AI Governance Policy

SentientPro AI Governance Policy

Customer-facing statement of how SentientPro governs artificial intelligence

Last updated: September 25, 2026 · Applies to SentientPro platform v1.20.3 and later

1. Introduction and Purpose

SentientPro is an AI-enabled sales enablement platform for SDRs, account executives, and sales managers. It provides calendar-based meeting preparation, AI web research, conversation intelligence (recording, transcription, and analysis of sales calls), and a Gym learning management system with AI roleplay practice.

Artificial intelligence is central to how SentientPro works, and we believe our customers are entitled to a clear account of how that AI is built, what data it touches, and how it is governed. This AI Governance Policy explains the principles, controls, and accountabilities that apply to every AI feature in the platform. It is intended for customers, prospective customers, and their procurement, security, legal, and data protection teams.

This policy complements, and should be read together with, the SentientPro Terms of Service, Privacy Policy, and Data Processing Addendum (DPA). Where this policy summarises those documents, the underlying documents prevail.

This edition reflects SentientPro's completed migration of text-based AI processing from the OpenAI API (United States) to Azure OpenAI Service hosted in the European Union, and to add our position under the EU AI Act. Microsoft is now SentientPro's primary external AI subprocessor. OpenAI, L.L.C. remains a subprocessor for audio processing only (speech-to-text, text-to-speech, and speech-to-speech), because the audio models SentientPro relies on are not yet available on Azure OpenAI Service in the European Union; see Section 4, "Audio processing". Both are reflected in the SentientPro Subprocessor List, and the change was notified to customers in accordance with the DPA.

2. Scope

This policy covers all AI-powered capabilities of the SentientPro platform, including:

• Digital Revenue Assistant — AI-generated meeting briefs and preparation notes, including relationship history drawn from past conversations.
• Conversation Intelligence — Recording, transcription, AI summaries, action items, call-type auto-tagging, Ask AI, and AI-drafted follow-up emails for sales calls, including calls imported from third-party dialers such as Apollo.
• Gym and LMS — AI roleplay practice partners (text and real-time voice), AI feedback on roleplay sessions with transcript-linked quotes, scenario generation from real calls, and learning courses with quizzes and flashcards.
• Research and Industry News — AI-powered research on companies, contacts, and accounts, including the research graph, plus curated industry news.
• Digests and analytics — Weekly Digests, manager dashboards, roleplay performance dashboards, and team progress views that aggregate the outputs above.

The policy applies to all plans, including the Free Pass plan, and to all interfaces: web application, mobile installation, and the SentientPro Chrome extension.

3. Governance Principles

Five principles govern how we design, deploy, and operate AI at SentientPro.

• Transparency — Users always know when they are interacting with AI, when content is AI-generated, and when a call is being recorded and transcribed.
• Human oversight — AI outputs are advisory. They inform human judgment; they do not replace it. No SentientPro feature takes automated decisions with legal or similarly significant effects on individuals.
• Data minimisation and ringfencing — Customer data is processed only to deliver the service the customer has configured, inside a ringfenced environment, and is never used to train generalised AI models without the customer's explicit opt-in.
• Accuracy and honesty about limits — We are candid that AI-generated content can contain errors. The product is designed so outputs are easy to verify against sources such as transcripts, and customers are contractually reminded to validate AI outputs before relying on them.
• Accountability — Named ownership of AI risk inside SentientPro, documented change management for AI features, and support for customer audits and assessments.

4. AI Architecture and Data Ringfencing

SentientPro's text-based generative AI features — summaries, insights, action items, call-type tagging, Ask AI, drafted emails, meeting briefs, research, and roleplay feedback — are delivered through a hosted Azure OpenAI Service deployment operating within SentientPro's own Microsoft Azure environment in the European Union (West Europe region, Netherlands). Audio processing is the one exception, described under "Audio processing" below. This architecture was chosen specifically for its data protection properties:

• Ringfenced processing — Prompts, transcripts, documents, and outputs processed by these models are handled inside SentientPro's ringfenced Azure tenancy. Customer Data processed by them is not sent to OpenAI, is not shared with other Azure OpenAI customers, and is not accessible to other SentientPro customers.
• No training on customer data — Under the Azure OpenAI Service terms, Microsoft does not use customer prompts or outputs to train its foundation models. SentientPro likewise does not use Customer Data to train generalised machine-learning models unless a customer has expressly opted in, as set out in our DPA.
• EU hosting — AI processing for the platform is hosted in EU Azure infrastructure, using deployment types scoped to the EU so that prompts and outputs are processed and stored at rest within the EU, supporting customers' data residency expectations under GDPR and UK GDPR.
• Microsoft's commitments — Under Microsoft's Azure OpenAI data commitments, prompts and outputs are not available to other customers, not available to OpenAI or other model providers, and not used to train or improve foundation models without permission.
• Access control — Access to production systems and Customer Data is restricted, role-based, and logged. Organisation admin and team manager roles are separated in the product, and manager access to team members' conversations and roleplay sessions is assigned explicitly rather than automatically.
• Server-to-server architecture — All AI requests are made server-to-server from SentientPro's infrastructure. End-user browsers and devices never communicate directly with AI providers, and AI provider credentials are never exposed to clients.

