GenAI Security
The following data protection & security measures are in place:
- All knowledge and conversations are saved on CM.com's internal databases, with a separate database for every client. Knowledge is never used for training/tuning LLMs.
- Data goes through an anonimisation process before going to any LLM, and is re-identified before it goes to the user. As such there is no personally identifiable information flow towards the LLM.
- Measures are taken against LLM pitfalls such as hallucinations & prompt injection.
- The Engine is GDPR Compliant. All LLM models are hosted in Europe.
- According to the AI Act, the GenAI engine classifies as a limited-risk system.
- CM.com qualifies as both the provider and deployer of the AI system. As such, CM.com is the owner of the model itself, whereas clients are the owner of the knowledge. A client's knowledge is deleted when they are no longer a client.
