Prodoscore AI Governance Framework

1. Purpose and Scope

This Framework describes how Prodoscore governs the use of artificial intelligence in its products and services. It covers two categories of AI:

• AI features — capabilities Prodoscore builds and operates, including ProdoAI Chat.
• Connected AI assistants — third-party AI applications a Customer selects and connects to Prodoscore, including through the Prodoscore MCP Server.

This Framework is a governance document. It is not a privacy policy, and it does not create contractual obligations. Privacy matters are governed by the Prodoscore Privacy Policy. Processing obligations are governed by the Prodoscore Data Processing Addendum. Where this Framework and either document differ, the Privacy Policy and DPA control.

The AI features available to a Customer depend on the products, configurations, and integrations that Customer has enabled.

2. Governance Model

Prodoscore does not develop, train, or fine-tune foundation models. Its AI features are built on third-party models accessed through Google Cloud Vertex AI under Gemini Enterprise.

AI governance at Prodoscore operates through existing controls rather than a separate AI control set:

• AI features run inside the Prodoscore platform’s authentication and authorization model. There is no separate AI permission system.
• AI providers engaged as subprocessors are managed under Prodoscore’s vendor management process and the subprocessor notification provisions of the applicable DPA.
• Changes to AI features follow Prodoscore’s standard change management and release process.
• Prodoscore’s information security practices are covered by a SOC 2 Type 2 attestation.

Customers control whether AI features are enabled in their environment and which users can access them.

3. AI Training

Customer data processed through Prodoscore’s AI features is not used to train or fine-tune AI models. This applies to Prodoscore and to the model providers Prodoscore engages.

Prodoscore does not permit model providers to retain Customer data for training. Under the Training Restriction section of Google Cloud’s Service Specific Terms for Vertex AI under Gemini Enterprise, Google does not use customer data to train or fine-tune its models without the customer’s prior permission or instruction. Prodoscore gives no such permission.

Prodoscore uses service telemetry and quality metrics to monitor, troubleshoot, and improve the reliability of its AI features. This does not include using Customer data to train models.

Prodoscore does not use Customer or End User personal information processed through AI features for advertising or marketing.

Prodoscore does not share customer data with third-party services. But the customer can connect the Prodoscore MCP server to a third-party chat system. If the customer makes this connection, the chat system receives the data that the user query returns. The customer controls this connection. The customer is also responsible for the terms and the privacy controls of the chat system.

4. AI Providers and Subprocessors

Prodoscore’s current AI model provider is Google, via Vertex AI under Gemini Enterprise. Customer data hosted by Prodoscore resides on Google Cloud Platform.

Where a provider processes Customer data on Prodoscore’s behalf, that processing is governed by a written agreement covering privacy and security obligations. Changes to AI subprocessors are communicated under the subprocessor notification provisions of the applicable DPA.

5. Customer-Connected AI Assistants and the MCP Server

Prodoscore operates an MCP Server that allows Customers to connect third-party AI assistants — such as Claude, ChatGPT, Microsoft 365 Copilot, or Gemini Enterprise — to their Prodoscore data.

Where a Customer connects an AI assistant:

• The Customer selects and controls that assistant. Prodoscore does not contract with, direct, or act as a subprocessor to the assistant provider.
• Access requires the authenticated user to complete an OAuth authorization flow. The assistant receives only data that the user is already authorized to access in Prodoscore.
• Prodoscore caches MCP tool responses on the server for a maximum of 5 minutes. The cache holds the analytics results that the server returns to a connected assistant. After 5 minutes, the server makes the cached entry invalid and deletes it. The server does not keep analytics responses in the cache after this period.
• Data flows in both directions across this boundary. Prodoscore receives the authenticated, structured tool requests the assistant sends — including the tool name, parameters, and request metadata — and returns the corresponding analytics results. Prodoscore does not receive the user’s full conversation with the assistant, and the assistant provider does not receive Prodoscore data beyond what it requests on behalf of the authorized user.
• Once analytics results are transmitted to the assistant, that data is subject to the assistant provider’s own privacy policy, terms, retention practices, and model-training practices. Prodoscore does not control them.
• Customers are responsible for reviewing an assistant provider’s privacy and security practices before enabling the connection.

Further detail is available in the Prodoscore AI and MCP Privacy Notice.

