Trust Center
AI Transparency
HelmXP uses AI to draft briefing sections. This statement covers what AI systems we use, what data is sent to AI providers, what is never sent, how data is redacted, citation requirements for AI-generated content, and how we handle hallucinations.
Last reviewed: 2026-05-23. Maintained by HelmXP. Changes are published with a new review date.
Model training commitments
HelmXP customer data is never used to train or fine-tune foundation or third-party AI models.
This is a contractual commitment from Anthropic, enforced by the Azure AI Foundry enterprise agreement under which HelmXP operates. Anthropic's API terms explicitly prohibit using API inputs and outputs to train models. Azure AI Foundry's enterprise data protection terms additionally prohibit Microsoft from using customer data sent through the service for model training. Claude — the only foundation model HelmXP uses — performs inference only.
The full AI Transparency Statement document — including the specific contract clauses — is available on the Documents page.
Separately, the optional Voice feature builds an in-tenant writing-style model — private to your hub.
If a hub enables Voice, HelmXP builds a writing-style profile from that hub's own approved meeting minutes — and nothing else. The style model is private to the hub that built it: it is never shared across hubs, never pooled, and never used to improve Claude or any shared model. It is used for inference only — to match drafts to the hub's established voice — and the hub can delete it at any time, which removes the profile immediately.
AI systems used
Claude Sonnet
claude-sonnet-4-5 (pinned; updated only with explicit HelmXP approval)- Provider
- Anthropic via Azure AI Foundry
- Role
- Primary drafting model — AI-drafted briefing sections, Q&A, and risk-scan analysis.
- Data access
- Receives the section context, the hub voice profile, peer NCUA 5300 statistics, and the operator prompt. Does not receive other hubs' data, raw financial ledger detail, or member-level PII.
Claude Haiku
claude-haiku-4-5 (pinned)- Provider
- Anthropic via Azure AI Foundry
- Role
- Background tasks — smart summary generation, search index pre-processing, low-latency completions.
- Data access
- Receives condensed section or query context only. Same data-access constraints as Claude Sonnet.
What data is sent to AI providers
Each category is listed with whether it is included in AI model requests. Data marked Not sent never enters an AI prompt.
| Category | Examples | Sent to AI? |
|---|---|---|
Section text and prior memo context | Content of the briefing section being drafted, plus up to 5 prior approved memos for voice calibration. | Sent |
Hub voice profile | Aggregated stylistic features from approved memos — tone, sentence length, preferred terminology. Not the raw memo text. | Sent |
NCUA peer statistics | Aggregate NCUA 5300 peer benchmarks for the hub's asset tier and peer group. No individual peer data. | Sent |
AI model system prompt | The HelmXP-authored system prompt, including the seat label and any seat-specific voice instructions. | Sent |
Individual member records HelmXP works with aggregated financial metrics, not individual member records. Member-level data is never included in AI prompts. | Member account data, loan records, names, account numbers, payment histories. | Not sent |
Full GL trial balance detail Only summary-level financial metrics (net interest margin, loan-to-share ratio, asset totals) are included in prompts. | Line-item general ledger entries, individual account balances below summary level. | Not sent |
Personnel or HR data HR data is not ingested by HelmXP and is never sent to any AI provider. | Employee salaries, performance reviews, hiring records. | Not sent |
Data from other hubs Each hub's RAG corpus is isolated by tenant prefix and RLS. No cross-hub data is ever included in a prompt. | Any data from institutions other than the hub whose section is being drafted. | Not sent |
Redaction practices
PII in uploaded documents
When a seat holder uploads a document to the hub knowledge base, HelmXP applies a pattern-based redaction pass before chunking for RAG. Detected patterns include US Social Security Numbers, 16-digit card numbers, and common financial-account number formats. Redacted with [REDACTED-<type>] markers.
System prompt separation
Seat-specific voice and style instructions are placed in the system prompt turn, not in the user-turn context. This prevents the model from treating operator instructions as user-generated content.
Prompt logging
Every AI request is logged: model name, prompt hash (SHA-256 of the prompt — not the text), token count, and the seat ID that initiated the request. The full prompt text is not stored; only the hash, for audit deduplication.
Error traces
If an AI request fails, the error trace logged to Azure Application Insights is scrubbed of prompt content. No partial completions are retained in error logs.
Citation requirements
Every AI-drafted briefing section must carry citations grounding its claims in the hub's actual data before a seat holder can sign it off. Citation enforcement is built into the AI prompt contract and validated at the application layer.
- Every financial claim cites its source. Sources include: NCUA 5300 call report line items (with line number), the GL trial balance, the ALM model output, or a named integration export.
- Citations are machine-readable. Citations are structured objects in the AI output — not inline footnotes. The application validates that each claim resolves to a named source.
- Uncited drafts are not accepted. If the model returns claims that cannot be grounded, the application discards the draft and prompts the seat holder to re-run with narrower context.
- AI drafts are marked visibly. Every AI-drafted section displays a persistent “AI draft · review before signing off” marker, which clears only when the seat holder explicitly signs off.
Hallucination handling
HelmXP applies three layers of hallucination mitigation. None are a guarantee — the seat holder's review is the final control.
Grounding in source data
AI prompts are constructed from the hub's actual data — NCUA 5300 figures, ALM outputs, GL summaries. The model drafts commentary on provided numbers, not from parametric memory. Specific figures the model cannot source are flagged with [ESTIMATE] markers.
Citation validation at application layer
The application validates each citation in the draft against the source data that was included in the prompt. Claims citing a line item not provided are rejected before the draft reaches the seat holder.
Seat holder sign-off
No AI-drafted content reaches the briefing without a seat holder explicitly signing off. The sign-off UI reminds the seat holder to verify all numeric claims. The Logbook records who signed off and when.
To report a specific case of inaccurate or harmful AI-generated content, contact security@helmxp.com. HelmXP reviews all flagged AI outputs within 2 business days.
The full AI Transparency Statement — including specific contractual clauses from Anthropic and Microsoft governing the model training commitments — is available as a downloadable document on the Documents page.