OpenSay AI Usage & Data Security Policy

#1. Core Principles & Non-Negotiable Guarantees

OpenSay adheres to four non-negotiable principles across all AI processing:

1. Zero Model Training: Customer prompts, message submissions, whispers, poll entries, and moderation outputs are never used to train, retrain, improve, or fine-tune foundational AI models by Google, Cloudflare, Meta, or any third party.
2. Zero-PII Data Minimization: OpenSay strips all personally identifiable information (PII)—including user names, email addresses, Slack user IDs, team domain names, and IP addresses—prior to transmitting text to any AI model. Only the isolated text content and objective safety rules are evaluated.
3. No Behavioral Profiling or Scoring: OpenSay never builds psychological profiles, sentiment dossiers, or individual risk scores on employees. AI is evaluated on a per-interaction basis without historical user correlation.
4. Human-in-the-Loop & Governance: AI serves strictly as an objective pre-flight safety filter or advisory guardrail. Workspace administrators maintain full control over safety presets, custom rules, and exception overrides.

#2. Scope of AI Usage

Where AI is Used

• Pre-Flight Safety Moderation: Evaluating author submissions (anonymous posts, replies, whispers, and polls) against organizational policies (e.g., preventing harassment, hate speech, severe toxicity, and non-consensual disclosure of sensitive data).
• Workspace Custom Rules: Enforcing customer-defined workspace guidelines (e.g., restricting unsolicited sales pitches, profanity, or sensitive project code-names).
• Positive Tone Verification: Validating that peer kudos and shoutouts align with constructive workplace recognition standards.

Where AI is NEVER Used

• De-Anonymization: AI is never employed to analyze writing styles, syntax patterns, or timing to deanonymize anonymous authors.
• Employee Surveillance & Performance Scoring: AI is never used to rank employee sentiment, measure morale trends tied to individuals, or inform employment decisions (hiring, promotion, or termination).
• Automated Permanent Censorship: If an AI model flags a submission as violating workspace rules, the author receives immediate real-time feedback with the specific rule triggered, allowing them to edit and rephrase their message.

#3. AI Architecture & Subprocessors

OpenSay utilizes enterprise-grade AI infrastructure operated by trusted, certified subprocessors under strict Data Processing Agreements:

Workspace administrators can inspect their active moderation engine, toggle between Cloudflare AI (default) and Google Gemini, or customize safety presets at any time via the OpenSay Dashboard at https://app.opensay.co.

#4. Zero Model Training & Contractual Commitments

OpenSay procures all third-party AI services under commercial, paid enterprise agreements that contractually prohibit the vendor from using customer data for model training.

Google Gemini API Commitments

OpenSay accesses the Google Gemini API exclusively as a Paid Service through an active Google Cloud Platform billing project. Under the official Gemini API Additional Terms of Service (Section: Paid Services — How Google Uses Your Data):

"When you use Paid Services, including, for example, the paid quota of the Gemini API, Google doesn't use your prompts (including associated system instructions, cached content, and files such as images, videos, or documents) or responses to improve our products, and will process your prompts and responses in accordance with the Data Processing Addendum for Products Where Google is a Data Processor."

Furthermore, as documented in the Google Cloud Generative AI Data Governance documentation:

• Customer prompts and generated responses are strictly isolated to the customer's project.
• Google does not use customer content to train foundational Gemini models or share customer data across other tenants.

Cloudflare Workers AI Commitments

Inference executed via Cloudflare Workers AI runs within Cloudflare's secure serverless edge environments:

• Customer inputs and model outputs are processed in-memory and discarded upon completion of the inference request.
• Cloudflare does not use customer data transmitted through Workers AI to train models, in accordance with the Cloudflare Customer DPA.

#5. Technical Data Minimization: Zero-PII Transmission

OpenSay's application pipeline sanitizes all data before dispatching any request to an external LLM:

At no point does the LLM receive the identity of the author, the recipient, or the customer's workspace name.

#6. Data Retention & Lifecycle

OpenSay applies rigorous data lifecycle standards to AI moderation operations:

• In-Flight Ephemeral Evaluation: Model inference occurs in real time (typically under 600 milliseconds). Prompts and responses are processed synchronously in-memory.
• Subprocessor Retention (Google Cloud): For Paid Services, Google retains ephemeral operational logs solely for a temporary period (standard Google Cloud transient logging, typically up to 30 days) to detect and prevent violations of its Prohibited Use Policy (e.g., child sexual abuse material or malicious system attacks). Once this window lapses, ephemeral logs are permanently purged. This data is never added to training data sets.
• OpenSay Audit Telemetry: OpenSay records high-level moderation verdicts (timestamp, allowed status, rule triggered, token count) in encrypted Firestore records for customer workspace analytics. In alignment with our Privacy Policy, this data is retained while the workspace's subscription is active and permanently deleted within 14 days of bot uninstallation, or immediately upon customer request.

#7. Security & Prompt Injection Protections

OpenSay employs defense-in-depth measures to protect our AI moderation pipeline:

1. Boundary Encapsulation: Untrusted user inputs are quarantined inside strict XML boundaries (<user_message>...</user_message>) within system prompts, preventing user-submitted text from hijacking moderation directives.
2. Schema Enforcement & Strict Whitelisting: Models are constrained to return strictly formatted JSON payloads (response_mime_type: "application/json"). OpenSay validates and whitelists only recognized fields (allowed, reasoning, violated_rules), discarding any unexpected tokens to neutralize indirect prompt injection attacks.
3. Deterministic Zero-Temperature Inference: Safety evaluations run at temperature 0.0 to maximize determinism, eliminate speculative hallucination, and maintain consistent policy enforcement.

#8. International Data Transfers & Regulatory Safeguards

Data transfers necessary to execute AI moderation are safeguarded under robust international transfer frameworks:

• EU GDPR & UK GDPR Compliance: Both OpenSay and our AI infrastructure providers maintain comprehensive Data Processing Agreements incorporating the European Commission's Standard Contractual Clauses (EU SCCs 2021/914) and the UK Information Commissioner's Office (ICO) UK International Data Transfer Addendum.
• EU-U.S. Data Privacy Framework (DPF) & UK Extension: Google LLC and Cloudflare, Inc. are actively certified under the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Transfers of personal data to certified U.S. entities are recognized as providing adequate data protection under UK and EU law.
• Adequacy Recognition: Where applicable, transfers across international operational centers operate under permanent statutory adequacy recognition from both the European Commission and the UK Government.

#9. Workspace Administrative Controls

OpenSay empowers administrators with granular control over AI moderation:

• Preset Customization: Admins can toggle individual safety dimensions (Toxicity, Severe Toxicity, Hate Speech, Harassment, Sexual Content, Profanity).
• Custom Workspace Rules: Admins can create company-specific moderation policies tailored to internal communication standards.
• Channel Exclusions: Specific channels (e.g., private leadership or whistleblower whisper hotlines) can have custom moderation thresholds or bypasses configured.
• Audit Transparency: Workspace admins can inspect moderation activity and review flagged interaction metrics in the OpenSay Dashboard.

#10. Inquiries & Security Contact

For enterprise security questionnaires, Data Protection Impact Assessment (DPIA) inquiries, or questions regarding our AI architecture, please contact our privacy team:

• Data Protection Officer: Sagi Kedmi
• Corporate Entity: Heterodox Ltd. (d/b/a OpenSay)
• Email: [email protected] or [email protected]
• Security Portal: /security/
• Data Processing Addendum: /dpa/
• Subprocessors Registry: /subprocessors/
• Terms of Service: /terms/