6. Information Processed

AI features and connected assistants process information already present in the Customer’s Prodoscore environment. The specific information available depends on the Customer’s configuration and the authenticated user’s permissions.

Identity and organizational information: name, employee or user identifier, job title or role, department or organizational unit, manager and reporting relationships, time zone, and information required for authentication.

Productivity and activity information: Prodoscore scores and classifications, active time and working-time metrics, meeting and collaboration metrics, application and product usage, adoption metrics, and session-level activity.

User-provided information: questions, prompts, and feedback a user submits to an AI feature.

Technical and security information: authentication events, user and organization identifiers, AI client and integration identifiers, request metadata, performance data, and audit records.

Prodoscore does not expose passwords, payment information, or credentials to AI features or connected assistants.

7. Access Controls, Data Minimization, and Customer Controls

AI features and connected assistants operate within the permissions established for the authenticated user and only return data the authenticated user is authorized to access. Each Customer environment is logically separated, and a user cannot retrieve data belonging to another Customer.

The tools exposed through the Prodoscore MCP Server are read-only. They cannot create, modify, or delete data in Prodoscore.

Customer administrators can:

• Enable or disable AI features for their domain.
• Enable or disable MCP access for individual users.
• Set user access levels, which determine what data AI features and connected assistants can retrieve.

To revoke a connected assistant’s access to Prodoscore, an administrator disables MCP access for the relevant user or domain. Prodoscore does not provide a per-assistant connection management interface; credentials held by the assistant itself are managed in the assistant provider’s own administrative console.

Customers are responsible for configuring user permissions and access levels in their Prodoscore environment.

8. Human Oversight and Employment Decisions

AI-generated output can be inaccurate, incomplete, or wrong. It should be reviewed before it is relied on.

Prodoscore’s AI features produce informational output. They do not make decisions. Prodoscore does not make employment decisions on behalf of its Customers.

Customers are responsible for how they interpret and act on Prodoscore analytics and AI-generated output, including decisions affecting employees and compliance with applicable workplace, privacy, and employment law.

9. AI Model Limitations and Provider Responsibilities

Prodoscore does not train or fine-tune AI models. Algorithmic fairness and bias mitigation for the underlying models are the responsibility of the model provider, currently Google via Vertex AI under Gemini Enterprise.

Prodoscore applies its AI features to workplace productivity data within the controls and configurations of its platform and applicable Customer agreements. AI output is informational and does not make employment decisions. Customers are responsible for how they interpret and act on that output, including compliance with applicable employment and anti-discrimination law.

10. Security and Retention

Customer data is hosted on Google Cloud Platform and encrypted in transit and at rest. Access is controlled through authentication, role- and organization-based authorization, and least-privilege principles. Prodoscore maintains security monitoring and audit logging, and performs vulnerability management and security testing. Further detail is available on the Prodoscore Security & Privacy page.

Prodoscore maintains a SOC 2 Type 2 attestation. Additional detail is available to Customers under confidentiality.

Security incidents involving personal information processed through AI features are notified under the breach notification provisions of the applicable DPA.

Retention is governed by the applicable Customer agreement and the DPA. Prodoscore does not delete these records after a set number of days. Prodoscore keeps the records for the term of the service agreement. Prodoscore deletes the records when the customer makes a deletion request. The Data Processing Agreement (DPA) gives the conditions and the time limits for these requests.

Prodoscore keeps these record types:

• AI features interaction records. These records include user questions, prompts, and generated responses. Prodoscore deletes them when the customer makes a request.
• MCP request metadata and integration logs. These records hold no customer content. Prodoscore uses them only for analysis and for service operation.
• Authentication and security audit records. These records hold no customer content. They hold only the identifiers that are necessary for security purposes, for example, the user identifier, the IP address, and the time of the event. Prodoscore uses them only for security monitoring and analysis.
• Service telemetry and performance data. These records hold no customer content. Prodoscore uses them only for analysis and for service performance monitoring.

Prompts and requests transmitted to a Customer-selected AI assistant are retained by that assistant provider under its own retention practices, which Prodoscore does not control. On termination, personal information processed through AI features is deleted or returned under the applicable DPA.

11. Changes to This Framework

Prodoscore updates this Framework as its AI features, providers, or governance practices change. Material changes are reflected in an updated version of this Framework.