Last Updated: October 24, 2026

Privacy Policy

‍

AI Use

Thoropass uses artificial intelligence (AI) to help customers complete compliance work more efficiently. Our AI features run on Google Vertex AI (Gemini). It is the only AI provider integrated with the Thoropass platform and the only AI service with access to customer data.

Our primary AI feature helps customers answer security and due diligence questionnaires. When a customer chooses to use it, the customer selects the documents to be used, such as policies, procedures and audit reports. The AI reads the questionnaire and the selected documents, extracts relevant information, and suggests answers along with the location in the source document where the information was found.

No Training on Customer Data

Thoropass does not use customer data, including documents or other content uploaded to the Service, to train, retrain or fine-tune AI models. Customer documents are processed only to generate outputs for that customer, within that customer's environment. AI-generated outputs created from customer documents are treated as Customer Data, as defined in our Master Subscription Agreement.

Under Google Cloud's terms, Google does not use data processed through Vertex AI to train or fine-tune its AI models without our prior permission or instruction. Thoropass has not granted that permission.

We may compile anonymous, aggregated statistics about use of the Service, for example how often AI-suggested answers are accepted or edited, to operate and improve the Service. These statistics do not identify customers or individuals and are not used to train AI models.

Data Processing and Storage

AI processing is performed through Google Vertex AI in Google Cloud data centers located in the United States. Google acts as a Thoropass subprocessor and is bound by data protection obligations under its Cloud Data Processing Addendum (https://cloud.google.com/terms/data-processing-addendum). Our current subprocessor list is available in our Trust Center.

Customer Control

AI features are optional. Customers decide whether to use them and which documents to provide. Customers who do not want their documents processed by AI can choose not to use AI features, or contact us at privacy@thoropass.com for assistance.

Human Oversight and Limitations

AI technology is still evolving, and AI-generated outputs may be incomplete or inaccurate. Every AI-suggested answer must be reviewed and approved by the customer before it is used, and customers remain responsible for the accuracy of the responses they submit. We monitor the quality of AI outputs, including how often suggestions are accepted, edited or rejected, and review the results as part of our AI governance program.

AI Governance and Safeguards

Our use of AI is managed under our AI Management System, aligned with ISO/IEC 42001. Every AI system that processes customer data is subject to an AI impact assessment. The assessment is reviewed at least annually and before any change to the AI provider, model or capabilities. No new AI provider is connected to customer data without a security review and management approval.

Generative AI tools used internally by Thoropass staff for productivity are not connected to the Thoropass platform or customer data environments. They are governed by our AI acceptable use policy.

Our safeguards include:

• Access controls based on the principle of least privilege
• Encryption of data in transit and at rest
• AI safety filters and protections against prompt injection
• Regular security audits and assessments
• Employee training on data privacy, security and acceptable use of AI
• Contracts with subprocessors that include data protection obligations

If we materially change how we use AI or customer data, we will update this policy and notify customers as required by law and our agreements.