How Zefort uses AI
Last updated
Zefort uses artificial intelligence to help customers organise, find, understand and work with contracts. The features available to each customer depend on their subscription, settings and hosting setup. This page explains what Zefort’s AI features can do, what data they use and what customers can control.
What Zefort uses AI for
Zefort may use AI to:
- read documents: make them searchable and find, extract or classify information;
- search and analyse: find relevant documents or passages and answer questions about customer content;
- create content: prepare summaries, explanations, translations, comparisons, recommendations and other drafts;
- apply customer instructions: review content using fields, criteria, policies or playbooks set by the customer; and
- run AI agent tasks: follow customer instructions to complete multi-step work, use permitted tools and connected systems, recommend actions, take actions or make decisions.
Who provides the AI models
For features that use language models, Zefort chooses the information needed for the task from data the user is allowed to access. It sends that information and the user’s request to the model selected for the feature. If the task requires tools, the model can use only the tools approved for that task. Zefort then returns or stores the result as part of the feature and carries out any permitted actions.
Zefort uses language models provided by other companies. Zefort does not currently build or fine-tune them, so it cannot control or guarantee their answers. When customers use a model through Zefort, Zefort manages the provider relationship and the technical connection.
AI agents
Zefort may offer AI agents that can complete complex work in Zefort and connected systems. Depending on what the customer enables, an agent may retrieve and analyse information, use tools, and create or change records and files. It may also communicate with other systems or people and recommend or make decisions.
Customers decide what an agent may do. They do this through instructions, reusable sets of instructions called skills, data sources, connections, permissions, limits and approval settings. If the feature supports it, the customer can require approval before particular actions or allow the agent to work independently.
Data used by AI
The data used depends on the task, the customer’s settings and the user’s access rights. It may include:
- contracts, messages, extracted text and other customer content;
- information about that content and links between related records;
- fields, criteria, policies, playbooks, instructions or other settings created by the customer;
- the user’s request and any files or content selected for the task; and
- relevant conversation history, search results, data from connected systems, tool results and work produced while completing the task.
An AI feature can use data only from the relevant customer account. The user, or an automated task acting with the customer’s permission, must be allowed to access that data. Zefort gives the model only the information chosen for the task, not unrestricted access to the account.
AI results and how Zefort stores them
AI results may include extracted information, classifications, search results, answers, summaries, translations, comparisons, references, review findings, recommendations, decisions, messages, actions and drafts.
Zefort stores the data it sends to language models and the results it receives. It may also store the related conversation, references, tools used, actions taken and records needed to operate and protect the service. Much of this information comes from customer content that is already stored in Zefort, such as contracts or conversations.
Stored AI information is part of the customer’s account data. How long Zefort keeps it depends on the related feature and the terms for the customer’s account. Deleting a supported contract, Agent conversation or other record may also remove related AI data.
What customers can control
Depending on the feature, customer administrators may decide who can use it and which model it uses. They may also control what data and tools it can access, what instructions it follows and which actions require approval. Some features may run automatically if the customer chooses to set them up that way.
The customer usually decides why and how personal data in Zefort is used. Under data-protection law, this normally means that the customer is the controller and Zefort handles the data on its behalf. The customer agreement and any separate Data Processing Agreement apply.
Before using an AI feature, customers should consider its purpose and the data it can access. They should also consider what could happen if it makes a mistake and whether any privacy, confidentiality or industry rules apply. Customers should set access rights, instructions, safeguards and oversight to match their needs.
Where AI data is processed
When customers use models provided through Zefort, their prompts and the model’s results are processed in the European Union. Providers and models may change as the service develops. The current providers are listed on the Security and compliance page.
A customer may also connect its own model provider. In that case, data is processed using the provider account and location chosen by the customer. The customer is responsible for reviewing that provider’s locations, security, data retention, model-training terms and any international data transfers. The providers and locations for a Private Instance are listed in the customer’s order or other documents for that setup.
How model providers use and store data
Zefort does not currently train or fine-tune the underlying language models. The providers that Zefort currently uses do not use customer prompts or results to train those models.
For normal, real-time requests, Zefort configures the provider service not to keep the content after returning the result. A provider may still keep basic technical or security records. In limited cases, it may temporarily keep content to investigate misuse, security issues or failed requests. If requests are processed together as a batch, the provider may also keep the content while that work is in progress, as allowed by its terms.
This is separate from the AI information stored in the customer’s Zefort account, as explained under “Results and storage†above. If a customer connects its own model provider, that provider’s agreement and settings determine how it uses and stores the data.
Security
AI features can use data only from the relevant customer account and only when the user or automated task has permission to access it. Zefort sends the model only the information chosen for the task. Connections between Zefort and model providers are encrypted, and AI information stored in Zefort has the same access controls and storage protection as other customer data in the same Zefort setup. See the Security and compliance page for more information about Zefort’s security and current providers.
Limits and human review
AI can make mistakes. It can miss important information, misunderstand instructions, use the wrong material, produce an inaccurate answer or take an unintended action. A mistake can have a greater effect if an agent works quickly, works on many records or acts without approval. Technical limits may also affect large or complex tasks.
Customers should decide when people need to review AI work and how independently an agent may act. Depending on the use, suitable safeguards may include testing, monitoring, restricted access, approval steps and practical ways to stop, override or reverse actions.
If AI is used for regulated work, or to make or support decisions that affect people or their legal rights, the customer must decide whether that use is allowed. The customer is also responsible for meeting the legal requirements that apply to its use of AI and its decisions.
More information
Zefort agrees Data Processing Agreements directly with customers where needed and does not publish a standard DPA online. For questions about AI settings or data handling, contact support@zefort.com. For privacy and DPA questions, contact privacy@zefort.com.