AI Disclosure

Trusvo uses artificial intelligence for part of its work. This page explains where AI is used, how we keep it honest, what remains your responsibility, and how your data is handled. It also serves as our transparency notice for interactions with an AI system.

1. Where AI is used

• Evidence from prose — extracting security-relevant facts from policies and architecture documents.
• Answer drafting — proposing answers to security-questionnaire questions from your Evidence Graph, with citations.
• Overview polish — tidying the summary paragraph of a trust pack.
• Ask agent (optional) — answering a visitor's question strictly from your published materials.

Configuration and infrastructure (Dockerfiles, manifests, Terraform, CI, schemas, dependency and vulnerability data) are handled by deterministic parsers with no AI. External observations are gathered by deterministic scanners, not the model.

2. Honesty by construction

The system is engineered not to over-claim:

• a generated answer may only cite evidence you actually uploaded;
• answers without a valid citation have their confidence capped in code, and controls the evidence does not support are marked UNSUPPORTED or UNKNOWN;
• externally observed signals are labeled as external observations — never presented as proof of an internal control;
• what a machine-readable surface (trust.json, the MCP/agent endpoints) exposes can never exceed what the human-readable page shows.

These are enforced in code, not left to the model's discretion.

3. Human oversight is required

Despite these safeguards, AI output can contain errors, omissions, or mischaracterizations. Every generated answer carries a review status and must be approved by a person before it is exported, shared, or published. Trusvo does not make automated decisions that produce legal or similarly significant effects about individuals; it is an assistance tool for preparing security materials, not an automated compliance-decision system. You are responsible for the accuracy of anything you approve, send to a customer, or publish.

4. Your data and model training

Evidence and questionnaire text sent to the LLM provider are wrapped as untrusted data with instructions not to execute anything found inside documents (prompt-injection defense). We require providers, where available, to offer zero-retention processing and to not train models on your content. We never use your Customer Content or Generated Materials to train models. You may supply your own provider key to keep that processing under your own agreement; without a configured key, AI features are simply disabled and the deterministic parts of the product still work. Secrets are redacted before any content leaves for a model.

5. Providers

Hosted AI inference is routed through OpenRouter to an operator-configured model. Self-hosted deployments configure their own credentials. See the Subprocessors page for the current role-based list and the Privacy Policy for how data is handled.

6. Transparency and standards

This notice supports transparency expectations such as the EU AI Act's rules on interacting with AI systems, and reflects our design commitment that a trust product must not manufacture unearned trust.

7. Changes and contact

We will update this page as our AI use changes; the version and date are shown at the top. Questions: legal@trusvo.com.

Pre-launch template texts describing how Trusvo actually works. Not legal advice — have counsel review before relying on them.