AI Governance, Security, and Responsible Use

​

Overview

Germain Software recognizes that artificial intelligence introduces additional considerations around data privacy, security, confidentiality, and operational accountability. We are committed to implementing and maintaining appropriate safeguards to ensure that AI capabilities within GermainUX are used responsibly and transparently. Our approach is based on customer control, data protection, transparency, and human oversight.

​

Our Commitments

​

1. Customer Control Over AI Capabilities

GermainUX provides configurable AI capabilities that organizations can enable or disable based on their business requirements, security policies, and compliance obligations. Administrators can: AI features are disabled by default and are managed by administrators in GermainUX settings. Customers retain control over whether and how supported AI capabilities are enabled in their environments. See AI Settings to select an LLM, choose online or offline execution, enable or disable AI features, and customize AI prompts.

​

2. Customer Data and AI Processing

GermainUX is designed to give organizations flexibility in how their data is processed by AI capabilities. Depending on the selected AI feature, model, and deployment configuration, processing may occur through an externally hosted model or a model running within the customer’s controlled environment. For Germain hosted instances, AI features can run on an offline model within the GermainUX AI Service, so AI processing does not require an external AI provider. When configuring AI capabilities, organizations should evaluate: Externally hosted AI models may involve transferring selected information to a third-party provider for processing. Such configurations should be reviewed and approved before use. When a customer connects its own externally hosted model, the customer selects the provider and supplies the API endpoint and credentials. GermainUX supports local or offline AI execution for supported models and features, allowing organizations to keep AI processing within their controlled environment where technically supported.

​

3. Data Privacy and Protection

GermainUX provides privacy capabilities that help organizations minimize the exposure of sensitive information throughout the monitoring and analytics lifecycle. Masking and exclusion are applied before data is transmitted or stored, so masked values and excluded information are not available to AI features. These capabilities include: Organizations should configure these controls according to their data classification, privacy requirements, and intended use of AI capabilities.

​

4. AI Model and Third-Party Provider Governance

GermainUX supports integrations with multiple AI model providers and deployment approaches. The model selected for a particular use case may affect processing location, data handling, retention, and other privacy considerations. AI providers used by Germain Software are subject to our Vendor Management Policy. Before enabling an externally hosted AI model, organizations should assess the applicable provider’s: The applicable AI provider and processing configuration should be evaluated based on the customer’s requirements and the specific GermainUX deployment. The Germain team can recommend a model and hosting approach for each use case.

​

5. Human Oversight and Responsible AI

AI-generated summaries, classifications, insights, and recommendations are intended to assist users in analyzing information and making informed decisions. AI-generated outputs should not automatically be treated as verified facts. Organizations should establish appropriate human-review procedures, particularly when AI outputs may influence decisions involving healthcare, employment, financial matters, legal obligations, or other high-impact activities. GermainUX automation capabilities can be configured to require human approval before executing designated actions. The appropriate level of oversight should reflect the sensitivity and potential impact of the activity.

​

6. Access Control and Accountability

Access to AI configurations, prompts, outputs, and associated customer information should be restricted to authorized users based on their roles and business responsibilities. GermainUX supports this through role and team based permissions, dashboard and data type permissions, enterprise authentication, multi factor authentication, and IP restrictions. Access to AI settings and prompt configuration is limited to authorized administrators through these permissions. Organizations should: See Data Security and Authentication and Access Control.

​

7. How Germain Software Uses AI Internally

Germain Software personnel may use approved AI tools to support product development and business work. This use is governed by our Responsible Use of Artificial Intelligence Policy: only approved tools with company controlled accounts may be used, new tools require a security review before approval, and customer data, personal information, credentials, and other confidential information may not be entered into AI tools.

​

8. Continuous Review and Improvement

Germain Software reviews its security, privacy, and compliance practices as its products and AI capabilities evolve. AI related risks are included in our annual risk assessment, and AI related incidents are handled under our Incident Response Plan. We encourage customers to work with our team to evaluate AI deployment options, data-processing requirements, privacy configurations, and security controls before enabling AI capabilities in production environments. For questions regarding AI governance, privacy, or security, please contact our Security and Compliance team at security@germainux.com.

​

Additional Resources

​

Get Help

The content of this document is proprietary to GERMAIN SOFTWARE.