AI PRIVACY ARCHITECTURE
Names recorded in your workspace, and names written with a title, are replaced before anything leaves our servers.
The question and record text of every AI request passes through the AI gateway before it can leave our servers; fixed instructions, including your organisation's name, are sent as written. The gateway replaces recorded names and contact details, blocks secrets, looks for health information, applies your organisation's AI mode and records the request. Search indexing runs on our own servers and never goes to OpenAI.
STEP 1
Scan the request
The question and record text in each request is scanned with word lists, injury and body-part rules, and your list of known people. Fixed instructions, including your organisation's name, are sent as written.
STEP 2
Block secrets
Text that looks like a password, PIN, door or alarm code, API key, access token or private key is blocked from every model.
STEP 3
Replace names and contacts
Recorded names, titled names, emails, phone numbers, postcodes and National Insurance numbers become placeholders.
STEP 4
Decide by your AI mode
Health and other special-category wording keeps the whole request on our own model in France. Otherwise your AI mode decides: our own model, or OpenAI.
STEP 5
Record every request
Every request writes a record to your audit trail: date, feature, where it was processed and the outcome. Never its content.
BEFORE: WHAT YOU WROTE
“Sarah Adjei reported that the forklift reversed into the racking at Dock 3. Call 07700 900456.”
AFTER: WHAT LEAVES OUR SERVERS
“[PERSON_A1] reported that the forklift reversed into the racking at Dock 3. Call [CONTACT_A1].”
An example of real output. A name is recognised when it is recorded in your workspace (team members, incident and observation reporters, people in absence, working-hours and lone-worker records, contractors, emergency contacts, the organisation's responsible person, the assessors, approvers and data owners named on assessments and documents, and wellbeing-survey respondents who leave their name) or carries a title such as Mr or Dr. Other names typed into free text may not be recognised.
RESIDENCY
Stored in France
Records are stored in France. A request with detected health information stays on our own model in France. If your mode allows it, other drafting may go to OpenAI, which may process it in the United States.
YOUR CONTROL
Four modes
Off, Sovereign, Restricted or Standard, set per organisation. Off switches AI drafting and the assistant off and leaves everything else working.
ISOLATION
Per organisation
The server returns only the signed-in organisation's records, checked on every request.
OFF
AI switched off
AI drafting and the assistant are switched off for the organisation. Search still indexes records with our own on-server model; nothing is sent to OpenAI. Everything else keeps working.
SOVEREIGN
Our model only
Nothing is sent to OpenAI; all AI runs on our own model in France. On current hardware it is slow: Ask Trex still answers, more slowly, but document drafting (management system, risk assessments, investigation write-ups, site recommendations) does not complete and must be written by hand.
RESTRICTED
Totals and trends
Only anonymous totals and trends may be sent to OpenAI. No current feature sends totals, so today it behaves like Sovereign.
STANDARD
The default
Requests may be processed by OpenAI (OpenAI OpCo, LLC), which may process them outside the UK and EU, including in the United States. Recognised names and contact details are replaced first, and detected health information stays on our own model.
Health information (injuries, illness, mental health, religion, trade-union membership, criminal records and similar) is detected automatically using term lists, injury and body-part rules and your list of known people. Detection uses word lists and rules, so it can miss wording they do not cover. It is a safeguard, not a guarantee, so an organisation that cannot accept that residual risk should choose Sovereign or Off. The application never puts passwords, sign-in codes or tokens into a request. Text that looks like a password, PIN, door or alarm code, API key, access token or private key is blocked from every model. Every AI request writes a record to your audit trail (date, feature, where it was processed, outcome), never its content. The full details are in the privacy notice.