Snapshot 38452
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Skip to content TRUST · AI GOVERNANCE AI Subprocessor Disclosure Effective 2026 · What AI processes your data, and how CyberComply uses a single AI subprocessor, and only for generating your documents and guidance. It is never used to make automated decisions about you, and it processes no payment, credential, or client tax data. This is an example of the vendor vetting record that supports firm compliance procedures under IRS Circular 230 §10.36 — and a worked example of the vetting artifact CyberComply helps your firm produce for the AI tools you use. AI subprocessors (1) Anthropic, PBC Claude API (Anthropic commercial / business tier) · Sole AI subprocessor — all AI-assisted features Purpose Drafting policy and WISP language, generating compliance guidance and remediation explanations, and writing the narrative sections of readiness and advisory reports. Data processed Only the program data needed to produce the specific deliverable requested: your selected frameworks, control gaps, company profile (name, industry, size), and the finding being explained. Never sent No card numbers, no passwords or connector credentials, no client tax data or return contents, and no breach-monitoring results are ever sent to the AI provider. Model training Under Anthropic's commercial terms, inputs and outputs are not used to train its models. Retention Processing is transient; Anthropic's commercial data-retention terms apply. No customer data is retained by the provider to build a profile of your firm. Region United States Safeguards Encrypted in transit (TLS); access to the API key is restricted and audit-logged; governed by Anthropic's Commercial Terms and DPA. No key, no AI. When no AI backend is configured for your account, CyberComply produces every document and recommendation from deterministic, rules-based logic. In that mode no customer data reaches any AI provider — the AI subprocessor above processes nothing. Scope Non-AI subprocessors — hosting, payment processing, email delivery, and optional breach monitoring — are disclosed in our Privacy Policy. AI is used to assist in producing your deliverables; it does not make automated decisions about your firm, your eligibility, or your compliance status. You review and adopt what it drafts before relying on it; on managed plans a named advisor also reviews it. Vetting your own AI tools Circular 230 §10.36 puts the same question to your firm about every AI tool your staff use. In CyberComply each one goes in your vendor register, and your AI usage policy and staff training cover how they may be used. See the vendor register in the live demo or copy our own answers into your file. CyberComply is a product of DigComply Solutions Private Limited (in association with CA4CPA Global LLC). © 2026 DigComply Solutions Private Limited. Questions: [email protected]