An AI metadata tool is defensible for unreleased work when three things are true: it states in writing that your images are not used to train models, it publishes a retention window and gives you a delete control you can operate yourself, and it hands the metadata back in a portable format instead of locking it inside its own platform. Accuracy is a separate question, and a much less urgent one.
What counts as unreleased work
The phrase covers more than photographs waiting on a model release. Contributors apply it to anything not yet published: a client shoot under NDA, personal work held back for a competition deadline, an editorial series that loses its value if it surfaces early, and files with identifiable people whose paperwork has not come back. What these share is that the cost of a leak is not the file itself. It is the loss of first publication, a broken contract, or a legal exposure that no keyword set is worth.
That changes the evaluation completely. For a folder of already-published stock, the worst case of a bad metadata tool is wasted money and a cleanup afternoon. For unreleased work, the worst case is the file existing somewhere you did not intend. So the questions below are about data handling, not keyword quality.
Seven questions to ask before uploading
1. Does the tool process locally or in the cloud?
This is the first fork, and it is an architecture question rather than a moral one. A desktop tool that reads pixels on your own machine never transmits the image. A cloud tool has to. Local processing usually means weaker models and slower throughput on large batches; cloud processing usually means better keywords and a copy of your file on someone else's server. Neither answer is automatically correct, and the right one changes per batch.
2. If it is cloud-based, who actually sees the image?
Many metadata tools are a thin layer over a third-party vision model. Your file then touches two companies rather than one: the tool and its upstream provider. Ask which provider is used, whether the tool's own terms bind that provider, and whether zero-retention or enterprise API terms are in place. A vendor who cannot answer this in one sentence has not thought about it, which is itself informative.
3. Is there a written no-training commitment?
A line about taking privacy seriously is not a commitment. What you are looking for is a specific statement that customer images are excluded from training, fine-tuning and evaluation, ideally in the terms of service rather than on a marketing page. The absence of that sentence is not proof of misuse, but it does mean you have no recourse if it happens.
4. How long are files kept, and can you force deletion?
Retention windows exist for legitimate reasons: failed jobs need retrying, support tickets need reproducing, billing disputes need evidence. What matters is that the window is stated, that it is measured in hours or days rather than described as long as necessary, and that deletion is a control you can operate yourself rather than an address you have to write to and wait on.
5. Does the tool claim any rights over the files?
Read the licence grant clause rather than the pricing page. Some platforms take a broad licence to host, display and sublicense your content because their business model requires it. Wirestock is the clearest current example of a company built around supplying creative content to AI labs, which is a legitimate model and one many contributors choose on purpose. It is simply a different relationship from a tool that writes metadata and hands the file straight back to you.
6. Is the output portable?
A tool that writes IPTC and XMP into the file itself, or exports CSV and XML you can take elsewhere, leaves you free to walk away. A tool that keeps metadata inside its own dashboard has created a dependency. This matters twice over for sensitive work, because the natural response to a vendor changing its terms is to leave, and you can only leave cleanly if the work comes with you.
7. What happens to your agency credentials?
Metadata tools that also deliver files need agency access, and the size of that grant varies enormously. FTP credentials scoped to an upload directory are a far smaller concession than a stored agency password or an account-wide token that can read your sales data and change your settings. This deserves its own review, and it is worth reading separately on how much access a stock tool actually needs.
Where the main categories sit
No tool is universally safest, and the honest comparison is by architecture rather than by marketing claim. Here is how the common options differ against the questions above.
Xpiks
Open-source desktop application for Windows, macOS and Linux, free with no hidden fees. Metadata editing, spell checking and pre-upload validation all run locally, and keyword suggestion can be sourced from your own existing library rather than any external service. Its automatic AI keywording arrives as a plugin, which means the privacy question shifts to whichever provider the plugin calls rather than to Xpiks itself. Best for contributors who want a genuinely local baseline and accept a slower, more manual workflow in exchange.
StockSubmitter
A long-established desktop tool that contributors run themselves, and one of the names most often recommended for multi-agency submission. Because it is software on your machine driving uploads to accounts you already hold, there is no intermediate platform sitting on the files. The trade-offs are its Windows-first availability and a setup you configure and maintain yourself rather than a service that maintains itself.
Wirestock
A managed pipeline rather than a tool you drive. Wirestock now describes itself as connecting creators and AI teams around training data, running that business alongside its marketplace and taking a share of licence revenue. For contributors who want that relationship it works and it pays. For NDA or embargoed material it is simply the wrong category, because the model depends on content flowing outward rather than back to you.
