AI Features & Data Use Notice

How CyberWave Sentinel uses AI, what it sends where, what it keeps, and what it does not do with your content

1. What this Notice covers

CYBER WAVE INC., a corporation existing under the laws of Ontario, Canada (Ontario Corporation Number 1000780137), located in Markham, Ontario, Canada ("CyberWave", "we", "us" or "our") provides CyberWave Sentinel (the "Services"), a cybersecurity readiness, governance and evidence platform.

Sentinel includes optional features that use artificial intelligence to draft, review, summarise and explain material inside your workspace. This Notice describes those features in one place: what they do, how a request is processed, what leaves our systems, what we keep, and what we will not do with your content. It is written to be read once and understood.

This Notice is incorporated into the Terms of Service. It adds detail; it does not add rights or obligations that conflict with the Terms. If this Notice and Terms §14 conflict, Terms §14 prevails. How we handle personal information is governed by the Privacy Policy and, where we process personal information on your behalf, by the Data Processing Addendum.

2. Who may use the AI Features

The Services are sold to organisations for business use. When you accept the Terms or create an account, you represent that you are of legal age to contract, that you are using the Services for business or professional purposes and not for personal, family or household purposes, and that you have authority to bind the organisation you act for.

Where mandatory consumer protection, privacy or other law nonetheless applies to you, that law prevails over anything in this Notice that would give you less. A term of ours that conflicts with a mandatory right is read down, not enforced.

3. Defined terms

4. What the AI Features do today

Every AI Feature is invoked by an Authorized User. None of them runs on a schedule, and none of them runs without a person asking for it. Which AI Features a Workspace can use depends on its plan and, during a free trial, on the plan selected for the trial. As at the effective date of this Notice they cover:

• drafting and reviewing policies;
• reviewing an evidence item and explaining what is weak about it (no AI model reads the content of uploaded evidence files; see §8);
• drafting answers to a customer security questionnaire, and assembling a security pack;
• analysing a vendor record or a contract;
• cyber-insurance readiness material: a roadmap narrative, a broker summary, an underwriter package, an evidence-gap explanation, renewal talking points, and draft answers to an insurer's questionnaire (see the Cyber Insurance Readiness Disclaimer, which governs all of these);
• narrative for executive reports;
• advisory and assessment narrative, and training material;
• suggested actions, and answers to questions about your own readiness position.

5. The core statement: AI Features are assistive

AI Features are assistive. Outputs may contain errors and do not replace professional judgement. You remain responsible for decisions made using them, and AI output should be reviewed before it is relied on.

That is the sentence we use on our website, and Terms §14.4 states the same position, deliberately, so that the promise does not change depending on where you read it. In practice it means all of the following.

• Output can be wrong. It can be plausible, well-structured, confidently expressed and still factually incorrect, out of date, incomplete, or a description of a control you do not actually have.
• We do not warrant Output. We do not warrant that Output is accurate, complete, current, original or non-infringing, or that it is unique — another customer may receive similar Output for a similar request.
• Output is not professional advice. It is not legal, audit, actuarial, underwriting, accounting or tax advice. Where a decision has legal, regulatory, contractual or insurance consequences, obtain advice from a qualified professional.
• The Services attach this warning to generated content. Generated material carries an on-screen notice that it is AI-generated and should be reviewed with a qualified professional before it is used, distributed or submitted to a third party. Please treat that notice as meant.

6. What the AI Features have no authority to do

CyberWave does not certify compliance, issue audit opinions, guarantee compliance, or replace independent auditors, certification bodies or legal counsel. CyberWave is not an insurer or an insurance broker, does not bind coverage, does not interpret policy coverage as legal advice, and does not guarantee coverage, premium reduction, claim payment or insurer acceptance. CyberWave does not operate a security operations centre or provide 24/7 monitoring, and does not provide managed detection and response, emergency incident response or incident response retainers, penetration testing or forensics.

The AI Features are inside those boundaries, not an exception to them. Specifically:

• AI has no authority to create a compliance fact. If a model writes that a control is implemented, that does not implement it. If it writes that evidence is sufficient, that does not make it sufficient. A compliance fact is created by doing the thing and holding the evidence, and it is confirmed by an independent auditor or certification body — never by our software.
• AI output is not a certification, attestation, audit conclusion, rating or endorsement, and no third party is obliged to accept it. The same is true of readiness scores, percentages and maturity levels, which are internal management indicators calculated from your own data using our methodology.
• AI output is not an insurance application, binder, quote or coverage opinion, and it is not a representation to any insurer. Only you, or your licensed broker, make representations to an insurer.
• No certification, insurance or legal decision should rest on AI output alone. Where the consequence of being wrong is a failed audit, a denied claim or a legal exposure, a person with the relevant qualification has to look at it.

