Overview
Suno turns a line of text into a finished song with vocals, usually in under a minute. The company is based in Cambridge, Massachusetts, and Mikey Shulman is its chief executive.
In February 2026 Shulman said Suno had passed 2 million paid subscribers and $300 million in annual recurring revenue, and that more than 100 million people had used the platform at least once. On 1 October 2026 he said the business was “far beyond” those numbers, without giving new ones. Investors have kept pace: a $400 million round led by Bond Capital closed in June 2026 at a $5.4 billion valuation, roughly double the $2.45 billion mark from November 2025, taking disclosed funding past $775 million.
The product has grown from a prompt box into something closer to a workstation. Suno Studio launched on 25 September 2025 as a browser-based editor, and Studio 2.0 shipped on 13 August 2026 with MIDI recording, a built-in wavetable synth, and uncapped multitrack export for Premier subscribers. There is still no VST hosting, no sync to a desktop digital audio workstation, and no installable app.
What It Knows About You
Reviews of Suno’s privacy policy describe prompts, uploaded audio and generated outputs all feeding back into model training, justified under legitimate interests, with no opt-out offered on any tier. Paying does not buy you out of it.
Upload your own singing and you have handed over voice data, which is a biometric identifier in a way a typed prompt is not. One analysis of the policy records a ceiling of three years after your last interaction for biometric voice data. Other categories get the elastic formula instead, kept as long as reasonably necessary, with no published number attached. Access, correction and deletion requests go to [email protected], and the policy frames those rights around users in the EEA and California.
The licence runs in the other direction as well. Trackers that index Suno’s terms read them as granting the company a worldwide, sublicensable, royalty-free, perpetual and irrevocable licence to user content, voice models included. That is a great deal wider than storing your tracks requires.
Beyond audio, Suno holds the ordinary account records. An email address, a phone number if you signed up with one, and for paying customers a Stripe purchase record carrying name, postal address and partial card details. That set matters chiefly because of what happened to it.
The Real Risks
A breach users were not told about. Have I Been Pwned added a Suno dataset on 20 July 2026 covering about 55.3 million accounts. The data traces back to a security incident Suno confirmed in November 2025 and characterised as limited, quickly contained, and mainly involving outdated source code no longer in use. Reporting on the catalogued set puts email addresses and some phone numbers in it, plus names, physical addresses, purchase amounts and partial card details from tens of thousands of Stripe records. Suno did not notify users, saying it judged formal notification not to be legally required. Its July 2026 position that no sensitive personal information was compromised is difficult to square with what the breach index later listed. A law firm notice citing press reporting describes the entry point as a compromised employee, which gave access to private repositories and customer records; that account is reported rather than confirmed.
The copyright question is half settled, and you cannot tell which half you are using. Warner Music settled in November 2025 and became a licensing partner, in a deal that also moved the concert listings service Songkick to Suno. BMG signed on 12 August 2026, with terms reported to cover past training as well as future use and to require artists and songwriters to opt in. Believe has licensed as well. Universal and Sony have not. The majors’ 2024 suit is still live, a motion to expand it to 61,026 recordings was pending as of late October 2026, and the statute allows damages of up to $150,000 per infringed work. Nothing in the interface tells a user which model weights rest on licensed material and which rest on the corpus still being argued over.
The displacement here is measured, not speculated about. Deezer reported that 44% of tracks uploaded to it daily in April 2026 were fully AI-generated, against roughly 10% in January 2025, and said the share crossed half by June at around 90,000 synthetic tracks a day. Those tracks pull only about 1% to 3% of actual streams, and Deezer says a large portion of even that came from fraudulent streaming schemes. The figures are self-reported, and the pressure they describe falls hardest on commissioned work rather than on catalogue: library and production music, podcast beds, advert backing tracks, corporate video. On 5 June 2026 the American Federation of Musicians sued Universal and Warner in the Southern District of New York, arguing that the players on the recordings licensed to Suno and Udio received neither payment nor credit under the new use provision of their collective agreement, and asking the court to make the labels disclose which recordings went into training. No ruling had landed by late October 2026. Where money did change hands, it does not appear to have reached the musicians.
It flattens traditions it has not heard much of. An ISMIR study of 60,014 recordings found Suno’s output clustering on Western pop harmony, with the I-V-vi-IV progression over-represented relative to human recordings. A preprint titled Bias beyond Borders generated 73,000 tracks spanning 79 countries and 147 languages and found Suno’s opera and ghazal attempts landing closer in distribution to ordinary pop than to real recordings in those genres. A separate paper, Missing Melodies, reports maqam microtones rounded to the nearest Western pitch, and raga requests answered with Western melodies played on a sitar. A University of Johannesburg paper published in AI & Society on 3 September 2026 asked Suno and Udio for ten Kenyan Benga tracks apiece and found neither reproduced the melodic grammar. These tests ran against older model versions, and Suno publishes nothing about its training data, so they establish a pattern rather than a current measurement.
Alternatives
- Licensed production-music libraries (Epidemic Sound, Artlist, Musicbed) cost more per month than a Suno subscription and come with a documented chain of rights. If the work ships under a client’s name, that paperwork is the product you are buying.
- Commission a composer or a session player for the one cue that actually carries the project. For a single track the price gap is narrower than people assume, and the result is yours outright with nobody else holding a perpetual licence to it.
- Udio sits in the same legal position rather than outside it. It settled with Universal in late October 2025 and with Warner in mid-November, and it appears beside Suno in the AFM complaint and in every bias study above. Switching platforms does not move you out of any of this.
- Use less music. Much of what gets generated is filler behind a voice. Room tone, or one properly licensed cue reused across a series, usually serves the work better than a fresh synthetic song per upload, and it is the option that costs nothing and carries no rights risk.
Our Verdict
D. The grade is driven by job displacement at 9 and the privacy record at 7, not by anything the tool does to your judgement while you use it. Suno is good at what it sells and straightforward about charging for it. The trouble sits around the product. Users learned of a 55.3 million account breach from a third-party index eight months after the incident; two of the three major labels are still litigating the training corpus; and synthetic uploads now outnumber human ones on at least one streaming service, competing for the same royalty pool as the people who used to be paid for this work.
Lock-in came out mild, at 5, and that is to Suno’s credit. Studio exports up to twelve time-aligned WAV stems along with MIDI, and Premier subscribers get uncapped 32-bit multitrack, so the audio can genuinely leave. The rights are stickier than the files. Terms trackers report that since 3 September 2026 commercial use of an output also requires a permitted download under your tier’s allowance, and that songs made on a free account cannot be licensed retroactively by subscribing later. Autonomy scored 4 on its own terms: this is a tool you drive, not an agent acting on your behalf.
Three things would move this to a C: a published retention period for voice data, a training opt-out for paying subscribers, and settlements with Universal and Sony that close the provenance question. A B is harder, because the jobThreat score reflects the market Suno operates in rather than a choice Suno made. On privacy alone, a stated breach notification policy, applied the next time something happens, would do more than anything else on that list.