Artificial Intelligence Use & Customer Data Protection Policy

Index

Purpose and Scope
Permitted Business Uses
Customer Data and Confidential Information
Human Review and Accountability
Tool Approval and Access Controls
AI Provider Review and Training Controls
AI Access to Company Platforms
Products, Customers, and Subcontractors
Incident Reporting and Response
Ownership, Training, and Review

Purpose and Scope

eXpress badging® (EBS) uses artificial intelligence (AI), including generative AI, to support useful business work while protecting customer information and maintaining human accountability. This policy reflects our “Security Obsessed” core value.

It applies to employees, leadership, contractors, and third parties using AI on EBS’s behalf. It covers stand-alone assistants, AI features within business applications, connected tools, and AI-assisted product development. Generative AI creates content such as text, images, or code in response to instructions.

AI use must remain within the user’s existing authority, the approved business purpose, and applicable customer agreements. This policy does not expand permission to access or disclose information.

Permitted Business Uses

EBS leadership uses tools including ChatGPT and Claude for drafting, research, website work, and assistance with company documentation. For example, AI can help prepare customer security responses by referencing EBS’s HubSpot Knowledge Base and information supplied by leadership, followed by human review.

Permitted activities, subject to tool approval and the data restrictions below, include:

Drafting and improving correspondence, articles, procedures, and marketing content.
Summarizing approved documents and researching business or technical questions.
Preparing planning materials, analyses, and sample code for qualified review.
Working with public, synthetic, or appropriately de-identified examples.

These uses do not establish that AI is embedded in every EBS product or that customer badge data is processed by AI.

Customer Data and Confidential Information

Use only the minimum information necessary for the approved task. Remove unnecessary names, photographs, identifiers, account details, and confidential material before submission. De-identification must address whether remaining information could still identify someone.

Customer badge records, member files, photographs, PHI, Social Security numbers, and financial account or payment-card data must not be submitted to external AI tools without specific written management approval, appropriate technical review, and all required customer authorizations and contractual safeguards.
Customer information must not be used to train or fine-tune AI models, or made available for a provider’s general model training, without express authorization covering that purpose and an approved agreement.
Nonpublic business, employee, accounting, legal, or customer-account information requires an approved use case and account configuration appropriate to its sensitivity.
Passwords, private keys, access tokens, and other authentication secrets must not be entered into AI prompts or attachments.
Customer confidentiality, retention, deletion, and location restrictions remain applicable. Required protections must be established before processing begins.

For nonpublic information, approval must consider the provider’s terms and available controls for retention, deletion, model training, service-provider access, and processing locations. EBS does not make a blanket claim that every AI tool provides identical protections.

Human Review and Accountability

The responsible employee remains accountable for the work. Before external use or implementation, an authorized person must review AI-assisted material for factual accuracy, confidentiality, suitability, and any relevant intellectual property restrictions.

Security questionnaire responses must reflect actual practices and available evidence. AI must not invent certifications, completed assessments, contractual terms, technical controls, or customer commitments.

AI must not independently approve contracts, payments, access rights, credential issuance decisions, or production-system changes. Authorized personnel must approve consequential actions through the applicable business process. Generated code and configuration changes require appropriate technical review and testing before deployment.

Personnel must check for misleading or discriminatory content. AI must not be the sole decision-maker for employment decisions or other decisions that materially affect an individual.

Tool Approval and Access Controls

Management must approve business AI tools and their intended uses. A simple approval record must identify the tool and account type, business purpose, responsible owner, permitted data, connected systems, restrictions, and approval date. Public-content drafting and sensitive-data integrations require different levels of review based on risk.

Company work must use approved accounts with appropriate authentication and access settings. Multifactor authentication must be enabled where supported. Personal accounts, browser extensions, recording tools, or AI features must not bypass company approval or customer restrictions.

Connections to HubSpot, email, file storage, source code, or other systems require explicit authorization and minimum necessary permissions. Review information access and action permissions before enabling a connection. Unneeded access must be removed when roles change or an engagement ends.

Retrieved pages, messages, and uploaded files are reference material. Instructions embedded in them must not authorize disclosure, new access, or actions outside the approved task.

