AI / Model Data Use

1. Where AI may be used

Large language models may analyze workflow descriptions and schema metadata you provide to produce readiness narratives, remediation guidance, and framework mapping (for example NIST AI RMF alignment language). Mapping is not certification.

The public Lab primarily uses deterministic RULES interpretation to map plain-language workflow text to a known scenario. When an AI interpretation path is enabled for that environment, utterance text may be sent to a model API to assist mapping. Decisions (Allow / Pause / Block) still come from Check Write™, not from the interpreter inventing a decision.

The Allow / Pause / Block decision path is control-and-evidence evaluation. It is not “another model pass” that replaces your enterprise controls.

2. Providers that may process content

Depending on the surface and configuration, TekCapitol may use model APIs from providers such as:

Provider privacy policies: Google · Anthropic · OpenAI.

Enterprise customers evaluating subprocessors should request current configuration details for their engagement. We do not assert on this page that every commercial DPA is “in place” for every provider without a customer-specific review.

3. Training and retention stance

TekCapitol product intent: We do not use customer workflow content to train TekCapitol foundation models.

Third-party providers: Retention and training behavior depend on the provider account type and API terms we use for that surface. We configure enterprise/API modes intended to avoid provider training on customer content where the provider offers that option. We do not publish an absolute guarantee that every provider never retains data beyond the request in all circumstances. Review provider terms for your risk posture, or choose a private deployment where model processing stays inside your boundary.

4. What assessment flows typically send

Do not upload regulated personal data, children’s data, or secrets unless you have cleared that with TekCapitol in writing first.

5. Public Lab guidance

6. Private / VPC deployments

Production enforcement can run inside your trust boundary. In that model, what leaves your environment is limited to what you configure. Hosted evaluation and private enforcement use the same decision logic with different deployment boundaries. See Security and Data & Confidentiality.

7. Contact

For DPA, security questionnaire, or subprocessor detail requests: info@tekcapitol.com. We aim to respond within 3 business days.