Get readiness score

security --data-handling

What happens when a learner uses AI.

The data posture for AiBI Lab and Toolbox, written for IT, InfoSec, risk and compliance. It does not replace your institution's AI policy.

IT review packet Security overview
one AI requestdata flow
  1. 01Learner promptSynthetic or redacted practice data. No customer records needed.
  2. 02Server checkCommon PII patterns and prompt injection are blocked before any model sees them.
  3. 03Provider, paid APIAnthropic, OpenAI or Google Gemini, depending on the feature.
  4. 04Draft back to the learnerA person reviews it before it is used.

Usage log: metadata only. No prompt text, no matched PII values.

Never paste

The course never needs customer data.

  • Customer or member PIIAccount numbers, SSNs, dates of birth, addresses, phone numbers.
  • Confidential bank materialNon-public exam material, credentials, secrets, internal system details, vendor records.
  • Case filesUnredacted complaints, loan files, BSA/AML cases, transaction records.
  • Anything not approvedIf your institution has not approved the tool and use case, it does not go in.

Provider terms · checked June 23, 2026

Paid API paths only.

Commercial APIAnthropicCommercial terms state that Anthropic may not train models on Customer Content from the Services.Provider terms API PlatformOpenAIOpenAI states API inputs and outputs are not used to train models by default and may be retained up to 30 days for service and abuse monitoring, except where a different endpoint or feature applies.Provider terms Gemini API paid servicesGoogle GeminiGoogle states paid Gemini API prompts and responses are not used to improve products; prompts and responses may be logged for a limited period for safety, security, and required disclosures.Provider terms

AiBI operating posture

What we keep, and for how long.

Retention at a glance
RecordHow long it is kept
Assessment resume draftsDeleted after 30 days
Raw prompt text in AI usage logsNever stored — metadata only
OpenAI API inputs and outputsRetained by OpenAI up to 30 days for abuse monitoring, then deleted (per provider terms)
Account, assessment, enrollment, certificate, saved-artifact, support, and payment recordsKept while needed to provide the product, operate support, handle disputes, and satisfy tax or legal obligations
Institution rolloutsStricter retention or deletion expectations can be defined before seats are assigned
Usage and PII audit logs

AI usage logs store user id or hashed IP, feature, provider/model, token and cost totals, status/error state, timestamps, and non-content PII flag/override metadata when applicable. They intentionally do not store raw prompt text or matched PII values.

Subprocessors and residency

Core application data is stored in Supabase and Vercel-hosted application infrastructure. Email is sent through Resend. Payments run through Stripe. Model requests may route to Anthropic, OpenAI, or Google Gemini depending on the feature and model selected. Residency follows those providers and configured services; AiBI does not currently offer a self-serve single-region residency guarantee.

DPA and SOC 2 posture

AiBI does not currently claim SOC 2, ISO 27001, FedRAMP, GLBA, or other third-party security certification status. For institution rollouts, request a security packet or DPA review before seats are assigned; provider SOC 2 reports should not be treated as AiBI certification.

PII warning overrides

Paid Toolbox flows may let a learner confirm that a PII warning is from fabricated sample data and send anyway. Prompt-injection blocks cannot be overridden. A confirmed send records non-content audit metadata; it does not store the prompt text or matched value in the usage log.

Need a direct answer for IT or risk?

Email hello@aibankinginstitute.com. For rollouts, we scope the tool path and data boundary before seats are assigned.

IT review packetFor institutions
LLM Data Handling — The AI Banking Institute