# AI Use and Data Policy

| | |
|---|---|
| Organisation | IVERIOS OÜ |
| Version | 1.0 — 6 November 2026 |
| Classification | Public |

## 1. Where we use AI
IVERIOS Trust Center uses AI for:
- classifying uploaded documents (public / restricted / internal) and extracting certificate data;
- translating trust center content into the 24 official EU languages;
- suggesting trust center content from documents and the company website;
- answering security questionnaires from published trust center information;
- the visitor assistant (chat);
- preparing redacted versions of documents for publication.

## 2. Provider
These features use **Anthropic Claude** through Anthropic's commercial API. Under Anthropic's commercial terms, data sent through the API **is not used to train models**. Transfers to the United States are covered by Standard Contractual Clauses.

## 3. What is sent
Only the data needed for the specific task, for example:
- the uploaded document for classification or redaction;
- published trust center content for translations, questionnaires and the assistant;
- the visitor's question for the assistant.

The assistant and questionnaire answers use **only information published in the customer's trust center**; restricted and internal documents are not used to answer visitors who are not entitled to them.

## 4. Human control
- AI suggestions (classification, content, translations, redactions) are reviewed and approved by the customer before publication.
- Questionnaire answers are marked with confidence and sources and must be reviewed before use.
- The assistant tells visitors when information is not available and refers them to the company's security contact.

## 5. Safeguards
- Content from documents and visitors is treated as untrusted input; instructions inside it are ignored (prompt-injection protection).
- Misuse of the assistant is detected and repeated misuse blocks the visitor temporarily.
- Usage is limited per visitor and per company.
- AI usage and cost are recorded per company.

## 6. Highly confidential data
For IVERIOS services that process highly confidential data, we use **IVERIOS-operated GPUs and AI models**, field-level encryption and a dedicated key management system, so that such data is not sent to third-party AI providers. Trust centers by design do not contain such data.

## 7. Retention
Chat conversations are kept for 12 months. AI usage records are kept for billing. Data sent to the AI provider is retained by the provider only for a limited period under its commercial terms.