Skip to content
English
Contact us
  • There are no suggestions because the search field is empty.

Documoto RAG Pipeline & LLM Data Security Policy

Documoto is committed to maintaining the confidentiality, integrity, and security of customer data. This policy ensures that AI-driven capabilities can be delivered without exposing customer information to unapproved third-party AI services or public AI systems, while maintaining strict control over data access and processing boundaries. 

 

Article Topics

1. Purpose

This policy defines the data handling, processing, and security standards governing the use of Retrieval-Augmented Generation (RAG) and Large Language Model (LLM) technologies within the Documoto platform.

2. Scope

This policy applies to all Documoto systems, services, employees, contractors, and partners involved in the development, operation, or use of AI-powered features, including but not limited to RAG pipelines and LLM-based functionality.

3. Policy Statement

3.1 Prohibition of Third-Party LLM Data Sharing

Documoto strictly prohibits the transmission, processing, or exposure of customer data to unapproved external AI services or public LLM APIs, including but not limited to:

  • OpenAI (ChatGPT)

  • Google (Gemini)

  • Anthropic (Claude)

Under no circumstances shall customer data be sent to, processed by, or stored within external AI systems not explicitly approved for use within Documoto’s AWS environment and governance controls.

3.2 Terms of Service Enforcement

The use of unapproved third-party LLM technologies in connection with customer data constitutes a violation of Documoto’s Terms of Service. Any such usage is unauthorized and subject to enforcement actions, which may include suspension of access, termination of services, or other remedies as defined in contractual agreements.

3.3 Approved Infrastructure Requirement

All AI capabilities used within the Documoto platform must operate through approved AWS-managed services operating within Documoto’s AWS account and defined security boundaries and governed by Documoto security, privacy, and compliance controls.

3.4 Data Isolation and Control

Documoto ensures that:

  • Customer data remains logically isolated within secure environments.

  • Data is not used for external model training or shared across tenants.

  • Access to data is restricted to authorized systems and personnel only.

  • Customer data processed through AWS-managed AI services is not used to train foundation models and is handled in accordance with AWS data protection, privacy, and service-specific security controls.

3.5 RAG Pipeline Data Flow

Within the RAG pipeline:

  1. Customer queries are processed within Documoto systems.

  2. Relevant documents are retrieved from securely stored, indexed customer content.

  3. Retrieved data is processed by approved AWS-managed foundation models.

  4. Responses are generated through approved AWS-managed services rather than public consumer AI tools or unapproved third-party APIs.

This architecture ensures that data processing remains restricted to approved AWS-managed services within Documoto’s controlled cloud environment and is compliant with this policy.

4. Compliance and Governance

Documoto maintains governance controls to ensure adherence to this policy, including:

  • Infrastructure-level controls to restrict and monitor external data egress to unauthorized AI services.

  • Monitoring and auditing of data flows within AI systems.

  • Enforcement mechanisms aligned with contractual and legal obligations.

5. Customer Assurance

Documoto is committed to maintaining the confidentiality, integrity, and security of customer data. This policy ensures that AI-driven capabilities can be delivered without exposing customer information to unapproved third-party AI services or public AI systems, while maintaining strict control over data access and processing boundaries.