Home / Legal

AI sub-processors.

KivoHR’s AI suggestions are off until an organisation switches them on. When it does, these are the companies that may process what a suggestion needs, on our behalf.

Last updated 8 November 2026

In short

AI is optional and off by default. Only an account owner can switch it on, accepting our AI addendum.
Only what a feature needs is sent, masked first. Health, equality, criminal-record, biometric and location information are never sent unless a feature needs it, says so and an account owner accepts that separately. No current feature does.
No provider may use what it is sent to train its models.
We give 30 days’ notice of a new provider or location, and an organisation that objects is never routed to it.

The summary helps you read the full text below. Where they differ, the full text applies.

1. Who processes it

No AI provider is in use yet.

2. Notice and objection

We announce a new provider, or a new location for one, at least 30 days before any data goes to it, and email the account owners of every organisation with AI switched on. Until then an account owner can object in Settings, AI assistance. An organisation that objects is never routed to that provider; a feature with no other provider stays off for it, and nothing else in KivoHR changes.

3. Earlier versions

None yet.

4. What each provider’s terms say it keeps

Every provider we can use, in its own terms as they stood on 18 October 2026. The list in section 1 says which are in use, and what each keeps under the terms we have with it. None may train its models on what it is sent.

Anthropic

Inputs and outputs are deleted from its systems within 30 days of receipt or generation, unless agreed otherwise (zero data retention, by agreement).
Inputs and outputs its trust and safety systems flag as breaking its usage policy are kept for up to 2 years, and their safety classification scores for up to 7 years.

Source: Anthropic’s privacy centre, updated 1 July 2026.

AWS Bedrock

For Anthropic Claude Fable 5 and 5.1, all traffic is kept for up to 30 days for automated offline abuse detection, and traffic a classifier flags may be reviewed by AWS staff.
For OpenAI models other than the gpt-oss family, only classifier-flagged traffic is kept, for up to 30 days.
What is kept is stored by AWS, in the region that processed the request, and not shared with the model’s maker. For any other model, see the provider’s terms.

Source: Amazon Bedrock abuse detection.

Google Vertex AI

Cached data is held in memory only and deleted no later than 24 hours after it is written.
Google may log prompts to detect abuse; its page gives no period for these logs, so see the provider’s terms. We use no Google Search or Maps grounding, which keep query logs for 3 and 30 days.

Source: Google Cloud data governance, updated 15 October 2026.

OpenAI

Abuse monitoring logs are kept for up to 30 days, longer only where the law requires it or to protect its services or others from harm.
Zero data retention, for customers OpenAI approves, keeps the content out of those logs.

Source: OpenAI API: your data.

Azure OpenAI

Not made available to OpenAI. Content flagged for abuse may be reviewed by authorised Microsoft staff (in the EEA, for an EEA deployment); Microsoft’s pages give no storage period, so see the provider’s terms.

Source: Microsoft Learn: abuse monitoring.

Mistral

We could not confirm a retention period on Mistral’s own pages: see the provider’s terms.

Source: Mistral’s legal terms.