AI Policy

This policy is authoritative. Procurement reviewers, DPOs and information-governance officers assessing how we use AI should treat it as our statement of record. It applies to both products and to how we run the company.

The policy in one paragraph

We use AI in two places and we are explicit about each.

In our products, AI means rule-coded detection and one machine-learning detector, which surface candidate redactions to a human operator who makes every final disclosure decision. Your documents never leave your own machine or your own cloud, and we send no customer content to any third-party AI service under any tier. In our company operations, AI means agentic workflows that let a very small team do work a conventional software company would staff with many more people — with humans keeping ownership of architecture, judgement and final approval on everything a customer sees. Four boundaries hold across both: the operator makes every final redaction decision; your documents stay inside your own boundary; you control what leaves your machine; and we label our own use of AI assistance. This policy says how each works, where the limits are, what happens when they move, and how you can check.

1. Definitions

• AI — any system that produces outputs by inference rather than by explicit rule-coded logic. Covers machine-learning models that classify, detect or rank; large language models that generate or transform text; and agentic systems that combine models with tools to take multi-step action.
• Deterministic detector — a rule-coded pattern matcher (regular expressions, lookup tables, signal tables) that uses no machine learning at runtime. SurePrepare’s record filter is one. In SureRedact, three of the four shipping detectors are deterministic: phone (regular expressions, a phone-number parsing library and context heuristics), email (regular expressions and role-prefix allowlists), and credential (regular expressions with entropy and keyword-proximity checks — no model).
• ML detector — a machine-learning model that detects candidates in documents. In SureRedact exactly one shipping detector is an ML detector: signature, a model bundled with the application and run on your own machine. Under this policy’s own definition of AI, the other three are not AI at all.
• Third-party AI service — a hosted model service operated by someone else, who would receive your content if it were sent to them.
• Customer content — any document, email, attachment or extracted text originating inside your organisation and relating to a Matter you are preparing for disclosure.
• Operator — the person at your organisation who runs SureRedact or SurePrepare for a Matter, and who is accountable for the disclosure it produces.

2. Two layers, kept separate

AI in our products and AI in our company operations are different things with different boundaries. Conflating them is a common failure in procurement conversations and it produces commitments nobody can keep. We do not conflate them.

2.1 In our products — what runs against your content

Shipping today:

• SureRedact — rule-coded and machine-learning detection. The product surfaces candidate redactions, each labelled with a type, to the operator. The operator approves, edits or rejects every one before any redaction is applied. Applied redaction is forensic — the page is rasterised, so removed content is not recoverable from the file — and happens only after explicit operator action. Rule-coded detection covers phone, email and credential; machine learning covers signature only.
• SurePrepare — rule-coded only. A filter scores the imported material against a set of rule-coded signals and surfaces include, exclude or review verdicts. The operator triages every record needing a decision. There is no language model in SurePrepare; one appeared in early preview builds and was withdrawn when small local models did not meet the quality bar for this audience.

Possible later, and gated:

• Local language-model assistance in SurePrepare, only if it passes a published evaluation covering extraction accuracy, filter relevance, operator override rate, latency on ordinary hardware, and installation. If it passes, it returns opt-in and off by default, with the rule-coded filter kept as the primary signal. If it does not, we say so.
• Further SureRedact detectors for additional types — names, identifiers, dates of birth, addresses, financial and medical terms. Each would surface candidates; the operator would still decide.

Never, under any tier:

• Sending your content to a third-party AI service. Not your documents, emails, attachments, extracted text, scope files, decisions logs or disclosure packs — not to OpenAI, Anthropic, Google, Cohere, Mistral, AWS Bedrock, Azure OpenAI, or anyone else. This is a category commitment, not a tier feature.
• Autonomous final redaction. Operator review is not advisory. There is no combination of setting, feature flag, licence entitlement or configuration that makes the product apply candidates on its own.
• AI deciding disclosure scope. The filter surfaces verdicts; the operator confirms scope at every gate.

2.2 In our company operations — how we run SureMatters

SureMatters is a very small company that uses AI agents to do work a conventional software company would hire for. That is a deliberate design, not a temporary stage: it keeps senior human judgement as the constraint on quality rather than headcount, and it is why a company this size can maintain a corpus of trust documentation at all. Agents amplify volume. They do not substitute for judgement.

In practice:

• Engineering. Planning, code generation, review, documentation and test generation use agentic workflows under human ownership. Every commit is reviewed by a human before it reaches anything a customer receives. Architecture, schema changes, contract changes and security-sensitive code are human-authored or rewritten from agent drafts and reviewed line by line.
• Support. Triage and drafting are agent-assisted with human review on every outbound message. You will see a named human on every reply.
• Documentation and communications. Compliance updates, questionnaire responses, blog posts, release notes and customer communications are drafted by agents working from our internal corpus, then edited and signed by a human.
• What this rules out. No outsourced content or engineering teams. No outbound sales motion. No arrangement in which a person supervises agents as their whole job — agents work for senior people, not the reverse.

