Artificial Intelligence Use & Customer Data Protection Policy

1. Purpose and Scope
2. Permitted Business Uses
3. Customer Data and Confidential Information
4. Human Review and Accountability
5. Tool Approval and Access Controls
6. Products, Customers, and Subcontractors
7. Incident Reporting and Response
8. Ownership, Training, and Review

Purpose and Scope

eXpress badging® (EBS) uses artificial intelligence (AI), including generative AI, to support useful business work while protecting customer information and maintaining human accountability. This policy reflects our “Security Obsessed” core value.

It applies to employees, leadership, contractors, and third parties using AI on EBS’s behalf. It covers stand-alone assistants, AI features within business applications, connected tools, and AI-assisted product development. Generative AI creates content such as text, images, or code in response to instructions.

AI use must remain within the user’s existing authority, the approved business purpose, and applicable customer agreements. This policy does not expand permission to access or disclose information.

Permitted Business Uses

EBS leadership uses tools including ChatGPT and Claude for drafting, research, website work, and assistance with company documentation. For example, AI can help prepare customer security responses by referencing EBS’s HubSpot Knowledge Base and information supplied by leadership, followed by human review.

Permitted activities, subject to tool approval and the data restrictions below, include:

• Drafting and improving correspondence, articles, procedures, and marketing content.
• Summarizing approved documents and researching business or technical questions.
• Preparing planning materials, analyses, and sample code for qualified review.
• Working with public, synthetic, or appropriately de-identified examples.

These uses do not establish that AI is embedded in every EBS product or that customer badge data is processed by AI.

Customer Data and Confidential Information

Use only the minimum information necessary for the approved task. Remove unnecessary names, photographs, identifiers, account details, and confidential material before submission. De-identification must address whether remaining information could still identify someone.

• Customer badge records, member files, photographs, PHI, Social Security numbers, and financial account or payment-card data must not be submitted to external AI tools without specific written management approval, appropriate technical review,  and all required customer authorizations and contractual safeguards. 
• Customer information must not be used to train or fine-tune AI models, or made available for a provider’s general model training, without express authorization covering that purpose and an approved agreement.
• Nonpublic business, employee, accounting, legal, or customer-account information requires an approved use case and account configuration appropriate to its sensitivity.
• Passwords, private keys, access tokens, and other authentication secrets must not be entered into AI prompts or attachments.
• Customer confidentiality, retention, deletion, and location restrictions remain applicable. Required protections must be established before processing begins.

For nonpublic information, approval must consider the provider’s terms and available controls for retention, deletion, model training, service-provider access, and processing locations. EBS does not make a blanket claim that every AI tool provides identical protections.

Human Review and Accountability

The responsible employee remains accountable for the work. Before external use or implementation, an authorized person must review AI-assisted material for factual accuracy, confidentiality, suitability, and any relevant intellectual property restrictions.

Security questionnaire responses must reflect actual practices and available evidence. AI must not invent certifications, completed assessments, contractual terms, technical controls, or customer commitments.

AI must not independently approve contracts, payments, access rights, credential issuance decisions, or production-system changes. Authorized personnel must approve consequential actions through the applicable business process. Generated code and configuration changes require appropriate technical review and testing before deployment.

Personnel must check for misleading or discriminatory content. AI must not be the sole decision-maker for employment decisions or other decisions that materially affect an individual.

Tool Approval and Access Controls

Management must approve business AI tools and their intended uses. A simple approval record must identify the tool and account type, business purpose, responsible owner, permitted data, connected systems, restrictions, and approval date. Public-content drafting and sensitive-data integrations require different levels of review based on risk.

Company work must use approved accounts with appropriate authentication and access settings. Multifactor authentication must be enabled where supported. Personal accounts, browser extensions, recording tools, or AI features must not bypass company approval or customer restrictions.

Connections to HubSpot, email, file storage, source code, or other systems require explicit authorization and minimum necessary permissions. Review information access and action permissions before enabling a connection. Unneeded access must be removed when roles change or an engagement ends.

Retrieved pages, messages, and uploaded files are reference material. Instructions embedded in them must not authorize disclosure, new access, or actions outside the approved task.

Products, Customers, and Subcontractors

Before introducing an AI feature into an EBS product or a customer data workflow, management and technical leadership must review its purpose, data flow, access, accuracy, security, customer impact, and the means to disable or revert the feature. Testing should use synthetic or de-identified information where practical. Required customer approvals must be obtained before activation.

Material AI functionality and its handling of customer information must be described accurately. Customer notices or consent must be provided when required by the applicable agreement or law.

Vendors and subcontractors must disclose AI use relevant to their contracted work and comply with applicable confidentiality and security obligations. Authorization to provide a service does not automatically authorize submitting customer information to an additional AI provider.

Where a subcontractor receives customer files directly, EBS must obtain relevant AI-use disclosures and applicable contractual safeguards. Any change introducing EBS or AI access to those files requires review before implementation.

Incident Reporting and Response

Suspected unauthorized disclosure, unexpected AI access or actions, compromised credentials, or harmful output affecting customers must be reported promptly to EBS leadership or the designated IT contact. Personnel must stop the affected activity and preserve relevant details without unnecessarily copying sensitive information.

EBS will use its established incident-response process to evaluate the event, contain exposure, coordinate with the provider, document remediation, and make required customer notifications. Removing a conversation from view must not be assumed to remove every provider-held copy.

https://support.expressbadging.com/knowledge/cybersecurity-incident-response-reporting-process

Ownership, Training, and Review

Policy owner: Joe French, Owner and President. The CTO supports technical review, and managers oversee appropriate use within their teams.

Personnel must receive practical guidance before using AI for company work. This policy must be communicated during onboarding and through ongoing security communications, with acknowledgment required and retained for personnel using AI on EBS’s behalf. Violations may result in corrective action, restricted access, or other action under applicable company policies and agreements.

The policy owner must review this policy at least annually and when material changes in tools, data use, customer obligations, or incidents warrant review. Approvals, exceptions, material changes, and incident records must be retained in the company's existing documentation or ticketing systems. Exceptions must identify their purpose, permitted data, safeguards, approving authority, and review or end date. Management approval cannot override a customer agreement or legal obligation.

Customer questions may be directed to joe.french@expressbadging.com or 321-784-5925.

Document status:  Version 1.0. Approved by Joe French, Owner and President. Effective date: October 16, 2026.