PhotoTag.ai and similar cloud keyworders
Upload-and-receive-metadata services. They are fast, often produce good keywords, and the entire interaction is a file going up and text coming back, with no claim on distribution or royalties. That narrow scope is a genuine strength. It also means the evaluation reduces almost entirely to retention and training terms, so read those before the feature list.
Generic vision APIs
Calling a general-purpose vision model directly gives you the most control over terms, because the major providers publish data-handling commitments you can actually read and, on business tiers, contract against. What you give up is stock-specific judgement. Generic labels are not agency-compliant keyword sets, and the money saved tends to reappear as cleanup time.
Rastock AI
Cloud metadata generation with FTP delivery to 10+ agencies, plus any other agency that accepts FTP or SFTP. There is no revenue share and no ownership claim over files, and metadata exports as IPTC, CSV or XML, so the output stays portable by default. Like every cloud option, the file is transmitted in order to be processed, so the local-versus-cloud trade-off above applies here as much as anywhere; the difference is in what happens afterwards, and the data handling terms are the thing to read rather than take on trust.
When cloud processing is fine, and when it is not
For published portfolio work, back catalogue re-keywording and generative images you produced yourself, cloud processing is a reasonable default. Those files are already public or unambiguously yours, the accuracy gain over local models is real, and on an archive of several thousand files the throughput difference is measured in days rather than minutes.
For NDA client work, unreleased editorial, images with pending model releases and anything under embargo, the answer flips. Either keep those specific batches on a local tool, or get the no-training and retention terms in writing before the first upload. Splitting a workflow by sensitivity is normal and costs far less than most people assume, because you are not choosing one tool for everything. You are choosing a fast path and a careful path, and deciding which folder each shoot lands in.
A test you can run this afternoon
Before committing a real archive to any tool, run this on three throwaway files.
- Find the retention and training language in the terms of service, not the FAQ. If you cannot locate it in five minutes, that is your answer.
- Upload the three files, then delete them from the dashboard and check whether deletion is confirmed and immediate rather than queued.
- Export the metadata and confirm it comes back as embedded IPTC or XMP, or as CSV or XML you can read outside the tool.
- Email support and ask directly whether uploads are used for model training and how long files are retained. Keep the reply.
- Check what the delivery side requires, and whether the credentials can be scoped to an upload directory rather than a whole account.
Four of those five take minutes. The fourth is the one that actually protects you, because a written answer from a named person is evidence in a way that a marketing page never is, and it costs a vendor nothing to give if the policy is real.
None of this makes a tool trustworthy on its own. It makes the risk legible, which is the most any evaluation can honestly do. Legible risk is what lets you put the safe majority of an archive through the fast path while the sensitive remainder stays on the slow one, and it is the same discipline that decides which tools take a share of your work and which do not.
Frequently asked questions
Are AI metadata tools safe for unreleased or NDA work?
It depends on the tool's data handling rather than its accuracy. A tool is defensible for unreleased work when it states in writing that uploads are excluded from model training, publishes a retention window measured in hours or days, offers a self-service delete, and claims no licence over your content. If any of those four is missing, keep sensitive batches on a local desktop tool instead.
Do AI keywording tools train on the images I upload?
Some do, some do not, and many say nothing either way. The only reliable check is the terms of service: look for a specific statement excluding customer content from training, fine-tuning and evaluation. Language about taking privacy seriously carries no weight. Where a tool wraps a third-party vision model, ask which provider is used and under what terms, because your file touches both companies.
Is local processing always safer than cloud processing?
For confidentiality, yes, because the file never leaves your machine. For everything else it is a trade-off: local models are generally weaker, batch throughput is lower, and you maintain the software yourself. Most contributors handling mixed work split the difference, running a desktop tool for sensitive batches and a cloud service for published back catalogue files.
What should I look for in a metadata tool's terms of service?
Four clauses. The licence grant tells you what rights the tool takes over your files. The retention clause should state a specific window rather than an open-ended one. The training clause should exclude your content by name. The deletion clause should describe a control you operate rather than a request you send. Read those four before you read the feature list.
Is it safe to give a metadata tool my stock agency credentials?
Scope matters more than trust. FTP credentials limited to an upload directory grant far less than a stored agency password or an account-wide token that can read sales data and change settings. Prefer delivery methods that cannot touch anything beyond uploads, and revoke access when you stop using a tool rather than leaving the connection open indefinitely.
Can I use a cloud tool for most work and a local one for sensitive files?
Yes, and it is the most common arrangement among contributors who handle both. Route published portfolio files and your own generative images through the faster cloud pipeline, and keep NDA shoots, embargoed editorial and images with pending releases on a desktop tool. The overhead is a folder convention, not a second workflow, and it removes the need to pick one tool for every situation.