AI Data Use Policy

Audon helps organizations understand what they spend on AI. Customers reasonably want to know whether we, in turn, feed their data into AI. This Policy answers that question precisely. It describes the practices of Audon Software LLC, the operator of Audon, and should be read with the Privacy Policy (document id privacy) and the Data Processing Addendum (document id dpa).

1. Summary

• We do not send customer data to any large language model or other AI model. Findings are produced by deterministic rules and calculations, not by an AI model.
• We do not train, fine-tune or evaluate AI models on customer data.
• We do not sell, license or share customer data as a dataset, including with AI labs.
• We do not read your prompts or responses. Our provider connectors read only aggregated cost and usage reports.
• These are defaults that you do not need to opt out of. Changing any of them would require a separate written agreement with you.

2. Different kinds of use, kept separate

3. What data we have, and what we do not

We retrieve (through the read-only connectors using the OpenAI Organization Admin API key and/or Anthropic Admin API key that you supply): daily aggregated cost and token usage reports, by project or workspace, model, line item and API key id.

We receive, only if you choose to send it (through the Telemetry API): run ids, workflow ids, status, verification type, estimated cost, token counts, retry and tool-call counts, and up to 20 operational metadata keys. The API rejects metadata keys that suggest prompts, content, personal data or secrets.

We do not retrieve or receive: prompts, model responses, files, embeddings, fine-tuning data or end-user data. There is a "raw prompt capture" setting in the product data model; it is off by default and not implemented. It cannot be turned on today. If we ever implement content capture, it would be off by default, require separate explicit opt-in by an authorized administrator, apply redaction, and be announced in advance with an update to this Policy, the Privacy Policy and the DPA.

4. Your AI providers' terms

Your use of OpenAI, Anthropic and other providers is governed by your agreements with them. Our access to your provider reports is based on your authorization and is used only to provide the Services to you. Nothing we do changes how your providers treat your data.

5. The "research data use" setting

The product contains an organization setting called research data use. It:

• is off by default;
• currently does nothing — no data is collected, retained, used or shared differently when it is changed; and
• is not consent to, or a licence for, any use of your data for research, training, evaluation or resale.

We may in future explore research partnerships (for example, for evaluating the reliability of AI agents). Any such use of customer data would require all of the following before it began:

1. a separate written agreement signed by an authorized representative of your organization, describing exactly which data, which purposes, which recipients, the duration and the safeguards;
2. confirmation that the use is permitted by your AI providers' terms and by applicable law, including any rights of the individuals concerned;
3. record-level provenance controls, so that each record carries its source, permitted purposes, retention and deletion obligations;
4. the ability to withdraw, with withdrawal actually stopping further use; and
5. an update to this Policy, the Privacy Policy and the Subprocessors list.

A checkbox, a general setting, use of the API or acceptance of the Terms of Service is not sufficient for any such use.

6. If we add AI features in future

If we introduce a feature that sends data to an AI model (for example, a natural-language explanation of a Finding), we will:

• make it optional and off by default for existing organizations;
• name the AI provider as a subprocessor, with its region and data retention terms, and give the 30-day subprocessor change notice in the DPA;
• send only the minimum data needed, and never your provider credentials;
• choose providers and settings under which the data is not used to train their models; and
• update this Policy before the feature becomes available.

7. Agents using Audon

When you connect your own AI agent to Audon (via MCP or API key), your agent receives data from us within the scopes you grant. What your agent, and the AI model behind it, does with that data is governed by your arrangements with your agent and model providers, not by this Policy. Grant only the scopes your agent needs.

8. Contact

Questions about this Policy: To be confirmed: privacy contact email.