Abuse monitoring

By default, the Azure OpenAI Service operates an automated abuse-monitoring system: prompts and outputs flagged by automated detection may be stored by Microsoft for a limited period, in the same Azure geography as the deployment, for potential review by authorised Microsoft personnel; for EU deployments, human reviewers are located in the European Economic Area. Microsoft no longer publishes a fixed retention period for this data (its documentation previously stated up to 30 days). Apart from the audio processing described below, abuse-monitoring handling is the only circumstance in which AI request content is retained outside SentientPro's own environment.

Audio processing (speech-to-text, text-to-speech, and speech-to-speech)

Azure OpenAI Service in the European Union does not currently host the audio models SentientPro relies on. Because of these EU model-hosting limitations, audio workloads are processed through the OpenAI API platform (United States) rather than through SentientPro's Azure environment. This applies to:

• transcription of recordings made with the SentientPro Chrome extension or the in-app recorder;
• transcription of call recordings imported from connected dialers such as Apollo; and
• the real-time voice used by AI roleplay practice partners in the Gym, including speech-to-speech and text-to-speech.

Only the audio needed for the request, and the resulting transcript or synthesised speech, is exchanged with OpenAI. Everything derived from a transcript afterwards — summaries, insights, feedback, and drafts — is processed within SentientPro's Azure environment as described above. Meetings recorded by the SentientPro bot are transcribed by Recall.ai, listed in the Subprocessor List, and are not sent to OpenAI.

Audio processing by OpenAI is governed by OpenAI's business terms for the API platform, not its consumer products. Under those terms, data submitted through the API is not used to train or improve OpenAI's models; organisation-level data-sharing options are disabled on SentientPro's account; API inputs and outputs may be retained for a maximum of 30 days solely for abuse and misuse monitoring, after which they are deleted; SentientPro does not use OpenAI features that persist customer content beyond this window; and a data processing agreement is in place with OpenAI, with international transfers protected by the safeguards described in the DPA. OpenAI maintains SOC 2 Type 2 attestation and encrypts data in transit and at rest.

SentientPro reviews the availability of audio models on Azure OpenAI Service in the European Union on an ongoing basis and will migrate audio processing to its EU Azure environment when suitable models become available. Any such change will be reflected in this Policy and the Subprocessor List and notified to customers in accordance with the DPA.

Security controls for AI processing

AI processing is subject to the same safeguards as the rest of the Services, including: encryption in transit for all AI provider communications; AI provider credentials stored in managed secret storage, scoped to minimum permissions and rotated periodically; access to AI provider accounts restricted to authorised personnel behind single sign-on and multi-factor authentication; and usage monitoring and spend limits on AI accounts to detect anomalous activity.

5. Data Use, Training, and Retention

What data our AI features process

Depending on the features and integrations a customer enables, SentientPro's AI processes: calendar and meeting data; emails; CRM records; files the customer connects (such as proposals and marketing assets); web data gathered by the Research agent; call and meeting recordings, video, and transcripts; roleplay session audio and transcripts; and usage data. The customer controls which integrations are activated and which meetings are recorded.

Training commitments

Customer Data is used only to provide the Services. It is not used to train generalised or cross-customer machine-learning models without the customer's explicit opt-in. Data obtained from Google APIs (including Gmail and Google Calendar data) is never used to train generalised models without explicit customer opt-in and is handled in accordance with the Google API Services User Data Policy, including its Limited Use requirements. Aggregated, de-identified data that cannot identify a customer or user may be used for security and product improvement.

Retention and deletion

Retention follows the DPA and plan documentation: for example, meeting recordings on SenPro Teams plans are retained for 90 days; customer log data is retained 30–90 days unless the customer instructs otherwise; and on termination customers may export their data, after which personal data is deleted within 90 days and purged from backups within 180 days, unless retention is legally required.

6. Position under the EU AI Act

SentientPro operates from EU-hosted infrastructure and serves customers in the EU and UK, so we treat Regulation (EU) 2024/1689 (the EU AI Act) as a primary reference framework for our AI governance. Our current assessment is set out below and is reviewed as the regulatory landscape evolves, including the changes to the AI Act's high-risk timeline adopted in 2026.

Roles

For most purposes under the AI Act, SentientPro acts as a provider of AI systems built on general-purpose AI models supplied by a third-party model provider, through Azure OpenAI Service for text processing and through the OpenAI API platform for audio processing. Our customers act as deployers of those systems within their organisations. Obligations that attach to the general-purpose model itself sit with the upstream model provider; SentientPro is responsible for the systems it builds on top, and supports customers in meeting their deployer obligations.

