Corporate policy · Artificial intelligence
AI Usage Principles
The principles that govern how we use artificial intelligence, both in our own work and in our products, and where we draw the line.
01Our approach
VexCore positions artificial intelligence as a decision-support layer in enterprise operations. AI suggests, classifies and accelerates; the authorised user decides. These principles cover both our employees' use of AI tools and the AI components embedded in our products.
02AI in our products
- Human decisions prevail
- In-product AI components are for decision support; decisions such as publishing, approval and escalation belong to the authorised user.
- Can be switched off
- AI processing can be disabled at the organisation (tenant) level and kept off in on-premises and public-sector deployments.
- Minimum data
- Data sent to an AI provider is limited by the data-minimisation principle; personal data is masked rather than sent in raw form.
- Provider conditions
- In-product AI providers must commit that data is not used for model training. An organisation may configure its own provider or a model on its own infrastructure, in which case the data flow is defined in the customer contract.
- Data location and KVKK
- Provider selection, data location and cross-border transfers are assessed under personal data protection legislation.
- Traceability
- AI-assisted operations are recorded in the audit trail like any other operation.
03Use of AI tools inside the company
- External AI tools are used only from an approved tool list and with corporate accounts; the list is reviewed regularly.
- Business data is never processed with personal accounts.
- Customer data and personal data are never entered into external AI tools.
- Passwords, keys and other secrets are never entered into any AI tool.
- Confidential source code is never entered into consumer AI tools; coding assistance is obtained only on enterprise plans where data is not used for model training.
- Contracts, proposals and financial information are not entered into AI tools without management approval.
- AI output is not passed on to a customer, a contract or production without verification; AI-generated code is not merged without human review.
- Suspected data exposure through AI tools is reported and managed as an information security incident.
04Review
These principles are reviewed at least once a year in light of changes in legislation, technology and product scope. Questions can be sent to info@vexcoreteknoloji.com.
Questions
Questions and reports relating to this policy can be submitted through the channels below.