Where AI assistance has been used in something you read, we say so. Hiding it would contradict everything else in this policy.

3. The four boundaries

These apply across both layers and every tier. They are not marketing statements. Walking back any of them requires a dated revision here, an entry in our decision record, and the notice described in §8 — not a quiet configuration change.

3.1 The operator makes every final redaction decision

The commitment. No redaction is applied, and no record is included in or excluded from a disclosure pack, without an explicit operator action — a click, a keyboard shortcut, or a confirmed batch operation — logged in an append-only decisions record with timestamp, operator identity and before-and-after state.

How to check. Open the disclosure pack’s decisions.jsonl: every applied redaction has a matching operator decision. The application only ever appends to this record; it never updates or deletes a row. At export the log is sealed into a chained-hash form whose first and last hashes ship inside the pack, so any later alteration is detectable by recomputing the chain from the pack alone.

Why it matters in law. Solely automated decision-making about individuals is governed by UK GDPR Articles 22A to 22D, which the Data (Use and Access) Act 2025 introduced in place of the former Article 22 and section 14 of the Data Protection Act 2018. The framework requires that people be told about significant decisions made about them, be able to make representations and challenge them, and be able to obtain human intervention.

Our commitment does not depend on where the threshold sits. The DUAA moved automated decision-making from a prohibition with narrow exceptions to a permissive framework with safeguards — the law now allows more automated deciding than it did, and we do less of it than the law permits. We keep a human on every redaction decision as a matter of design, not because we are compelled to.

3.2 Your documents stay inside your own boundary

The commitment. Your content — documents, emails, attachments, extracted text, scope files, decisions logs, bundles passed between the products, disclosure packs — is processed inside your own infrastructure. SureRedact and SurePrepare are desktop applications and run on the operator’s own computer. Where SurePrepare imports from a platform it does so through a connector, and where that connector needs a deployed helper, the helper runs in your cloud under your credentials. Your content does not transit any infrastructure we operate, any third-party AI service, or any processor not named in our sub-processor list.

What does reach us. Today: error reports, and nothing else. When something goes wrong, the application can send a crash report — stack traces, error messages, version and operating-system family, and a pseudonymous device identifier — with file paths, exception messages, request bodies and stack-trace local variables stripped on your machine before anything is sent. It goes to an EU-resident error-tracking provider named in our sub-processor list, and you can switch it off.

We do not currently operate a telemetry service, and none has ever been transmitted to us. Where the products record operational information about their own use, it stays on your machine. If that ever changes, it changes under §8.

How to check. Inspect your own firewall or DNS logs while running either product. You should see outbound traffic only to the error-reporting endpoint — and none at all if you have switched it off — plus any endpoints you have configured yourself, such as your own cloud tenancy for a connector. There should be no traffic to us and none to any AI service. If you see anything else, tell us at security@surematters.com.

3.3 You control what leaves your machine

The commitment. Error reporting is the only thing the products transmit, and switching it off is unconditional — you are asked on first run and can change it in Settings whenever you like. No paywall, no rationing, no shame-design, and no trade in which leaving it on suppresses prompts or unlocks anything. It works the same on every tier.

Operational records cannot be switched off, because they never leave your machine. They are recorded locally, and Settings → View telemetry log shows you every one with a button to clear them. If we ever transmit them, a real off-switch will exist before we do, on the terms above.

How to check. Switch error reporting off and inspect your network logs: there should be no outbound traffic to us at all. Open the telemetry log and clear it — that is the local record, visible and yours to delete. Source code is available for procurement audit on request.

3.4 We label our own use of AI assistance

The commitment. Where AI assistance has been used to produce something a customer reads — a support reply, a website page, a blog post, a policy document, a release note, this policy — it is labelled where the customer can see it, and a named person has reviewed it.

Why. You are choosing us partly on how we behave. Concealing agent involvement in our own writing would contradict what we ask you to trust about the product. It costs us little and we accept it.

4. In-product AI: the detail

4.1 How detectors are built and updated

1. Training data. Detectors are trained on public corpora and on synthetic data we generate. No customer content is used in training, ever. If we ever offer a way for customers to contribute material, it will be explicit opt-in with a preview of exactly what would leave the machine, and it will be described here first.
2. Training infrastructure. Training runs on infrastructure we control, and trained weights are stored by us. We do not outsource training to a third-party platform that would receive the data.
3. Signing. Detectors ship as signed bundles, using a key we control in a managed key service, and the signature is verified before a bundle is used.
4. You choose when to update. The products do not update themselves. You download a new version when you decide to, and you can stay on the one you have.
5. Changelogs. Where a release changes how the software identifies material for your review, it is published with a changelog saying so, so you can decide whether to take it.

4.2 Confidence is a ranking, not an authority

The products derive a confidence value per candidate and use it to order candidates for the operator’s attention. It is not presented as authority and it does not override the operator’s decision. Where a compliance regime requires an explicit operator confidence statement, both the derived value and the operator’s own are kept in the audit record.

