> ## Documentation Index > Fetch the complete documentation index at: https://docs.germainux.com/llms.txt > Use this file to discover all available pages before exploring further. # AI Governance, Security, and Responsible Use > How GermainUX keeps AI capabilities under customer control, protects customer data, and supports human oversight and responsible AI use. Service `Management` `Analytics` `Automation` > [card] [Our Commitments](#our-commitments) > > Core AI safeguards > [card] [Customer Control](#1-customer-control-over-ai-capabilities) > > Enable, select and configure AI > [card] [Data Privacy](#3-data-privacy-and-protection) > > Masking, exclusion and more > [card] [Human Oversight](#5-human-oversight-and-responsible-ai) > > Review AI outputs and actions ## Overview Germain Software recognizes that artificial intelligence introduces additional considerations around data privacy, security, confidentiality, and operational accountability. We are committed to implementing and maintaining appropriate safeguards to ensure that AI capabilities within GermainUX are used responsibly and transparently. Our approach is based on customer control, data protection, transparency, and human oversight. ## Our Commitments | Commitment | Description | | - | - | | **AI is off unless you turn it on** | Every AI feature in GermainUX is disabled by default and is enabled only by your administrators. | | **Your data is not used to train models** | Germain Software does not use customer data, prompts, or AI-generated outputs to train or fine tune AI models. | | **You choose where AI runs** | AI can run offline within the GermainUX AI Service, on a model hosted in your own environment, or on an externally hosted model you approve. | | **Privacy controls come first** | Masked values and excluded information are not available to AI features. | | **Germain access follows your Support Access Level** | Under Strict and Medium Safety Clearance, Germain Software personnel cannot access your business data. See [Germain Support-Access Levels](https://docs.germainux.com/management/compliance-privacy-and-security.md#germain-support-access-levels). | ## 1. Customer Control Over AI Capabilities GermainUX provides configurable AI capabilities that organizations can enable or disable based on their business requirements, security policies, and compliance obligations. Administrators can: * Enable or disable supported AI capabilities. * Select from supported language models and AI integrations, including models hosted in your own environment (through an OpenAI compatible API or a runner such as Ollama), offline models within the GermainUX AI Service, or approved externally hosted models. * Configure whether AI processing uses externally hosted models or locally hosted models, where supported. * Customize AI prompts for specific applications, business processes, and analytical use cases. * Review and test AI configurations before deploying them in production. AI features are disabled by default and are managed by administrators in GermainUX settings. Customers retain control over whether and how supported AI capabilities are enabled in their environments. See [AI Settings](https://docs.germainux.com/management/ai-settings.md) to select an LLM, choose online or offline execution, enable or disable AI features, and customize AI prompts. ## 2. Customer Data and AI Processing GermainUX is designed to give organizations flexibility in how their data is processed by AI capabilities. Depending on the selected AI feature, model, and deployment configuration, processing may occur through an externally hosted model or a model running within the customer's controlled environment. For Germain hosted instances, AI features can run on an offline model within the GermainUX AI Service, so AI processing does not require an external AI provider. When configuring AI capabilities, organizations should evaluate: * What customer information is provided to the AI model. * Whether personal, confidential, or regulated information is included. * Where the selected model processes and stores information. * The model provider's data-retention and data-use practices. * Applicable contractual, privacy, and regulatory requirements. Externally hosted AI models may involve transferring selected information to a third-party provider for processing. Such configurations should be reviewed and approved before use. When a customer connects its own externally hosted model, the customer selects the provider and supplies the API endpoint and credentials. GermainUX supports local or offline AI execution for supported models and features, allowing organizations to keep AI processing within their controlled environment where technically supported. ## 3. Data Privacy and Protection GermainUX provides privacy capabilities that help organizations minimize the exposure of sensitive information throughout the monitoring and analytics lifecycle. Masking and exclusion are applied before data is transmitted or stored, so masked values and excluded information are not available to AI features. These capabilities include: | Capability | Purpose | | - | - | | [**Cookie consent integration**](https://docs.germainux.com/management/compliance-privacy-and-security/cookie-consent.md) | Coordinates Real User Monitoring with an organization’s approved Cookie Consent Management Platform. | | [**Masking**](https://docs.germainux.com/management/compliance-privacy-and-security/data-privacy.md) | Hides sensitive values while optionally preserving their structure. | | [**Anonymization**](https://docs.germainux.com/management/compliance-privacy-and-security/data-privacy.md) | Replaces original values with hashed representations. | | [**Exclusion**](https://docs.germainux.com/management/compliance-privacy-and-security/exclusion-process.md) | Prevents