Security documentation and FAQs

Security documentation and FAQs

Latest security documentation

 

ISO/IEC 27OO1:2O22 Certificate click here
ISO Statement of Applicability click here

For further information on penetration testing please contact security@adeption.io

Frequently Asked Questions (FAQ): Resultant Data

How is Resultant Data derived by Adeption?

Resultant Data is created through a controlled process that transforms user-submitted content (free text responses to questions) into a fully anonymized and aggregated dataset. Before any data is used for analysis, all personally identifiable information (PII), such as names, company names, and locations, is automatically removed or replaced with generalized tokens (e.g., "[PERSON]" and "[COMPANY]").

The sanitized data is then aggregated across the platform to identify broader behavioral patterns, themes, and development trends. During this process, all user-level identifiers and organizational references are removed, and the resulting dataset is stored separately from customer records.

Resultant Data cannot be linked back to any individual user or customer organization.

Will Adeption derive Resultant Data from free-text data entered by the customer's people?

Resultant Data cannot be linked back to any individual user or customer organization. While free-text responses may contribute to Resultant Data, they are only included after an anonymization process has been completed. Raw identifiable content is stored securely and is not used for cross-client insights, model training, or aggregated AI outputs.

How does Adeption ensure that Resultant Data cannot identify individuals?

Adeption applies a multi-stage anonymization and aggregation process before including any data in Resultant Data. Personally identifiable information (PII), including names, company names, locations, email addresses, and other identifying details, is automatically removed, masked, or generalized. User-level identifiers (like IDs or keys) and organizational references are stripped from the data before it enters any aggregation or AI processing workflow.

Resultant Data is generated only after this anonymization process and is used solely in an aggregated form to identify broader behavioral patterns, themes, and trends. As a result, the data cannot be used to identify any individual participant.

Will Resultant Data be held or used by Adeption in a format that links back to the customer in any way?

No. Resultant Data is stored and used separately from customer records and does not retain identifiers that would enable Adeption to link the data back to the customer, its users, or any specific organization. The process intentionally removes the technical and data relationships required to re-establish such a connection.

Consequently, Resultant Data exists only as a non-identifiable, aggregated dataset and cannot be traced back to the customer or any individual participant.

Some platform features may ask people to describe situations they’ve been in. Does the platform have anything to guide users to avoid entering information about other people?

The Adeption platform enables participants to share their insights and experiences with the wider group by making responses to selected questions visible to others. These questions are clearly marked with a "Visible to others" label, ensuring participants are aware that their responses will be shared before they submit them.

All other questions remain private, and the responses are accessible only to the individual participant and their coach.

Can a customer own Resultant Data?

No. This is a commonly asked question and the answer is that Resultant Data is not related to any one individual or customer. It is anonymous aggregated data and therefore it cannot be linked or attributed to any one customer. This means it is not possible to be owned by any one customer. Furthermore, as Resultant Data is created as a result of all activity on Adeption’s platform and is not in service of any one individual customer, it is used to provide the features for all platform users.

Frequently Asked Questions (FAQ): AI Data Processing

Does enabling AI cause user-generated content to be sent to an external AI provider?

No. Enabling AI within the Adeption platform does not cause user-generated content to be sent to any external or third-party AI providers.

All of Adeption’s AI features and ML models are entirely proprietary and developed completely in-house. Our entire architecture operates within a secure, self-contained Microsoft Azure private cloud infrastructure. This ensures that user-generated content is isolated within our managed boundaries, never leaves our environment, and is never exposed to external AI vendors or the public internet.

Because Adeption does not engage or integrate with any external third-party AI platforms to handle user data, there are no external AI providers to disclose or list within our subprocessor documentation. All processing, evaluation, and system workflows are maintained entirely within Adeption’s directly managed cloud tenants.

Is the AI inference call stateless — does Adeption discard inputs / outputs after inference, or retain them?

The AI inference calls within the Adeption platform are completely stateless.

When a user interacts with our AI features (such as AIVA Insights or AIVA Assist), the underlying Large Language Model (LLM) - which is hosted privately inside our secure cloud infrastructure - evaluates the prompt in real time strictly to generate the response. The model itself does not permanently retain, cache, or store the text of these inputs or outputs after the inference operation is complete.

Adeption’s internal architecture enforces this through several strict safeguards:

  • Data and Model Separation: Customer data is never permanently injected, embedded, or saved into the foundational model logic. Instead, it is extracted dynamically in real time from a logically separate, isolated customer AI Index only for the duration of that active user session.
  • No Model Retraining: Inputs and outputs from inference calls are never retained by the provider to train, retrain, or adjust the underlying foundational models.
  • Prior Masking: Any user-generated content undergoes strict entity masking to strip away personally identifiable information (PII) before it is ever sent to the inference model.

While raw user-generated text answers remain securely stored within your own isolated and dedicated database tenant to maintain your historical user dashboards and coaching records, the inference pipeline itself functions entirely as a stateless pass-through.

Is customer data used to train, fine-tune, or improve Adeption’s AI model?

No. Enterprise data is not used to train, fine-tune, or improve either Adeption's proprietary AI models or the underlying AI models provided by Microsoft Azure OpenAI. Customer data submitted to the Adeption platform is used only to provide the contracted service, including retrieval-based AI features (RAG). Before any content is indexed for retrieval, it undergoes automated sanitization and anonymization processes to remove or mask personally identifiable information (PII).

Adeption does not use customer-specific data to fine-tune foundation models, and Microsoft Azure OpenAI does not use customer prompts, completions, embeddings, or indexed content to train or improve OpenAI, Azure OpenAI, or other Microsoft AI models. Data processed through Azure OpenAI remains within the customer's Azure environment and is used solely to deliver inference services.

Where Adeption develops proprietary AI capabilities, training is performed only on approved, anonymized, and aggregated datasets that cannot be used to identify individuals or customer organizations.

Does the Adeption have an independent security certification supporting its platform, AI features and data storage?

Yes. Adeption operates an ISO/IEC 27OO1:2O22 certified Information Security Management System (ISMS), which governs the security, privacy, access control, monitoring, supplier management, and data protection processes applied across the platform, including AI-enabled services.

In addition, the AI services used by Adeption are hosted on Microsoft Azure's enterprise cloud infrastructure. Microsoft maintains independent security certifications and attestations, including ISO/IEC 27OO1 and SOC 2, which apply to the Azure services supporting Adeption's AI capabilities.

This combination of Adeption's ISO 27OO1-certified security management practices and Microsoft's independently certified cloud infrastructure provides a layered approach to the protection of customer data used within Adeption's AI features.

If you would like any further information,

please get in touch