4.3 If language-model assistance is introduced

Unconditional constraints, should it ever ship:

• Local inference only. Any model that touches your content runs on your machine or inside your own tenancy. No third-party API path.
• Operator authority preserved. Model output is a suggestion, never a decision.
• No pipes on show. The operator does not see model names, prompts or token counts.
• A published quality bar. You can read the evaluation that gated the decision.

5. In-operations AI: the detail

5.1 What agents do, and what they do not

Agents draft, review, search, summarise and generate code. They do not:

• make hiring, pricing or contract decisions;
• send anything to a customer without human review;
• approve or deploy a release;
• sign any agreement or any document with legal effect on a customer;
• reach systems holding customer content without explicit human authorisation.

5.2 Human review

Every customer-facing artefact produced with agent assistance is reviewed by a named human, substantively — a line edit, not a rubber stamp — and the reviewer is recorded: in commit history for code, in a review record for copy, and on the artefact itself for documents like this one.

5.3 Which AI tools we use

Current as at the date above. You can ask for the current list at any time, and we update this section when it changes.

• Claude Code and the Claude Agent SDK (Anthropic) — agentic engineering and authoring. Anthropic is named in our sub-processor list. No customer content is sent to Anthropic through these tools.
• Code-completion assistants in the editor — at engineer discretion, under the same review standard. Engineers work against synthetic data and public datasets; customer content is not present.
• Image and design tools — for website and product imagery. No customer content.

5.4 What agents are never given

Customer-content-bearing files; customer credentials, keys or tokens; per-Matter customer data; and personal data about customer staff beyond what a support request requires. Agents work against our own internal documentation, synthetic test data and public material — never against live customer artefacts.

6. How to verify what this policy claims

Also available:

• The sub-processor list — everyone who processes data on our behalf, and on what basis.
• The Security overview, with the full document on request.
• A DPIA template and a data processing agreement, both on request from policy@surematters.com. Neither is published.
• Source code for procurement audit, on request and under an appropriate agreement.

7. How this interacts with data subject rights

Plain-language summary. For legal authority, consult your own advisers and the regulator’s guidance.

7.1 Right to be informed (Articles 13 and 14)

When you use our software to prepare a disclosure, the person receiving it is entitled to know how their data was handled. Our position: AI-assisted candidate detection is not a solely automated decision, because your operator confirms every redaction. Your own privacy notice should reflect that — wording along the lines of “we use specialist disclosure-preparation software in which a caseworker reviews every redaction before disclosure” is usually enough. We can supply suggested wording.

7.2 Right of access (Article 15)

Unaffected by our use of AI. You remain the controller. Because your content does not reach us, we are not a processor of it at all; where we do process anything on your behalf, our processor agreement governs it and we support access requests at your direction.

7.3 Automated decision-making (Articles 22A–22D)

Because your operator makes every final redaction decision (§3.1), the disclosure your software produces is not the output of solely automated decision-making.

The Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with Articles 22A to 22D. You will still meet “Article 22” in older guidance and privacy notices; it is the provision that was replaced.

We do not claim data subjects have no rights here. The obligations sit with you as controller, and our tooling is the workflow that supports you — including the audit trail that evidences the human decision.

8. Changing this policy

• Material changes — anything touching the §3 boundaries, the scope of AI in the products, or the tools in §5.3 — mean a dated revision here, an entry in our decision record, and a notice on our website within 10 working days. Customers on multi-year contracts keep the policy text bound into their contract; a new version applies going forward.
• Corrections — where this document described our practice inaccurately and the practice itself did not change — are corrected in place and recorded in the change history. Whether a correction also needs the 10-working-day notice depends on its direction:
  • A correction that narrows what we claim about our AI — fewer components using machine learning, less inference against your content, a boundary that was always tighter than described — needs no notice. Anyone relying on the old text assessed more risk than existed. Nobody is under-protected and no boundary moved.
  • A correction that widens it, or touches any §3 boundary, becomes Material and takes the full notice — because anyone relying on the old text under-assessed, and may have approved us on a basis that was not true.

  The test is not whether the text changed. It is whether someone who relied on the old text would now be under-protected. If yes, it is Material however small the edit looks.

• Editorial changes — typographical fixes, link corrections, restructuring without a change of scope — are made in place and dated below.
• Questions go to policy@surematters.com. We aim to respond within 5 working days on substance, and 1 working day on a point of wording.

Change history

9. What this policy does not do

• It is not legal advice. It states our commitments and how we have built them; how they interact with your specific situation is for your own advisers.
• It does not bind your AI policy. Yours applies to your use; this applies to our product behaviour and our operations.
• It does not promise accuracy numbers. Those belong with the detectors, not in a policy.
• It does not rule out future capability that respects the §3 boundaries. The boundaries shape what we build; this is not a list of permitted features.
• It does not say we avoid AI. We use it deliberately and visibly. The policy is about how, not whether.

Drafted with AI assistance and reviewed by a named person, per §3.4.

This policy is meant to be readable cold, in fifteen minutes, by someone deciding whether to trust us. If it fails that test anywhere specific, write to policy@surematters.com and we will fix it.