Audit
Every request to an AI model is written down immediately and stays unchanged, so you can account for the use to regulators, auditors and customers.
Audit is for organisations only and is included on every team plan. See pricing
What the log contains
Everything sent to an AI model is written down before the answer is delivered. That includes requests that are stopped along the way. Afterwards nothing can be changed or deleted. The question, the answer and the sender's identity are encrypted with the organisation's own key. See Encryption for the details.
Who can see what
An administrator can read the content of a conversation but cannot see who wrote it. The name is encrypted separately, and bringing it out takes a written justification and a second administrator's approval. The access lasts for a limited period, and the lookup itself is written into the log.
Documentation for GDPR
If an inspection comes, it is the organisation that must be able to document the use. Because every request is written down and cannot be changed afterwards, the answer already exists. The record of processing, access to an individual's information and a receipt for erasure are written from the organisation's own settings and are ready to send.
Record of processing (Article 30)
It describes what is processed, why, who receives it and how long it is kept. The list of sub-processors and the technical security measures come with it, so it also covers the documentation a customer can ask for under the data processing agreement.
Access to your own information (Article 15)
Everything the platform has recorded about one employee, gathered in a single document. The report states which parts of the platform it covers, and that information Redaction has swapped out cannot be recovered.
Receipt for erasure (Article 17)
When an employee's information is erased, the receipt shows what was deleted where. If anything is retained under Danish bookkeeping law, the receipt says so rather than leaving it out.
Retention and erasure
The log is kept for one year, and on Enterprise you agree the period yourselves. When a request grows older than that, it is first marked and a day later deleted entirely. The day is there so a wrongly set period can be spotted while the deletion can still be stopped.