AI Usage Policy

Introduction

Certain products on the Euphile platform use artificial intelligence features. AI models are provided by third-party providers; the providers engaged by default, where they process data and what they retain are set out in this policy, and they are listed as sub-processors in the Security Policy.

1. AI Features on the Platform

The platform incorporates artificial intelligence capabilities in select products. These capabilities are delivered through external model providers and operate under data processing conditions compliant with EU data residency requirements.

AI System Providers and Data Processing

1. Providers and Processing Locations

By default, the platform's AI features run on two providers.

OpenAI models are served by Microsoft through Microsoft Foundry (Azure OpenAI Service), from a resource located in France (France Central) on European Union data zone deployments: prompts and responses are processed within Microsoft's European Union data zone (the Azure EU Data Boundary), data at rest stays in France, prompts and completions are not made available to OpenAI and are not used to train models, and abuse-monitoring review for deployments in the European Economic Area is carried out by Microsoft staff located in the European Economic Area.
Mistral models are served by Mistral AI SAS (Paris, France) on La Plateforme, through Mistral's European Union regional endpoint: inference runs in the European Union, data is hosted in the European Union by default, and API inputs and outputs are kept for thirty rolling days for abuse monitoring.

Both providers are listed as sub-processors in the Security Policy, section "Sub-Processors and Service Providers", with their data processing agreements.

On request, a different provider can be configured for a customer instead of the defaults: a direct account with OpenAI, Google Gemini, Anthropic, OpenRouter or Kilo, or a model the customer runs itself (bring your own model). Such a provider is not engaged by default. When the customer supplies its own account, the provider acts under the customer's agreement with it, in the location the customer chooses; when revzper SAS configures the provider at the customer's request, it is named to that customer as a sub-processor before use, as the Data Processing Agreement provides.

Restrictions on AI Usage

1. Prohibition of Automated Legal Decisions

The platform does not utilize AI-generated content to make automated decisions that produce legal effects on users or significantly affect their rights.

Identification of AI Features

1. Standardized AI Feature Labeling

AI features are clearly identified in each product interface using standardized labeling. For example, AI features are labeled with the '[AI]' tag and accompanied by a disclaimer text that links to this AI Usage Policy.

Data Submission to AI Features

1. Processing by Third-Party AI Providers

Data submitted to AI features may be processed by the AI provider under their data processing terms. Users are advised to review the applicable terms of the third-party AI model provider.

2. Code Analysis in Nassau

When you ask Nassau to analyse a scan finding with AI, it sends: for a first triage, up to 3,000 characters of the file around the finding; for a deep analysis, the file (up to 60,000 characters), up to 6,000 characters of facts collected on your computer and up to three further excerpts or searches of the repository the AI asks for, and, when the AI's first answer is not settled, up to four further requests, each with up to 16,000 characters of the file, and across them up to 20,000 characters of the further checks the AI asks for (excerpts, listings and searches of the repository, details of commits and installed packages, and the programs listening on network ports of your computer or running with a word it names, by name, process number and start time, never their command line); to generate a fix, the file and the analysis. These requests go through the platform's AI gateway to the providers named in this policy, or to the provider you configured; a model that runs on your own computer receives them there. The platform does not store them or use them to train models; what a model provider does with them is governed by its own terms, as "Use of Your Data to Train AI Models" explains. In Nassau's Settings you can stop the facts, searches and checks from being sent; the AI then sees only the flagged file.

3. Use of Your Data to Train AI Models

revzper SAS does not use the content you submit to AI features, or the answers they produce, to train or fine-tune AI models, and has no interest in doing so, with one exception: feedback you choose to give for that purpose, described below. This commitment covers what revzper SAS does; it cannot extend to what an AI provider does with the requests it processes. The platform's default providers process them under the terms described in "Providers and Processing Locations"; a provider you configure with your own account processes them under your agreement with it, and revzper SAS cannot guarantee that such a provider does not use them for training. Models that run on your own computer, where an application offers them, are openly published models used as published: revzper SAS has not trained or fine-tuned them, and what you send them stays on your computer. revzper SAS believes that AI features become more effective when a model is fine-tuned for a specific use, but it does not fine-tune models today. Fine-tuning on a customer's data will only ever be for that customer, as part of an enterprise offer, under a written agreement and on data that customer has explicitly designated for that purpose. The only other data revzper SAS may use to train or fine-tune the AI models of the platform's features is feedback a user agrees to give for it: where an application offers feedback, a separate box, unticked every time and never ticked for you, asks whether that feedback may be used to train and evaluate the platform's AI models; only if you tick it, and only after the secrets and the data identifying a person are removed from it, does it join a dataset kept for at most one year, as the Privacy Policy describes.

User Control Over AI Features

1. Opt-Out of AI Features

Users may opt out of AI features where such options are made available in the product interface.

Your Responsibility When Using AI

AI output can be wrong, incomplete or out of date, and an AI agent acting on your instructions can take an action you did not intend. AI features are assistance, not advice, and they do not replace your own review.

You remain responsible for the instructions you give to AI features and AI agents, for checking their output before you rely on it, and for every action they take with your account, your credentials or your systems. The Terms of Service set out the limits of revzper SAS's liability in this respect.

3. Models You Choose in Nassau

In Nassau you can choose the model that serves its AI features: a model the platform provides, where your account includes it; an AI provider you configure with your own account and key; or, where Nassau offers it, a model that runs on your own computer. With a model on your computer, the content of that request does not leave it; such a model is an openly published model that revzper SAS has not trained or fine-tuned. With a provider you configure, the content is sent to that provider under your own agreement with it, and that provider's terms, not this policy, govern how it processes, keeps or uses the content, including for training, which revzper SAS cannot guarantee it does not do. When you choose a provider or model other than those the platform provides, you are responsible for that choice, for knowing where the content goes and how it is handled, and for being entitled to send it there, whatever your role in Nassau, including creator or administrator. revzper SAS is not responsible for the processing carried out by a provider or model you chose.

4. Models That Run on Your Computer

Where Nassau offers models that run on your own computer, it offers only openly published models that revzper SAS has tested, and AI Settings shows each model's publisher and license. Nassau downloads such a model when you ask for it; the first time Nassau starts with this feature, it also downloads, once and in the background, a default model your computer can run, and none if your computer cannot run one. The files come from the hosting service on which the models' publishers publish them, which receives your computer's address as for any download, and Nassau checks each file against the fingerprint revzper SAS recorded when it tested the model before it uses it. Each model is the work of its publisher and is licensed to you by that publisher under its own open-source license, which applies to your use of it; revzper SAS does not claim ownership of it. Nassau runs these models with an open-source program included in Nassau, under that program's own license. Nassau works out on your computer whether a model suits it, from its graphics card, memory and processor.

5. The Model Results Nassau Shows

The results Nassau shows for these models, such as how well and how fast each did on each kind of task and in each language, are measurements revzper SAS made on its own tasks and on its own computer. They are there to help you compare the models; they do not promise how a model will do on your work or on your computer. The same holds for a model Nassau recommends for a task. What such a model produces can be wrong, like any AI output.

6. Checking a Fix With the Repository's Own Tests

Where Nassau offers to check a proposed fix by running the tests or the type checker of the repository it fixes, it runs them on your computer, and only once you have confirmed it for that repository. They are that repository's own code: they run with the permissions of your account on your computer, as if you ran them yourself, and can do whatever that code does. Confirm it only for a repository whose code you trust. What they report is given to the AI model that proposes the fix, like the other content of the repository that model reads.

Compliance with EU AI Act

This policy is provided in compliance with EU AI Act transparency requirements.