Breadcrumbs

AI Security FAQ

What AI functionality exists within Skills Base?

Skills Base includes AI-powered capabilities such as Sam (natural language assistant) and Lens (AI-driven skills insights engine).

These tools help users:

  • Explore and understand Skills Base features

  • Generate insights from workforce skills data

  • Analyse trends, risks and opportunities

  • Query data using natural language

  • Surface strategic insights aligned to business objectives

AI in Skills Base is designed to enhance decision-making, not replace structured assessment methodology or human judgement.

Can I control what data users can access via AI?

Yes.

AI functionality in Skills Base strictly enforces existing Security Group privileges. Users can only access data and functionality that they are already authorized to view within the platform.

AI tools:

  • Do not bypass permissions

  • Do not elevate user privileges

  • Respect row-level and role-based access controls

  • Only return data the requesting user is authorised to see

AI operates entirely within your instance’s established security model.

Do all users have access to AI features?

Core AI support capabilities (e.g., Customer Support Agent) may be available broadly.

However, advanced AI functionality such as deep skills analytics, business objective alignment, and natural-language data interrogation is available only to customers licensed for the AI Module.

Access is controlled at the Security Group level.


Is our organization's data shared with third parties (beyond AWS)?

No.

AI processing occurs within the same secure cloud infrastructure and hosting region as your Skills Base instance. Customer data is not shared with third parties.

Where third-party AI services are used as sub-processors:

  • Data remains within Skills Base’s controlled cloud environment

  • Data is not shared with model providers

  • Data is not used for model training

  • Data is processed transiently and securely

Skills Base maintains contractual and technical safeguards with all sub-processors.

Is our data used to train AI models?

No.

Customer data:

  • Is never used to train models

  • Is never incorporated into global AI model weights

  • Is not used to improve models for other customers

AI models analyze data in-session only to generate responses for the requesting user.

Where is AI processing performed?

AI processing occurs within your Skills Base hosting region (e.g., AWS region aligned to your instance).

Skills Base:

  • Does not move customer data outside the selected hosting region

  • Aligns infrastructure with data residency commitments

  • Uses enterprise-grade cloud environments

Is our AI data stored or retained?

  • AI conversations are logged within your instance for audit and quality purposes.

  • Logs are retained in accordance with Skills Base data retention policies.

  • AI model providers do not have access to customer prompts or responses for training.

Customers retain control of their instance data in line with the MSA and DPA.

How is AI output quality monitored?

  • AI interactions are logged for quality assurance and system improvement purposes.

  • Skills Base staff may review logs in accordance with access controls and internal policies.

  • Models are tested across multiple scenarios before release.

  • Feedback mechanisms allow customers to report issues.

While safeguards are implemented to mitigate inappropriate or inaccurate responses, AI output is not guaranteed to be error-free.

Is AI output guaranteed to be accurate?

No.

AI-generated content:

  • May contain inaccuracies

  • May require human verification

  • Should not be relied upon as the sole basis for critical decisions

AI is designed as a decision-support tool.

Can AI assess or measure employee skills directly?

No.

Skills measurement in Skills Base follows a structured methodology designed to ensure fairness, repeatability and usability.

AI:

  • Analyses skills data

  • Surfaces insights

  • Identifies patterns and risks

But it does not replace formal assessment workflows.

How is AI tested before release?

Skills Base uses:

  • Separate development, staging and production environments

  • Structured test plans

  • Scenario-based validation

  • Security and permissions testing

  • Regression testing across AI capabilities

AI features undergo controlled rollout and monitoring.

How does Skills Base protect data during AI processing?

Skills Base applies enterprise-grade security controls, including:

  • Encryption in transit (TLS 1.2+)

  • Encryption at rest

  • Role-based access controls

  • Principle of least privilege

  • Secure API communication

  • Infrastructure security aligned to ISO 27001 controls

  • Monitoring and logging

AI services operate within this same security framework.

How does Skills Base comply with global AI and privacy regulations?

Skills Base operates in alignment with applicable data protection and AI-related laws, including (where applicable):

  • GDPR and UK GDPR

  • Australian Privacy Act

  • Other relevant international data protection frameworks

Skills Base ensures:

  • Data remains within the customer’s hosting region

  • AI processing respects contractual Data Processing Agreements

  • Customer data is not used for model training

  • Appropriate sub-processor agreements are in place

  • Technical and organizational measures protect personal data

Can customers disable AI features?

Yes.

Most AI features and can be enabled or disabled at the instance or Security Group level.

Does AI make automated employment decisions?

No.

AI within Skills Base:

  • Provides insights and recommendations

  • Does not make autonomous employment decisions

  • Does not automatically change skills records

  • Does not initiate workflow actions without user input

Human review and control remain central.

What types of output can AI generate?

AI may generate:

  • Natural language explanations

  • Skills analytics summaries

  • Risk indicators

  • Objective-aligned insights

  • Structured data queries executed within the app

  • Tabular and dashboard-rendered outputs

All outputs are subject to user permissions.

How can inappropriate or unsafe AI responses be reported?

Customers can report issues via Skills Base Support. AI interactions are logged to support investigation and continuous improvement.