Legal, Privacy & Security

AI Policy & Trust Statement

Updated

This is the cross-product AI Policy for Capptions B.V. It applies to every AI feature in Capptions One, Capptions Direct, the Marketplace, Capptions AI and Seveso.app. The product-specific statement for Seveso.app is at Seveso.app AI Statement.

Headline commitments

  1. We never train AI models on your data.
  2. AI inference runs in the European Union by default.
  3. Prompts are tenant-scoped — no cross-tenant data ever reaches a model.
  4. A human is always in the loop for decisions that affect a person.
  5. We only use providers with contractual zero-training and zero/short-retention modes.

1. Why we publish this

European EHS, ESG and Seveso customers are right to ask hard questions before letting AI touch safety data. This statement is our public answer. It sits alongside our binding contracts — the Terms of Service, Data Processing Agreement and Security Statement — and forms part of the DPA via its AI processing annex.

2. The providers we use

Capptions does not train its own foundation models. We use a small set of audited AI sub-processors, all configured for no training on our data, zero or short retention beyond the response, and EU residency wherever the provider offers it.

We publish the current provider list and their regions on the Sub-processors page and update it under Section 6 of the Data Processing Agreement. Customers receive a 30-day notice before we change the default AI provider or model in production.

We only work with providers where we can simultaneously satisfy: EU residency, contractual no-training, zero or short retention, enterprise SLAs and meaningful capability. We avoid providers that train on API inputs by default, route through non-EU regions only, or refuse to sign an Art. 28 DPA with EU SCCs.

3. What leaves your tenant

Only the minimum context necessary for the requested AI operation. In practice that means:

  • the user’s prompt;
  • a tenant-scoped retrieval result (the relevant records from your tenant, selected by a search restricted to your tenant);
  • a system prompt that instructs the model on the task and safety constraints;
  • a tenant identifier so we can audit every call.

We never include data from another tenant. We never include credentials, tokens, or fields marked as secrets. Files are passed only when the user explicitly attaches them.

4. What does not leave your tenant

  • Customer Data is not sent to a model for training or fine-tuning.
  • Customer Data is not sent outside the EEA except via an AI sub-processor’s EU endpoint, and where a provider’s control plane is in a non-EEA country, only the inference data path is used and is covered by Standard Contractual Clauses.
  • Prompt logs stored at Capptions live on our EU infrastructure, are scoped per tenant, and are deleted on customer offboarding.

5. Retention and logging

Artefact Where Retention
Prompt + response at the AI provider EU region of provider None beyond the response, or ≤ 24 h abuse window where applicable
Prompt + response in Capptions logs Capptions EU infrastructure ≤ 30 days, then deleted
Tenant-scoped retrieval / search indexes Capptions EU infrastructure Life of tenant; deleted on offboarding
Human-feedback (👍/👎 on AI outputs) Capptions EU infrastructure Life of tenant; used only to improve prompts, never to train models

6. Human oversight

Every AI feature follows the same pattern:

  1. The user asks for an AI suggestion.
  2. The model returns a suggestion clearly labelled as AI-generated.
  3. The user can edit, accept or reject the suggestion.
  4. The accepted output is stored with a record of the user who accepted it.

Capptions does not let AI autonomously create, send or close items that affect a person, a regulator-facing record, or a safety-critical decision.

7. EU AI Act positioning

The EU AI Act (Regulation (EU) 2024/1689) takes full effect in 2026–2027. We classify our AI features as follows:

  • Transparency obligations (Art. 50): all AI features. AI-generated content is labelled in the UI. Synthetic content is watermarked or marked where technically feasible.
  • Limited-risk systems: general assistant and summarisation features.
  • High-risk systems (Annex III): only where an AI feature is used in a safety-management context that influences a Seveso safety report, a major-accident hazard analysis, or a worker’s health and safety determination. For those features we maintain:
    • a documented risk-management system (Art. 9);
    • data governance and quality records (Art. 10);
    • technical documentation (Art. 11) available to authorities;
    • automatic logging of decisions (Art. 12);
    • clear user instructions (Art. 13);
    • human oversight as the default workflow (Art. 14);
    • accuracy, robustness and cybersecurity controls (Art. 15).
  • Prohibited practices (Art. 5): none. Capptions does not deploy social scoring, real-time biometric identification, emotion recognition in the workplace, or any other practice prohibited under the Act.

For features classified as high-risk, the model card is published in Seveso.app AI Statement.

8. How customers stay in control

  • AI features can be disabled tenant-wide by an administrator.
  • AI features can be disabled per role (e.g. read-only users).
  • A tenant can request export and deletion of all AI logs at any time.
  • Customers receive a 30-day notice before we change the default AI provider or model in production.

9. Questions

Question not answered? Ask us via the contact form