GenAI

1. Purpose

This policy ensures that Cognida, Inc.’s use of third-party GenAI services in connection with Automate protects the security and confidentiality of customer data while also delivering stability and scalability. Cognida offers GenAI-based features through a number of software vendors (each, a “GenAI Provider”) such as Microsoft and OpenAI. Regardless of the GenAI Provider, Customer Content will not be used as training data for current or future AI models. “Customer Content” means documents, contracts, prompts and field values uploaded by customers. This policy is read with the customer agreement and DPA. Questions: dpo@cognida.ai

2. Our GenAI Providers

a. Microsoft

Microsoft Corporation (“Microsoft”) is a U.S. technology company that develops and sells a variety of enterprise and consumer technology products. Cognida evaluates the privacy and security practices of GenAI providers before use and periodically thereafter. More information about security and privacy at Microsoft Azure is available here.

b. OpenAI

OpenAI, L.P. (“OpenAI”) is a U.S. company that conducts research and deployment of artificial intelligence models. Cognida evaluates the privacy and security practices of GenAI providers before use and periodically thereafter. More information about security and privacy at OpenAI is available here.

c. Google

Google LLC (“Google”) is a U.S. company that conducts research and deployment of artificial intelligence models. Cognida evaluates the privacy and security practices of GenAI providers before use and periodically thereafter. More information about security and privacy at Google is available here.

d. Anthropic

Anthropic PBC (“Anthropic”) is a U.S. company that conducts research and deployment of artificial intelligence models. Cognida evaluates the privacy and security practices of GenAI providers before use and periodically thereafter. More information about security and privacy at Anthropic is available here.

3. How Cognida Uses GenAI Models

Cognida uses GenAI models to enhance its core NLP platform for automating document workflows. In addition to improving the speed and accuracy of the existing features, it powers generation of new AI-powered features within Automate such as Chat, Search and many others. GenAI Providers may perform the following activities with respect to data:

Processing document data to perform extractions
Matching data between checklist items
Compute embeddings from document data
Interact with users in a chat interface
Other activities in accordance with the agreement between your organization and Cognida

4. Personal Data Processing

Automate sends document data to GenAI Providers for processing. In addition, Automate may send other field values from third party systems (such as Salesforce) if your use case requires it. This may include the following categories of personal data:

First and last name
Contact information (telephone number & email address)
Company, position
Other personal data your organization asks to process

Cognida has entered into data-processing terms with the GenAI and cloud providers that process personal information on its behalf, with obligations appropriate to applicable data protection laws.

5. Model Training

GenAI providers are contractually restricted from using Customer Content to train or improve their general-purpose models, subject to disclosed exceptions.

Microsoft data usage policy can be found here.

OpenAI data usage policy can be found here.

Anthropic data usage policy can be found here.

Google data usage policy can be found here.

6. Data Retention

Any data processed by a GenAI Provider will be deleted, with exceptions for abuse monitoring, security and legal needs.

Cognida has negotiated and defined zero data retention policies with its GenAI Providers where available and contractually supported.

7. Certifications and Additional Protections

Microsoft Azure has SOC 1 Type II, SOC 2 Type II and SOC 3 reports and ISO 27001 certification, amongst other certifications listed here.

OpenAI has a SOC 2 Type II report.

Google has SOC 1 Type II, SOC 2 Type II and SOC 3 reports, amongst other certifications.

Cognida enters into appropriate contractual arrangements, including data-processing terms where required.

GenAI Usage Policy

Table of contents