The one-sentence claim
Customer data is never used to train any AI model. Every model we touch runs in zero-retention or queries-only configuration, and every customer-facing response path is structurally walled off from the lead-enrichment scrapers we use to research entities.
That structural wall is what we call the two-surface architecture: customer-facing Trust Score responses (/v1/verify, /v1/trust-score) and internal lead-enrichment outputs run on separate code paths that cannot resolve into one another. The wall is enforced by code review today and by a CI lint check from Phase 3 onwards.
Every AI sub-processor we use
Five AI sub-processors today. Two surfaces. Zero training on customer data.
Anthropic (Claude)
Customer-facing- Service
- Claude Sonnet 4.6 + Haiku 4.5 (risk narrative + false-positive reduction, Phase 3+)
- Countries
- US (control plane); processing US/EU
- Trains on customer data
- No (zero retention)
- Data received
- Prompts assembled from scan results; configured to exclude customer PII unless customer opts in
- Evidence + DPA posture
- Anthropic Trust Tier zero-retention configuration; standard Anthropic DPA
- Opt-out path
- Default opt-out via two-surface architecture (LLM-touched output never reaches customer-facing Trust Score response). Customer can additionally disable LLM-touched response surfaces in account settings (ships Phase 3).
Apify
Internal enrichment- Service
- Web scraping actors (research provider) + redundancy validator worker
- Countries
- Czech Republic (control plane)
- Trains on customer data
- No (queries only)
- Data received
- Target URLs and page content; no customer PII
- Evidence + DPA posture
- Apify SOC 2 Type II + ISO 27001:2022 + GDPR-aligned (EU-headquartered); standard Apify DPA
- Opt-out path
- Two-surface architecture wall: Apify outputs cannot reach customer-facing Trust Score response. Codified as hardBan in our agent role-card; CI lint check ships Phase 3.
Firecrawl
Internal enrichment- Service
- Web scraping (research provider): ASIC Connect lookup + adverse-media discovery
- Countries
- US (control plane)
- Trains on customer data
- No (queries only)
- Data received
- Target URLs and page content; no customer PII
- Evidence + DPA posture
- Firecrawl SOC 2 in progress; standard Firecrawl ToS + DPA in active use
- Opt-out path
- Same two-surface architecture wall as Apify.
Exa
Internal enrichment- Service
- Neural search + adverse-media discovery (research provider)
- Countries
- US (control plane)
- Trains on customer data
- No (queries only)
- Data received
- Search queries; no customer PII
- Evidence + DPA posture
- Exa SOC 2 in progress; DPA pending sign before Phase 3 activation
- Opt-out path
- Same two-surface architecture wall as Apify.
Perplexity
Internal Q&A- Service
- Sonar API + citation retrieval. Powers /v1/ask compliance answerer + methodology sweep worker
- Countries
- US (control plane)
- Trains on customer data
- No (queries only)
- Data received
- Queries; no customer PII
- Evidence + DPA posture
- DPA pending sign before Phase 4 elevation
- Opt-out path
- Customers can disable /v1/ask in account settings (ships Phase 3). Methodology sweep is internal-only; no customer data ever routed.
What our models do, and what they do not
What they do: generate plain-English risk narratives from structured scan results (Phase 3); identify likely false positives in sanctions match results so a human reviewer spends time on the matches that matter (Phase 3); answer plain-language compliance questions on /v1/ask with primary-source citations (Phase 2.5, live); validate scraper output against redundancy sources (Phase 2.5, live).
What they do not: assign your Trust Score (the score is computed by a deterministic algorithm, published in full on /methodology); replace human review on a sanctions match (every confidence-flagged match goes to a human); make any binding compliance determination (the answer to a regulatory question is yours and your lawyer's, not a model's); fabricate citations (every cited source on /v1/ask resolves to a primary-source URL we link explicitly).
Guardrails we run on every model output
Input sanitiser on every prompt assembly path (mitigates prompt injection from scraped page content). Output schema validation via Pydantic on every model response (mitigates hallucinated structure). Citation requirement on any compliance answer (no uncited regulatory claims). Per-user rate limit on /v1/ask (30 calls per 60 seconds). Per-workflow cost cap. Every model call logged with its prompt, its output, and the reviewer decision (Phase 3 audit-log integration).
Drift detection runs monthly on a fixed evaluation set. Human override rate on the false-positive reducer is tracked publicly on /methodology; if that rate exceeds 30 percent on Tier-1 critical paths, the agent is acting as a black box and we re-scope it.
How to opt out
By default you are already opted out of every AI sub-processor on the customer-facing surface, because the Trust Score response never resolves through a model. You only encounter AI when you explicitly call /v1/ask, request a risk narrative on a case, or accept the false-positive reducer on a scan result.
From Phase 3 onwards you can additionally disable AI on every response surface in account settings, including the /v1/ask oracle. Pricing does not change when you opt out.
EU AI Act + AU Privacy Act (ADM disclosure)
We do not classify any current Ironbark surface as a high-risk AI system under EU AI Act Article 16 (the closest fit, “creditworthiness”, does not apply because Ironbark is explicitly not a credit rating agency and explicitly does not opine on default probability). If we ever serve EU financial-services customers in a way that triggers Article 16, we will run a Fundamental Rights Impact Assessment (FRIA) before that surface goes live.
For Australian customers, our Automated Decision-Making disclosure under the Privacy Act 2024 amendment (live 10 December 2026) is published on /privacy with the relevant section pre-baked. The short version: we use AI to assist scan triage and risk narrative drafting, never to make a binding determination about an individual without human review.
ISO 42001 (AIMS)
Our compliance roadmap targets ISO 42001 (AI Management Systems) certification at Phase 5 or Phase 6, sequenced after ISO 27001:2022. ISO 42001 was published December 2023 and is being demanded by Fortune 500 procurement teams; per Gartner, 83 percent plan to require it by 2027. Calendar maths is published on /security/roadmap.
Where this page sits in the trust center
This page complements /security (overall posture) and /security/subprocessors (every sub-processor, not only AI). If you noticed a discrepancy between this page and the sub-processor register, email security@ironbarkaml.com.au and we will reconcile within five business days.
Published: 2026-04-26. Next review: 2026-07-26.
Source rule: ~/.claude/rules/enterprise-readiness.md v2.0 Module 7 (AI / Model Governance).