We ask AI vendors to prove their AI is safe. It would be absurd not to hold ourselves to the same standard — so here is exactly which models we use, what data reaches them, and what we do to keep it safe.
Third-party models accessed over secure APIs. We do not train, fine-tune or host our own models.
| Where | Model | What it does |
|---|---|---|
| Document assessment | Anthropic Claude Sonnet | Reads an uploaded report (SOC 2, ISO, pentest), grades it, identifies its type and validity, and maps which controls it evidences. |
| Answering | Anthropic Claude Opus | Drafts questionnaire answers strictly from your own profile and captured evidence. |
| Consistency scan | Anthropic Claude Opus | Flags where a declared claim disagrees with a captured signal. |
Models are configurable per deployment (ANTHROPIC_MODEL / ASSESS_MODEL). Anthropic is disclosed as a sub-processor in our privacy notice.
The honest answer, field by field — including the part most vendors gloss over.
| Data | Sent to the model? | Why |
|---|---|---|
| Uploaded compliance documents SOC 2, ISO certs, pentest reports, policies | Yes — in full | The model must read the report to grade it and map the controls it covers. This is the most sensitive data we send; see the safeguards below. |
| Your AI Trust Profile declared claims, company details | Yes | So answers are grounded in your own truth rather than invented. |
| Captured signal values e.g. "TLS 1.2+ enforced" | Yes | So an answer reflects live evidence, not just a declaration. |
| Questionnaire questions | Yes | The question being answered. |
| Your customers' data | Never | Avowa never receives it. We read security configuration and metadata — not your product's data. |
| Credentials & API keys | Never | Connector secrets are sealed at rest and never enter a prompt. |
| Prompts & outputs from your AI | Never | The Runtime SDK sends metadata only — model, region, and the flags you set. It never captures prompt or response content. |
No — and it is a contractual commitment, not just a policy. Anthropic's Commercial Terms state plainly that “Anthropic may not train models on Customer Content from Services.” Those terms also incorporate Anthropic's Data Processing Addendum by reference, so a DPA governs our use of the API. Avowa itself has no training pipeline: we do not train, fine-tune or otherwise build models on customer data, and never share it between tenants.
Every request is scoped to a single tenant. One customer's documents or evidence are never used to answer another customer's question.
We have no training pipeline. Your evidence improves your answers only — it never becomes model weights.
All model calls go over TLS to Anthropic's API. The API key is held server-side only and is never exposed to a browser.
Only the claim being assessed and the document in question are sent — not your whole evidence base. Oversized files are rejected rather than truncated.
AI output is a draft, never a decision. Grades, answers and seals are reviewable; the over-claim guardrail is deterministic code, not a model judgement.
If the model is unavailable or returns something invalid, Avowa says so and falls back — it never fabricates evidence to fill a gap.
Uploaded reports are the most sensitive thing we send. An owner can disable AI document processing for their workspace: documents are still stored and served, but never sent to a model. Auto-grading stops — a deliberate trade, and yours to make.
We hold no copy of your documents at the model provider. Anthropic's API applies its own retention for abuse monitoring; see “Where we are still closing the loop” for what we're doing about it.
The guardrail that matters most: the AI never decides whether you are compliant. Seals are computed from captured evidence by deterministic rules, and a claim your own evidence contradicts has its seal withheld — regardless of what any model says.
Publishing what isn't finished is the same standard we hold vendors to.
