AI Policy

Our commitment

Pistachio AS and its subsidiaries (Pistachio) use artificial intelligence (AI) to make security work better for our customers. We use it openly, carefully and in line with the EU AI Act, the GDPR and the UK GDPR. This policy covers AI in our products, the AI tools our people use, and the AI services we buy from others.

Where we use AI

Today, we use AI in these areas. Any new product or feature follows the same principles.

Our principles

• People decide. AI gives information, never decisions. That holds in our products and inside Pistachio: no AI system makes decisions about your employees or ours.
• Privacy by design. Our AI only gets the personal data it strictly needs.
• Open about it. We tell customers where we use AI, what data it uses and how it is safeguarded.
• Fair by design. We instruct our models to avoid bias, check their results for consistency, and design our products to show only what matters for security, never a full picture of someone’s work.
• Secure like everything else. AI components sit under the same security controls as the rest of our platform.
• Skilled people. Everyone who builds, runs or oversees our AI is trained to understand what it can and cannot do.
• No training on your data. We do not train AI models, and your data is never used to train our providers' models.

People stay in control in Presence

1. AI looks for patterns. Models review activity log metadata. They never see email or file content, passwords or browsing history.
2. Results are checked. Findings are validated before they become alerts, to keep false alarms low.
3. Your team reviews. Your IT administrator looks at the underlying activity logs and decides if there is a real concern.
4. You decide. Your team decides what happens next. The AI never does.

AI providers

Every AI provider we use must:

• sign a data processing agreement with us,
• keep data in the EEA or an equally protected jurisdiction,
• show strong security practices, such as recognised certifications or an equivalent assessment,
• never use your data to train their models, and
• give us the technical documentation and usage guidance the EU AI Act requires.

Supporting our customers

When you act on a Presence alert, you are a deployer of an AI-assisted tool under the EU AI Act. We help you meet your obligations by:

• explaining clearly what Presence does and does not do, and what data it uses,
• supporting your own impact assessment with information about Presence,
• stating in our contracts that Presence outputs are AI-generated and need human review, and
• giving guidance on telling your employees that Presence is in use.

Our legal team is happy to help with any documentation you need, including your impact assessment and information for your employees or works council. Email privacy@pistachioapp.com.

Governance

Our Chief Operating Officer is accountable for AI at Pistachio. That includes keeping an inventory of every AI system we use, making sure our people are trained, handling any AI-related incident and reviewing each AI system at least once a year. We review this policy every year, and sooner if our AI, the law or regulatory guidance changes.

Where to find more

• Privacy Notice: the data our AI uses, where it runs, and our EU AI Act assessment.
• Permissions: what we access in your Microsoft tenant.

Version history