AI Data Handling

Vered has AI inside the product rather than beside it: a chat assistant, scheduled agents that review your operation overnight, and analysis inside individual modules. To answer a question, the relevant records are sent to a large language model — so the honest statement is that your business data can reach a model, and this page is about which data, when, and under what limits.

Data is sent when a feature runs: when someone asks the assistant a question, when a scheduled agent runs its nightly review, or when someone triggers an analysis in a module. It is scoped to what the request needs — a question about a contract sends that contract, not your contract portfolio.

We train no models of our own on your data, and we do not pool tenant data for any purpose. Our model provider is Anthropic; under their API terms, content sent through the API is not used to train their models. We state that as their published position, which you can verify with them directly, rather than as a promise we are in a position to make on their behalf.

The same terms govern how long the provider keeps what it receives, and they apply to every AI feature in Vered — Bromel, the scheduled agents, the in-module analysis and the mail agent alike. Under Anthropic’s published commercial API terms, inputs and outputs are deleted from their systems within 30 days. The exceptions they publish are content their automated systems flag as violating their usage policy, which they keep for up to two years, along with the related trust and safety classification scores, which they keep for up to seven years, and anything they are required by law to keep longer. We do not send them feedback submissions. Zero-data-retention terms are available from the provider by separate arrangement; unless your agreement with us says otherwise, the standard terms apply.

The prohibitions are a mechanism rather than an instruction to the model. Actions the AI may take are declared in a registry, and that registry carries a list of categories it must never be given: writes to financial records, changes to regulated electronic records, moving a sales opportunity between stages, and sending communications outside your organisation.

The list is enforced when the code loads. If someone registers an action in a forbidden category, the product does not start. That is a different kind of guarantee from a prompt that asks a model to behave, and it is the one that matters when the question is what the AI cannot do rather than what it usually does not.

Where the AI can act, it proposes and a person confirms. It does not take the action and tell you afterwards.

AI features run inside the same boundaries as the rest of the product. A request is scoped to your organisation, and the assistant reaches only the modules your organisation licenses and only the data the person asking is permitted to see. It is not a way around permissions, and a user cannot learn through the assistant something they could not open directly.

The mail agent is off until a person turns it on for their own mailbox. Connecting it gives Vered a delegated Microsoft permission to that one mailbox: it can read mail and save reply drafts. It is never given permission to send. It cannot reach anyone else’s mailbox, and the lists it produces are visible only to the mailbox owner — not to administrators and not to other users.

What reaches a model, and when:

• Sorting. Newsletters and system notifications are set aside by their sender and message headers, with no model involved. For every other incoming message, Vered sends the sender, the recipients, the subject, the new text of the message (quoted history removed, at most 8,000 characters) and the names, types and sizes of any attachments — not their contents — so the model can say what the message asks for and how urgent it is.
• Reply drafts. Only when the person asks for one. The model receives the recent messages in that conversation and up to three of the person’s own earlier replies to the same sender, so the draft sounds like them. The draft is saved to their Outlook Drafts folder; they read it, change it and send it themselves.
• Filing a document into Vered. When a message carries a contract, the agent may suggest filing it in Vered Legal — as a new contract, or as the next version of one already in negotiation. That suggestion is made from the message details above and the records already in Vered, with no extra model call. The attachment itself is fetched from Microsoft only when the person opens the suggestion to review it. For a new contract, the document’s text is then sent to the model to pre-fill dates, value and governing law; for a new version of an existing contract, no model call is made. Nothing is filed until the person confirms it, and filing is subject to their existing Legal permissions.

Message bodies are never stored by Vered, and attachments are stored only once a person files them, at which point they are ordinary Legal records. What the agent does keep, and for how long, is set out in Data Retention & Deletion. Disconnecting the mailbox deletes everything the agent holds for it. Vered engineers with database access can technically see the stored details listed under Data Retention.

That access is limited and recorded. Today only Vered’s founder holds a production database credential, and direct database work is run through a single controlled script rather than ad hoc. Microsoft sign-in tokens are stored encrypted. When Vered staff need to look inside a customer’s account through the product, they use a support session that requires a written reason, is recorded in the customer’s own audit log before it begins, and ends automatically after 60 minutes. Staff look at mailbox details only to support or secure the service.

Every model call is logged with its cost, and spend is visible per organisation and per day inside the product, so you can see what is being spent and on what. Each log entry records which feature made the call, the model, the number of tokens in and out, how long it took and whether it succeeded, and at most a record reference such as a contract number. It never contains the prompt, the message or document sent, or the model’s answer. Those records are telemetry and are kept for thirteen months, as described in Data Retention & Deletion.

Features that anyone can trigger at volume carry a daily cap per organisation, checked before the call is made. When a cap is reached the feature degrades and says so rather than failing silently.

AI output is a starting point for a person, not a decision. It can be wrong, and it can be confidently wrong. Nothing it produces is legal, regulatory, financial, or medical advice, and it is not a substitute for the review your quality system requires. Where a record is subject to Part 11, a human being signs it.

Subprocessors names the model provider and what it receives. Security & compliance shows the guardrail refusing an action, and points at the code that enforces it.

Questions from your security or quality team: legal@vered.io. We will walk them through it in detail.