AI and your data
The question is whether it trains on your records. It does not. This page names every feature that calls a model, what each one sends, and which claims are ours to make rather than our providers'.
What uses a model
Today, one shipped feature sends customer data to a model: assisted application analysis in Cadre, which calls Anthropic's API when you run an analysis and is metered per call, so its use is visible on your bill.
Our model providers are Anthropic and OpenAI, accessed through their business APIs. If a new feature starts calling a model, it joins this list when it ships.
What gets sent
A feature sends the content it operates on, when you invoke it. The application analysis sends the application being analyzed and the criteria you are scoring against. Nothing is sent in the background, and your database is not synced to a model provider.
Training
We do not train models on customer data, and we do not build models from it. Data leaves for a provider only when a feature is used, as described above.
The retention and training terms on our provider accounts are a contract question, and we will not restate a provider's public documentation as our contractual position. If your review needs that position in writing, ask us at legal@mercleo.com and we will answer from the terms we hold.
Turning it off
There is no account-level switch today that disables model-backed features across every product. Because the features run only when invoked, not using them means no data goes to a model provider. If your obligations require the capability disabled outright, tell us before you buy and we will answer plainly.
Human review
No one at Mercleo reads your data as part of an AI feature. Whether a provider's trust-and-safety program can review API traffic is governed by that provider's terms; it is part of the same written answer we give on request.
The rest of the trust centre. Everything else a reviewer asks for.
- Where your data livesWhere the infrastructure runs, who runs it, and whose law can reach the data.
- SubprocessorsEvery third party that touches customer data, and what each one sees.
- SecurityTenant isolation, staff access, and the supply chain.
- Privacy and your rightsThe processing agreement, retention, export, deletion and breach notice.
- AccessibilityWhat has actually been checked, what has not been assessed, and how to report a barrier.
- ComplianceWhat we hold, what we are working towards, and what we do not have.
- Report a vulnerabilityHow to reach us, what is in scope, and what happens after you do.