AI Usage Policy

Summary

Evigate uses AI to draft answers to security questionnaires from evidence you upload, a Retrieval-Augmented Generation (RAG) system, not a chatbot guessing from general knowledge. Every confident answer is grounded in your evidence and cited; when the evidence does not support an answer, the system abstains rather than invent one. A human reviews every draft before it is used; nothing is auto-sent. Your content is never used to train any model.

1. What the AI does

When you upload evidence (SOC 2 reports, policies, past questionnaires), Evigate splits it into chunks and creates vector embeddings so it can retrieve the relevant passages later. When you run a questionnaire, for each question the system retrieves the most relevant snippets from your own evidence, within the selected project, and asks the AI model to draft an answer in the required shape (free text, yes/no, yes/no-plus-explanation, or a selection), citing the snippets it used.

2. Models and providers

Embeddings run entirely on our own infrastructure: chunk text never leaves our server to produce retrieval vectors. Anthropic is our primary answer-drafting provider; Google's Gemini API is used only as an automatic fallback for platform-key requests when the Anthropic call itself errors (see §3). We do not use OpenAI as a platform provider. Model choices may change as the product improves; material changes are reflected here.

3. What data is sent to AI providers

Only the minimum needed, and only to content-receiving subprocessors:

• At ingest, for scanned/image PDF pages only: a page with no real text layer

  is rendered as an image and sent to Anthropic (vision) to extract the questions on that page. Born-digital PDF pages (with a real text layer) go through a cheap text call instead; no image is sent for those.

• At answer time: a single question plus the handful of retrieved snippets

  (never whole documents, never your full corpus) is sent to Anthropic to draft the answer.

• Automatic fallback: if the Anthropic call for a given request errors, and

  the operator has configured GEMINI_API_KEY, that one request (the same content described above — a question and evidence snippets, or a scanned page image and extracted text) is instead sent to Google's Gemini API. This only applies to platform-key requests; organizations using their own Anthropic key never fail over. See §7 for BYOK routing.

• Embeddings never leave our server. Chunk text is embedded locally, on our

  own infrastructure, to produce retrieval vectors — no third party ever receives it, with or without BYOK.

We do not send account passwords, BYOK ciphertext, or unrelated data, and we do not log document contents or full prompts. See Subprocessors and the Privacy Policy.

4. Grounding, citations, and abstention

Evigate is designed against hallucination:

• Grounding: answers are drafted from your retrieved evidence, not the model's

  general knowledge. An answer presented as confident carries one or more citations to the specific snippets it relied on.

• Abstention: if retrieval finds no sufficiently relevant evidence, the system

  abstains before calling the model (a "no evidence" result), and even when it does call the model, an answer it cannot cite is rejected and routed to a human rather than presented as fact.

• Reuse with provenance: a near-duplicate question may reuse a previously

  approved answer from your answer library verbatim, carrying its original source; if the underlying source was later deleted, the reused answer is flagged for re-verification rather than silently re-served.

5. Mandatory human review

Every draft enters a review step. The service does not auto-submit or auto-send any answer. Low-confidence, abstained, and uncited answers are routed to you with the reason shown, and bulk "approve all high-confidence" actions deliberately exclude uncertain rows. You decide what is correct and what is submitted.

6. No training on your data

Your content is never used to train, fine-tune, or improve any AI model, ours or a provider's. Anthropic is engaged under a signed no-training, zero/low-retention data agreement: your content is not retained by Anthropic beyond what is required to serve the request, and is never used for training. Google's Gemini API (used only as the conditional fallback described in §2–3) is not covered by a bespoke signed agreement with us the way Anthropic is; instead, we rely on Google's stated terms for this API tier, under which paid-tier traffic is not used to train models — the same no-training posture we hold Anthropic to, but on Google's standard terms rather than a contract negotiated with us. Embeddings never leave our server, so there is no training exposure at all for that step.

7. Bring your own keys (BYOK)

You can supply your own API key for Anthropic, OpenAI, Gemini, a local Ollama endpoint, or a custom OpenAI-compatible endpoint (Settings → API keys), one provider at a time. When you do, the corresponding AI calls run on your own provider account: your evidence transits your account, not ours, and you absorb that provider's cost under your own agreement with them. If you BYOK a provider other than Anthropic (OpenAI, Gemini, Ollama, or a custom endpoint), that data is governed by your agreement with that provider, not by Evigate's agreements with Anthropic or Google. Embeddings are never BYOK — they always run on our local platform model regardless of which LLM key you supply. BYOK keys are encrypted at rest, used only at the moment of the call, and never returned to the browser or logged.

8. Limitations and your responsibility

AI-generated drafts can be incomplete, outdated, or wrong, and retrieval can miss relevant evidence or surface the wrong passage. Drafts are decision support, not a substitute for your professional judgment. You are responsible for reviewing, correcting, and approving every answer before relying on or submitting it, particularly for regulatory, contractual, or audit purposes. Do not attempt to manipulate the system into bypassing grounding, citation, or human-review controls (see the Acceptable Use Policy).

9. Contact

Questions about how we use AI: privacy@logethos.com or support@logethos.com.

*Effective date: July 31, 2026 · Last updated: 2026-07-21 · Version 1.1*