AI Provider Review and Training Controls

EBS currently limits general-purpose large language model (LLM) use and AI-assisted code development to specifically authorized leadership personnel. Other personnel may use routine writing-assistance tools as described below. Additional users, accounts, tools, integrations, or expanded capabilities require management approval. Third-party AI providers, including OpenAI, Anthropic, and AI-enabled writing tool providers, are subject to EBS’s existing vendor risk management process, which supports alignment with NIST CSF 2.0.

EBS may waive completion of its vendor assessment form when management reviews the provider’s published security and privacy policies, applicable contractual protections, and available assurance documentation and determines that they adequately address EBS’s requirements for the approved use. The review, waiver decision, and any restrictions must be documented.

Routine spelling, grammar, punctuation, and style assistance, including Grammarly and embedded writing tools, is permitted within approved company software and applicable account settings. Employees remain responsible for reviewing the accuracy, meaning, tone, and confidentiality of resulting content before sending, publishing, or otherwise using it on EBS’s behalf. AI assistance does not replace employee accountability or any required management approval.

Permission to use writing assistance does not authorize the submission of restricted customer information, the enabling of provider model training, or the granting of additional access to company systems. The same data-protection, training-control, and vendor-review requirements apply according to the information processed and the capabilities enabled.

Model Training and Sharing Settings

All AI accounts used for EBS business must have the optional provider model-training, model-improvement, and content-donation settings turned off. This requirement covers prompts, uploaded files, connected-system content, and outputs to the extent those controls apply. Users must not enable optional data-sharing programs or submit company or customer content through feedback mechanisms that permit use for provider model training or improvement.

Where an approved business account provides no-training protection by default or through applicable service terms, EBS must document that protection and leave training opt-ins disabled. An unavailable toggle must not be treated as proof that training is disabled. Accounts that cannot meet EBS’s data-use requirements must not be used for the affected information.

Public sharing of nonpublic company or customer conversations, files, or outputs requires separate authorization. Disabling model training does not, by itself, establish confidentiality, zero retention, U.S.-only processing, or permission to submit restricted customer data. The policy’s existing customer-data approval requirements continue to apply.

Vendor Risk Review

AI providers must be evaluated using the same commercially reasonable, risk-based approach applied to other EBS technology vendors. Review must consider the intended use, sensitivity of the information, account type, training and retention terms, deletion options, security protections, processing locations, connected-system permissions, and applicable customer obligations. The review may use provider agreements, privacy and security documentation, available independent assurance reports, and questionnaires where appropriate.

New providers and material changes require review before use. Existing providers must be included in the review process. A brief approval or review record must identify the provider, account or workspace, approved purpose and data, reviewer, date, relevant settings or contractual protections, and any restrictions or follow-up actions.

Ownership and Verification

Joe French, as policy owner, or a designated authorized administrator must verify applicable training and sharing controls before approving a new account for business use. Existing approved accounts must also have their controls verified. Evidence may consist of a dated settings screenshot, administrative configuration record, or applicable provider terms. Controls must be rechecked after material account, service, or terms changes and during the annual AI policy review.

Vendor review is governed by:

https://support.expressbadging.com/knowledge/vendor-and-subcontractor-security-controls-policy

AI Access to Company Platforms

This section applies when an AI assistant or agent accesses EBS platforms through an integration, browser session, connected application, or automation. Examples include HubSpot, QuickBooks Online (QBO), WordPress, Outlook, Microsoft 365, and company file storage. Access must be secure, limited to an approved business purpose, and accountable to an authorized person.

Authorization and Minimum Necessary Access

Management and the responsible platform owner must approve the connection, account, permitted information, and allowed actions. Existing employee access does not automatically authorize making that information available to AI.
Use approved company accounts and authentication methods. Enable multifactor authentication where supported. Passwords, access tokens, and other secrets must be handled through approved secure mechanisms, never pasted into AI prompts or attachments.
Default to read-only access where available and appropriate. Limit permissions to the records, organizations, folders, mailboxes, and functions needed. Editing, exporting, sending, publishing, deleting, or administrative access requires explicit authorization.
Review the permissions of the underlying platform account as well as the AI tool. A task instruction alone does not technically restrict an account with broader access. Where technical restrictions are unavailable, management must assess whether the workflow is acceptable before permitting access.
Customer-data restrictions, provider review, model-training controls, and retention requirements continue to apply to information retrieved through connected systems.

