AI Transparency at Eleveo

How we use AI during product development – Agentic Development

1. What this means for engineers
   1. AI assistance is a standard part of our workflow, adopted under defined guardrails and governed by an internal AI Steering Committee with an approved-tools registry. Nothing is used before it's cleared.
2. Non-Negotiable Principles
   1. Developers own every line they ship, whether or not AI helped. AI-generated code is never accepted without being understood.
   2. No code may be merged into a shared branch without review by a qualified individual who fully understands the change and takes accountability for its security, correctness, and licensing. AI generated code is held to the same standard as hand-written code. This applies without exception: no automated merge paths and no exemptions.
   3. AI-generated code meets the same security, quality and maintainability standard as any other code.
   4. Customer data, credentials and internal IP may not be sent to external AI tools.

1.  The security, privacy, and governance measures we have in place to support responsible AI

• A documented policy, not an intention. Eleveo is aligned to (not certified on) NIST AI RMF, OWASP LLM Top 10, IEC 27001 and 42001, the EU AI Act, CIS Controls and NIST SP 800-53. We are certified on ISO 27001.  The policy is owned by both Security and the AI Steering Committee and reviewed at least twice a year. 
• Approved tools registry only. Admission requires vendor security assessment, confirmed data handling and retention, SOC 2 Type ll or equivalent from the vendor and Legal and Security sign-off. Only business-tier licenses may be used for company work; personal and consumer-tier accounts are prohibited.
•  The following categories of data are expressly prohibited from being submitted to any AI tool under any circumstances: credentials, personal and health data, financial data, trade secrets and intellectual property, infrastructure secrets, and restricted customer data. Prior to submission, all data must undergo mandatory secret scanning and synthetic-data substitution to ensure compliance with this policy. 
• Every vendor processing our data needs a signed DPA covering retention, sub-processors, residency, breach notification and no model training on our data without explicit opt-in. Opt-out taken wherever available, verified by Legal annually.
•  AI agents must not operate without human supervision. Approval requirements are tiered according to risk level, with a second reviewer mandated for actions involving deployments, infrastructure, or production data. Irreversible actions are prohibited outright. AI agents must operate exclusively within sand-boxed environments segregated from production systems. 
• AI-generated code passes all static analysis, composition analysis and linting with no exemptions, and is licence-scanned before commercial release. AI-suggested dependencies are verified as real and pinned with integrity hashes.

b. How customer data is handled by AI -

• The Speech Generative server is installed within the Eleveo private cloud, or on customer hardware.
• The generative AI model used is a 'pre-trained' data model.
• Recordings, transcriptions of recordings, and other related data are NOT used to improve the accuracy of the underlying model or to train the model further.
• No customer data is shared or sent to an outside server or service for further processing.