AI data handling

AI data handling policy

How AI features should be scoped, reviewed, and governed when connected to tenant-specific ERP data.

Last reviewed: 2026-09-24. Final contractual commitments must be reviewed before signature.

Review status: The AI providers, the data each receives and where it is processed are on the published sub-processor list. A workspace limits or stops what reaches them in Settings > AI Agents.

Tenant-scoped context

AI features should only receive the tenant context needed to answer the user request and should avoid generic cross-tenant memory.

Use tenant context builders rather than hardcoded company assumptions.
Avoid sending secrets, passwords, or unnecessary personally identifiable data.
Log AI actions with enough metadata for support review without exposing sensitive payloads.

Human confirmation

AI output is advisory unless a workflow explicitly requires and records a human-confirmed action.

Require confirmation for financial, inventory, approval, payment, and shipment actions.
Show citations or source records for tenant-specific answers where practical.
Treat anomaly, forecast, and recommendation output as decision support.

Provider review

The AI providers, the data each receives and where it is processed are named on the published sub-processor list, which the DPA incorporates. Provider retention and training-use terms are the providers' own.

Review the AI entries on the sub-processor list before enterprise rollout.
Document whether customer data is used for provider training.
Settings > AI Agents (master admin) sets the workspace's AI data mode: standard; masked (email addresses, phone numbers, NRIC and card numbers masked on every AI feature, images refused); or off (nothing is sent).

Buyer checks

Questions this document should help answer.

Can AI answers cite ERP records?

Can risky actions be blocked until human confirmation?

Can AI be disabled for a tenant or role?

Which provider processes AI prompts and responses?