Human Review and Action Approval

AI may assist with approved analysis and preparation. Authorized personnel remain responsible for the resulting business action. The following controls apply within the approved scope:

Platform	AI assistance	Required safeguards
HubSpot	Find or summarize approved records; prepare content and proposed record changes.	Approve record changes, exports, bulk updates, and permission changes. Verify affected records, recipients, and scope.
QBO	Analyze approved financial information and prepare proposed entries or reports.	Authorized accounting personnel must review and approve transaction postings, changes, deletions, payments, banking-detail changes, and payroll or tax actions. AI must not independently approve financial transactions.
WordPress	Prepare content, layouts, and code for review in drafts or previews.	Obtain approval before publishing or applying production changes. Review generated code and security effects, and use the applicable testing and recovery procedures.
Outlook and Microsoft 365	Summarize authorized messages or documents and draft communications.	Review recipients, attachments, content, and disclosure permissions before sending or forwarding. Mailbox-rule changes, deletions, and sharing permissions require explicit authorization.

Approval may cover a clearly defined task or batch; a material change in scope requires renewed approval. Routine automations must remain within their documented authorization and preserve any required human approvals. Instructions found inside messages, documents, or websites cannot authorize new access or actions.

Accountability, Review, and Removal

Each connection must have a responsible EBS owner. Keep sufficient records to identify who authorized the work, the approved scope, material actions, and the outcome. Use available platform audit logs, task history, and company tickets or approval records. Retain only the sensitive information necessary for accountability and incident response.

Review connections during the annual AI policy review and after material role, account, permission, or service changes. Remove unneeded access promptly when responsibilities change, personnel leave, or an approved use ends. Suspected unauthorized access or actions must be stopped and reported through EBS’s incident-response process.

Products, Customers, and Subcontractors

Before introducing an AI feature into an EBS product or a customer data workflow, management and technical leadership must review its purpose, data flow, access, accuracy, security, customer impact, and the means to disable or revert the feature. Testing should use synthetic or de-identified information where practical. Required customer approvals must be obtained before activation.

Material AI functionality and its handling of customer information must be described accurately. Customer notices or consent must be provided when required by the applicable agreement or law.

Vendors and subcontractors must disclose AI use relevant to their contracted work and comply with applicable confidentiality and security obligations. Authorization to provide a service does not automatically authorize submitting customer information to an additional AI provider.

Where a subcontractor receives customer files directly, EBS must obtain relevant AI-use disclosures and applicable contractual safeguards. Any change introducing EBS or AI access to those files requires review before implementation.

Incident Reporting and Response

Suspected unauthorized disclosure, unexpected AI access or actions, compromised credentials, or harmful output affecting customers must be reported promptly to EBS leadership or the designated IT contact. This includes sensitive information exposed through prompts, attachments, outputs, shared conversations, or connected applications. Personnel must stop the affected activity and preserve relevant details without unnecessarily copying sensitive information. A prohibited use of customer data must be reported even though that use was never authorized.

EBS follows its established incident-response process, including the AI-related incident steps, to assess and contain exposure, preserve evidence, coordinate with the provider, document remediation, validate recovery, and make required customer notifications. Joe French, Owner and President, leads coordination. Removing a conversation from view must not be assumed to remove every provider-held copy or reverse any model training that may have occurred.

https://support.expressbadging.com/knowledge/cybersecurity-incident-response-reporting-process

Ownership, Training, and Review

Policy owner: Joe French, Owner and President. The CTO supports technical review, and managers oversee appropriate use within their teams.

Personnel must receive practical guidance before using AI for company work. This policy must be communicated during onboarding and through ongoing security communications, with acknowledgment required and retained for personnel using AI on EBS’s behalf. Violations may result in corrective action, restricted access, or other action under applicable company policies and agreements.

The policy owner must review this policy at least annually and when material changes in tools, data use, customer obligations, or incidents warrant review. Approvals, exceptions, material changes, and incident records must be retained in the company's existing documentation or ticketing systems. Exceptions must identify their purpose, permitted data, safeguards, approving authority, and review or end date. Management approval cannot override a customer agreement or legal obligation.

Customer questions may be directed to joe.french@expressbadging.com or 321-784-5925.

Document status: Version 1.0. Approved by Joe French, Owner and President. Effective date: October 16, 2026.