
“the Licensor does not provide an AI-model or any other AI system to Customer but only provides the IT infrastructure enabling the connection to a third-party AI-model”
The license granted is non-exclusive, non-sublicensable, and non-transferable, limited to the contract term. However, the terms don't clearly specify what rights Tiptap retains over user content stored in the platform. The broad disclaimer about third-party AI systems suggests user content may be processed by external parties.
“non-exclusive, non-sublicensable, non-transferable right, limited in time to the term of the respective Contract, to use the Software”
Significant third-party sharing occurs: Paddle (payment processor) receives payment data; Cloudflare Turnstile processes IP/browser data; GitHub receives account data if connected; HubSpot processes contact form data; Google Analytics tracks usage. For AI features, user content is sent to third-party AI models. The terms explicitly state 'Licensor is entitled to use sub-contractors for the provision of its services without the Customer's consent.'
“Licensor is entitled to use sub-contractors for the provision of its services without the Customer's consent.”
The terms state log files are stored 'generally no longer than 14 days' but don't clearly specify retention periods for user content/documents stored in the SaaS platform. Data deletion upon account termination is mentioned but not detailed. The privacy policy lacks comprehensive data retention schedules.
“The log files are stored for as long as is necessary for the respective purpose, generally no longer than 14 days.”
The terms grant customers a license to use the software but do not claim ownership of user-generated content. The customer retains responsibility for content legality and copyright. However, the terms don't explicitly state customer ownership of outputs, which is a gap rather than a risk.
“the Customer itself is responsible for ensuring that it has sufficient copyright for the use of any Content in the Software.”
The privacy policy and marketing materials reference SOC 2 Type II, GDPR compliance, and EU hosting availability. The terms explicitly reference GDPR compliance obligations and data processing agreements. These certifications and compliance frameworks are mentioned as available.
“SOC 2 Type II GDPR compliant EU hosting available”
Track and measure your AI tools with Olakai's observability platform.
Explore Olakai