Prohibited practices

SentientPro does not engage in any practice prohibited by Article 5 of the AI Act. In particular, and because our platform analyses workplace conversations, we state explicitly: SentientPro does not perform emotion recognition on employees in the workplace, does not build social scoring systems, and does not use manipulative or exploitative AI techniques. Conversation Intelligence and roleplay feedback assess the content and structure of sales conversations (such as talk ratios, topics, objection handling, and framework coverage), not the emotional state of participants.

Transparency obligations

The AI Act's transparency obligations for AI systems that interact with people or generate content (Article 50) apply from 2 August 2026, and SentientPro's design aligns with them: roleplay partners are clearly presented as AI; AI-generated summaries, briefs, feedback, and drafted emails are labelled as such within the product; and participants can be made aware when the SentientPro bot joins and records a meeting.

Employment context and high-risk classification

AI systems used to make or materially influence decisions about work-related relationships — recruitment, promotion, termination, task allocation, or performance evaluation — fall within the AI Act's high-risk category (Annex III). SentientPro is designed and positioned as a coaching and enablement tool: its dashboards, scores, and feedback exist to help reps improve and managers coach. It is not designed to be used as the sole or primary basis for employment decisions, and customers are instructed not to use it that way. We nevertheless track the high-risk requirements closely: following the EU's 2026 amendment to the AI Act timeline, obligations for stand-alone high-risk systems apply from 2 December 2027, and SentientPro's governance roadmap is aligned to be able to meet the relevant requirements (risk management, data governance, logging, human oversight, and technical documentation) should any customer use case require classification as high-risk.

Supporting customer compliance

On request, SentientPro provides customers with documentation to support their own AI Act, GDPR, and UK GDPR obligations, including descriptions of AI features and data flows for DPIAs and fundamental rights impact assessments, our subprocessor list, and our DPA with EU Standard Contractual Clauses and the UK IDTA where applicable.

7. Human Oversight and Accuracy

Every AI output in SentientPro is reviewable and editable by a human before it has any effect outside the platform. Meeting briefs are preparation aids; follow-up emails are drafts the user sends or discards; action items can be edited and reassigned; roleplay feedback links each observation to the exact spot in the transcript so users can check the AI's reasoning against what was actually said.

AI-generated outputs may contain inaccuracies. As reflected in our Terms of Service, outputs are provided for informational purposes, do not constitute legal, financial, or professional advice, and customers are responsible for validating their accuracy before relying on them. We reduce error rates through model configuration, grounding outputs in customer-provided sources (transcripts, calendar data, CRM records), automatic retries when generation fails, and continuous quality monitoring — but we do not claim, and customers should not assume, that any AI output is error-free.

8. Recording, Transcription, and Consent

Recording of real conversations is one of the most sensitive things our platform does, and it is governed accordingly. Recording is customer-controlled: the SentientPro bot joins only meetings the customer has configured it to join, video capture can be declined per meeting, and imported call recordings (for example from Apollo) are brought in only when the customer connects that integration. Customers are responsible for complying with the call-recording and consent laws that apply to them, and SentientPro provides the controls to support this. Recordings, transcripts, and the insights derived from them are treated as Customer Data under the DPA, with the confidentiality, security, retention, and deletion commitments described above.

9. Roles and Responsibilities

AI governance is shared between SentientPro and its customers. The table below summarises the division of responsibility.

10. Governance Operations

• Ownership — A named senior owner within SentientPro is accountable for AI governance, supported by engineering, security, and legal functions.
• Change management — Changes to AI features, models, and prompts go through documented review before release. All product changes, including security-relevant ones, are published in our release notes with the platform version number.
• Monitoring and evaluation — Model outputs are monitored for quality and failure modes; feedback generation retries automatically on failure; and suspected bias, inaccuracy, or misuse reported by customers is triaged as an incident.
• Incident response — Security incidents affecting customer personal data trigger notification to affected customers without undue delay, in accordance with the DPA, including required details and ongoing updates.
• Third parties — Subprocessors, including our cloud and AI infrastructure providers, are bound by contract to use Customer Data only to provide services to SentientPro. We maintain a current Subprocessor List and remain responsible for subprocessors' performance.
• Evaluating new AI providers — Before engaging a new AI provider, SentientPro assesses the provider's training and retention policies for API data, the availability of a data processing agreement and appropriate international transfer mechanisms, the provider's security certifications, and whether the intended use meets the principles in Section 3. New AI providers are added to the Subprocessor List and notified to customers in accordance with the DPA.
• Regulatory watch — We track the EU AI Act, GDPR and UK GDPR developments, and related guidance, and update this policy and our controls as obligations change.

11. Review and Contact

This policy is reviewed at least annually, and additionally on any material change to our AI architecture, model providers, or applicable law. The date at the top of this document identifies the current edition.

Questions about this policy, requests for supporting documentation, or reports of concerns about AI behaviour in the platform can be directed to privacy@sentientpro.com.