Where we use AI
- In the Kantis app. The Kantis AI assistant answers questions about your own compliance data. Kantis AI also suggests answers for your Statement of Applicability (SoA), drafts a starting risk register and vendor list with mitigation guidance from your onboarding answers, and researches your vendors from public sources.
- Security questionnaires. Our procurement agent drafts answers to the security questionnaires your buyers send, from your own evidence. Each answer is labelled as drafted by Kantis AI, and a person approves it before it is exported.
- Your own AI apps. You can connect an AI app such as Claude or ChatGPT to Kantis through our MCP server (Model Context Protocol). It can read the data your account can see and, if your workspace allows it, suggest policy changes. Suggestions are saved as drafts, and a person on your team publishes them.
- In our own work. Our team uses AI tools for research, writing, code, meeting notes and email. A person is responsible for every email and document that AI helped with. If you ask whether AI helped, we'll tell you.
We don't train or fine-tune AI models, and we don't use AI to make decisions about people.
How you know AI is at work
AI output in the app carries a label, for example "Suggested by Kantis AI" on SoA answers, "Drafted by Kantis AI during setup" on risks and vendors, and "Generated by Kantis AI from public sources" on vendor research. The assistant always appears as Kantis AI, never as a person, and reminds you that it can make mistakes.
People make the decisions
AI output is a draft. You review it before you use it.
Kantis AI's answers for your Statement of Applicability start as drafts. Someone on your team checks them and submits the Statement, and the assigned reviewer approves it before it counts. Where the review step is switched on, each AI answer also waits for a person to accept, edit or dismiss it.
If you think an AI result is wrong or unfair, email support@getkantis.com and a person will review it, usually within 2 working days.
Your data and AI training
- Kantis doesn't use your data to train AI models.
- To run our AI features, we send the data a feature needs to OpenAI through its business API. OpenAI doesn't train on API data by default. It may keep the data for up to 30 days to check for abuse, then deletes it. This processing happens outside the UK, mostly in the United States.
- Vendor research sends only public information, a vendor's name and website, to Firecrawl.
- The assistant reads only data in your own workspace that your account is allowed to see. It can't change your data.
- AI apps you connect through MCP sign in as you and see only what your role allows. They run under your own agreement with their provider.
- Our team's AI policy allows only approved tools, on accounts with model training switched off and two-step login.
Safeguards
What you send to Kantis AI is checked for hidden or harmful instructions, such as attempts to make it ignore its rules or reveal how it works. A message like that is refused. Text in your records or on vendor websites that looks like an instruction is made harmless before the AI reads it.
Kantis AI can't change your data or send anything on your behalf. Its answers are checked on the way out too, and secrets such as API keys are hidden.
If something goes wrong, we can switch off any Kantis AI feature for everyone within seconds, without a new release.
Accuracy and fairness
AI can be wrong while sounding sure. The assistant bases its answers on your own records and shows which ones it used. Our team is trained to check AI output before relying on it.
Our AI doesn't score, rank or make decisions about people, so the risk of unfair treatment is low. We review every AI feature for bias as part of its impact assessment, and repeat the review every year.
Turning Kantis AI off
Owners and admins can turn Kantis AI off for their whole workspace. Go to Settings › Connected AI apps and switch off "Use Kantis AI in this workspace". That stops the assistant, SoA suggestions, setup drafts and vendor research for everyone in the workspace. You can turn it back on at any time.
The same page lists the AI apps connected through MCP. You can disconnect them there and choose whether they may suggest policy changes.
Who is responsible
Misha Kushka, our founder and CEO, is our Accountable Officer for AI. We keep a register of every AI tool and feature we use and review it every year and whenever we add or change an AI feature. Every AI feature that touches customer data has a written impact assessment.
Questions and concerns
To ask about our AI, report a wrong or strange AI answer, or ask for a person to review an AI result, email support@getkantis.com with "AI" in the subject. A human review usually happens within 2 working days.