7. How a request is processed

1. An Authorized User invokes an AI Feature.
2. The server authenticates the caller, resolves the Workspace they belong to, and confirms that the Workspace is entitled to the feature.
3. Burst and volume controls are applied, and the Workspace's remaining AI credit allowance is checked before any AI work is done.
4. The Input is assembled from that Workspace's own records only: the item the user asked about and, often, a summary of the Workspace made up of record names, statuses, counts and saved answers. Tenant separation is enforced by PostgreSQL row-level security together with server-side authorisation. It is not enforced by asking the model to behave.
5. The Input is sent from our servers to the AI Provider's API. All AI Provider calls are made from CyberWave's servers, never from your browser.
6. The Output is returned to the user, and the records described in §9 are written.

We do not describe our authorisation logic, prompt construction or filtering in further detail here. That is deliberate: a public document that explains exactly how a control is built is a document that helps someone work around it.

8. What leaves CyberWave, and where it is processed

We cannot and do not claim that all of your data stays in Canada. Your Workspace records are primarily stored in Canada. Application processing and AI inference involve service providers that process data in the United States, and other service providers also handle some information — for example, application email is sent through a provider in the United States. The Privacy Policy states this in full, the Subprocessors document names each provider and describes where it processes data, and the Data Processing Addendum governs the transfer.

Only what is included in an Input reaches the AI Provider — not your Workspace as a whole. An Input contains the item the request is about and, often, the Workspace summary described in §7. No AI model reads uploaded evidence files: they receive text extraction and keyword classification instead. Where you use policy review, the text of the policy is included in the Input; where you use contract review, the contract text you paste in is included in the Input.

9. What is retained

This section is the one most often stated too favourably, so it is stated here plainly.

What is kept of the request. With each Output, CyberWave stores a short excerpt or label of the request, of up to 300 characters — for example the policy type, vendor name or evidence item name, or an excerpt of text typed into the request. A short excerpt of the request is also recorded in an append-only audit log.

What is retained, in your Workspace, under your Workspace's own access controls:

Three things follow, and you should know all three.

1. Output is kept even if you do not save it. Generating a draft you then discard still leaves an output record in your Workspace. You can see these records in the application's AI governance view.
2. Whatever an Authorized User puts into an Input can come back in the Output, and the Output is kept. If someone pastes personal information, a credential or a third party's confidential material into a request, it may be reproduced in the Output and retained in the record, and part of it may also be kept in the request excerpt stored with the output record and in the audit log. §15 asks you to manage that.
3. This Notice does not set a retention period for AI activity, output or metering records, and they may be kept for as long as your Workspace exists. The application does not currently provide a self-service control to delete an individual AI activity or output record. You can ask us to delete them by contacting support@cyberwave.ca, and we will action that request in the Services' active systems. Deleting an AI output record does not remove Output that a feature has already written into another Workspace record, which stays part of that record, and it does not remove the request excerpt recorded in the append-only audit log. Deletion from the Services' active systems is not the same as removal from every backup copy; the Privacy Policy describes the two separately, and we do not promise immediate permanent erasure everywhere. You may also request deletion of your whole Workspace by contacting support.

10. Model training and model development

Our commitment. CyberWave does not use Customer Data, Inputs or Output to train, retrain or fine-tune any artificial-intelligence model. We operate no training or fine-tuning pipeline, and we do not export Customer Data for model development. No such pipeline and no such export path exists in the Services. We do not use your content to build a model, and we do not make your content available to anyone else for that purpose.

Customer content is submitted to the AI Provider only to the extent it is included in an Input, and only to fulfil the request the Authorized User made. What the AI Provider does with content submitted to its API, including whether it uses that content to train models and whether it keeps any of it, is governed by the AI Provider's own terms, and this Notice makes no statement about it.

We also do not aggregate your content across customers for benchmarking, case studies or vendor demos. If we ever want to, we will ask first, separately, in a way you can refuse without losing anything you are paying for.

11. The AI Provider, and changing providers

Our AI Provider today is Anthropic, and Anthropic is named in our Subprocessors document with its role and processing location. AI Features call Anthropic's API from our servers, as described in §7.

We may change or add an AI Provider — models and providers move quickly, and being locked to one is not in either party's interest. Any change is subject to the subprocessor change process in the Data Processing Addendum: we publish the change, we notify you within the notice period that document sets, and your rights on objection are as that document states. A new AI Provider must be under a written agreement and disclosed with its processing location, and this Notice is updated with it.

12. Human review, and the record of it

The Services are built on the assumption that a person checks the machine's work, and they keep a record of that check.

An Authorized User can mark an AI output record approved, flagged for review or rejected. The application records who did it and when, together with any note they leave. Where a feature proposes an action for your action tracker, the proposal becomes an action only when a person creates it, and that conversion is recorded.