selected information from being collected, transmitted, or stored. | | [**AI-driven PII detection**](https://docs.germainux.com/management/compliance-privacy-and-security/pii-detection-ai-driven.md) | Identifies fields that may contain personal or sensitive information and flags them for review. | | [**Form Privacy**](https://docs.germainux.com/management/compliance-privacy-and-security/form-privacy-and-ux-monitoring-profile-view.md) | Helps prevent user-entered form values from appearing in Session Replay recordings. | Organizations should configure these controls according to their data classification, privacy requirements, and intended use of AI capabilities. ## 4. AI Model and Third-Party Provider Governance GermainUX supports integrations with multiple AI model providers and deployment approaches. The model selected for a particular use case may affect processing location, data handling, retention, and other privacy considerations. AI providers used by Germain Software are subject to our Vendor Management Policy. Before enabling an externally hosted AI model, organizations should assess the applicable provider's: * Data processing and privacy terms. * Data retention and deletion practices. * Use of submitted information for model training or improvement. * Security controls and certifications. * Data residency and processing locations. * Subprocessor arrangements. The applicable AI provider and processing configuration should be evaluated based on the customer's requirements and the specific GermainUX deployment. The Germain team can recommend a model and hosting approach for each use case. ## 5. Human Oversight and Responsible AI AI-generated summaries, classifications, insights, and recommendations are intended to assist users in analyzing information and making informed decisions. AI-generated outputs should not automatically be treated as verified facts. Organizations should establish appropriate human-review procedures, particularly when AI outputs may influence decisions involving healthcare, employment, financial matters, legal obligations, or other high-impact activities. GermainUX automation capabilities can be configured to require human approval before executing designated actions. The appropriate level of oversight should reflect the sensitivity and potential impact of the activity. ## 6. Access Control and Accountability Access to AI configurations, prompts, outputs, and associated customer information should be restricted to authorized users based on their roles and business responsibilities. GermainUX supports this through role and team based permissions, dashboard and data type permissions, enterprise authentication, multi factor authentication, and IP restrictions. Access to AI settings and prompt configuration is limited to authorized administrators through these permissions. Organizations should: * Limit access to AI configuration and administration functions. * Apply least-privilege access principles. * Review access to AI-generated results and underlying customer information. * Maintain appropriate oversight of production AI configurations and automated workflows. * Review AI configurations when models, use cases, data sources, or business requirements change. See [Data Security](https://docs.germainux.com/management/compliance-privacy-and-security/data-security.md) and [Authentication and Access Control](https://docs.germainux.com/management/compliance-privacy-and-security.md#authentication-and-access-control). ## 7. How Germain Software Uses AI Internally Germain Software personnel may use approved AI tools to support product development and business work. This use is governed by our Responsible Use of Artificial Intelligence Policy: only approved tools with company controlled accounts may be used, new tools require a security review before approval, and customer data, personal information, credentials, and other confidential information may not be entered into AI tools. ## 8. Continuous Review and Improvement Germain Software reviews its security, privacy, and compliance practices as its products and AI capabilities evolve. AI related risks are included in our annual risk assessment, and AI related incidents are handled under our Incident Response Plan. We encourage customers to work with our team to evaluate AI deployment options, data-processing requirements, privacy configurations, and security controls before enabling AI capabilities in production environments. For questions regarding AI governance, privacy, or security, please contact our Security and Compliance team at [security@germainux.com](mailto:security@germainux.com). ## Additional Resources | Topic | Documentation | | - | - | | **AI configuration** | [AI Settings](https://docs.germainux.com/management/ai-settings.md) | | **AI capabilities** | [AI-Driven Insights](https://docs.germainux.com/analytics/ai-driven-insights.md) | | **Compliance overview** | [Compliance, Data Privacy and Security](https://docs.germainux.com/management/compliance-privacy-and-security.md) | | **Certifications and policies** | [Certifications and Policies](https://docs.germainux.com/management/compliance-privacy-and-security/compliance.md) | ## Get Help > [card] [Contact GermainUX Support](https://docs.germainux.com/getting-started/support.md) > > The GermainUX team helps you get up and running faster, empower your team, turn data into actionable insights, and optimize performance to deliver measurable business outcomes. > [card] Can't Find What You Need? > > Search all GermainUX docs with **Ctrl + K**, or use the feedback buttons at the bottom of this page to tell us what is missing. The content of this document is proprietary to GERMAIN SOFTWARE. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.