We recommend using this. Two reasons beyond good practice: it gives you an internal audit trail that a human reviewed AI-assisted material before it was relied on, which is the question an auditor or an underwriter tends to ask; and it is the mechanism by which a wrong output stops being circulated.

13. No automated decisions about individuals

Sentinel produces readiness scores, insights, suggested actions and draft text. These are assistive outputs about an organisation's security posture, not decisions about individuals.

CyberWave does not use the AI Features to make a decision about an individual. We do not score people, and we make no employment, credit, eligibility or access decision about anyone using AI. The AI Features decide nothing at all; a person decides, and remains responsible.

If you use Workspace output when deciding something about one of your own people, that is your decision and your responsibility — including any obligation you have to tell that person, to explain the reasons and principal factors, and to give them a route to a human review. Quebec's private-sector privacy legislation is explicit about those obligations where a decision is based exclusively on automated processing, and other laws may impose similar ones.

14. Authorisation and security

• AI Features run inside the same tenant isolation as the rest of the Services — PostgreSQL row-level security together with server-side authorisation. An Input is assembled only from the requesting user's own Workspace, and an AI Feature is not a way into another organisation's Workspace.
• AI Features do not perform security-sensitive actions. They draft, analyse and explain, and some write their Output into the Workspace record it relates to (§9). Anything that changes access, permissions, billing or a security setting remains subject to the application's own authorisation controls and is done by a person with the rights to do it.
• An AI Feature is not a route around a control. Attempting to use one to obtain data you are not entitled to, to defeat tenant separation, or to circumvent a filter, safety control or rate limit is a breach of the Acceptable Use Policy.
• Report a suspected vulnerability in an AI Feature to support@cyberwave.ca with "Security" in the subject line, as described in our Responsible Disclosure Policy. Please do not test with another organisation's data.

15. Your responsibilities when using AI Features

• Submit only material you have the right to submit, and only what the request actually needs.
• Do not submit credentials, secrets, API keys or payment card data. Nothing in the AI Features requires them.
• Minimise personal information in Inputs. Where a request does not need someone's name or contact details to be useful, leave them out. Remember §9: Output is retained, and so is a short excerpt of the request, so personal information that comes back in an Output or appears in that excerpt is retained with it.
• Review Output before you use it, distribute it, or send it to a third party — an auditor, a customer, a broker, an insurer or a regulator. Adopt it as your own statement only once you have checked it against what is actually true of your organisation.
• Do not use the AI Features or Output to develop, train, evaluate or improve a competing artificial-intelligence model or product.
• Do not present Output as a certification, an audit result, an independent assessment or advice from a qualified professional, whether to a customer, an insurer, an auditor or a regulator.
• Tell your own people what you are doing. If Inputs will contain information about your staff or your customers, your own privacy obligations to those individuals continue to apply. The Data Processing Addendum sets out how the responsibilities divide.

16. Ownership of Output

As between you and us, you own the Output generated in your Workspace, and Output saved into your Workspace is Customer Data. We claim no ownership of it and no licence to it beyond what we need to operate and support the Services, as the Terms describe.

Ownership is not a warranty of clean title: generative models produce text that may resemble text produced for someone else, and we cannot and do not warrant that Output is original or that using it infringes nobody's rights. The Terms address indemnities, including the fact that AI Output is excluded from ours.

17. Metering: AI credits

AI Features are metered against a monthly AI credit allowance that depends on your plan. Each AI action has a credit cost, the remaining allowance is checked before any AI work begins, and a request is declined — with a clear message, not a silent failure — when the remaining allowance is too low. There is no automatic overage charge. Where extra usage is offered, it is an optional purchase that an owner or admin of the Workspace chooses. Volume and burst limits also apply, to help prevent one Workspace from exhausting shared capacity. Credit consumption is recorded as described in §9.

18. Free trials and the AI Features

Stated here rather than left to the Terms, because a trial customer will use the AI Features on day one.

• The free trial is a 14-day free trial of the plan you select — Essentials or Full Platform only. Which AI Features you can use during the trial depends on that plan (§4).
• No payment card is required. There is no automatic charge. A trial does not automatically convert to a paid subscription.
• Continuing after the trial means choosing a paid subscription.
• Your data is not deleted because a trial ended. That includes Output saved in your Workspace and the AI records described in §9.
• A trial is not a paid plan and includes no fees. Trial use is metered like any other use, and the performance warranty in the Terms does not apply to a trial.

19. Which document governs what

20. Changes to this Notice

We will update this Notice when the AI Features, the AI Provider or the data flow changes, and we will change the version string when we do. Where a change is material — a new AI Provider, a new category of content included in Inputs, or a change to what is retained — we will give notice as the Terms and the Data Processing Addendum require, and we will not treat continued use as agreement to a materially worse position without telling you first.

21. Contact