AI Disclosure

1. Which AI provider we use

SponsorGuard's AI-assisted features are powered by Claude models from Anthropic, PBC, accessed through the Anthropic API. We do not train or host our own models, and we use no other AI provider.

Three features use it: document field extraction, the CortexAI question-and-answer assistant, and the executive-summary narrative in an audit pack. Everything else in SponsorGuard — deadline tracking, right-to-work records, salary checks, reminders, audit-pack assembly — is deterministic code with no AI involved.

2. What is sent, feature by feature

This is the complete list of what leaves our systems for the AI provider. Nothing else is sent.

• Document extraction — the uploaded file itself. The document is sent as a PDF or as a JPEG/PNG image, together with a fixed instruction naming the fields to extract. This means that if you upload a passport, visa, or DBS scan and run extraction on it, the image of that document is sent to the AI provider. If you do not want a particular document sent, do not run extraction on it: uploading and storing a document does not send it anywhere.
• CortexAI assistant — the text of the question you type, plus up to five chunks of our GOV.UK sponsor-guidance corpus selected to answer it. No worker records, documents, or workspace data are sent with the question. If you type personal data into the question box, that text is sent, so do not type worker names or identifiers into questions.
• Audit-pack executive summary — the organisation name, the sponsor licence status, the readiness score, the questionnaire counts, and the text of up to eight identified compliance gaps. Gap text can name an individual worker where the gap relates to that worker's record. No documents, passport numbers, dates of birth, National Insurance numbers, or salary figures are sent.

3. Training on customer data

Your data is not used to train AI models — not by us, and not by the AI provider. We send data to the Anthropic API under commercial API terms, under which inputs and outputs are not used to train Anthropic's models. We do not use your data to train, fine-tune, or evaluate any model of our own.

4. Retention by the AI provider

We retain the AI output: extracted fields are stored in your workspace for review, and CortexAI conversations are stored in your workspace until you delete them. The input document itself stays in your workspace's object storage regardless of whether extraction is run.

Anthropic automatically deletes API inputs and outputs within 30 days, except where retained longer to enforce its Usage Policy (up to 2 years if flagged) or where required by law. No zero-data-retention arrangement is in place.

5. Where it is processed, and the transfer mechanism

The Anthropic API is processed in the United States, so using an AI feature is a restricted transfer of personal data out of the UK.

Transfers to Anthropic are covered by Anthropic's Data Processing Addendum incorporating the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.

6. Turning AI features off

AI features are controlled by deployment-level server configuration (SPONSORGUARD_AI_ENABLED). AI provider calls require this setting to be enabled and an AI API key to be configured. When disabled, document extraction returns empty fields with zero confidence rather than model-extracted values; CortexAI answers and audit-pack narratives use deterministic behaviour without a model call. Nothing is sent to the AI provider in that mode.

A workspace-specific AI toggle is not available. The deployment-level setting applies to all workspaces on that deployment. On the hosted SponsorGuard service this setting is enabled, so AI features are active for all workspaces.

7. Accuracy, and who remains responsible

AI-assisted output may be inaccurate, incomplete or out of date. It reflects the Home Office guidance corpus as of 2026-05, not today's rules. Always check every citation and extracted value against the current GOV.UK source before acting. Regulated advisers remain responsible for the advice they give their clients.

The guidance corpus CortexAI cites is version 2026-05, synthesised from Workers and Temporary Workers: guidance for sponsors (Parts 2 and 3), Appendix D, and SMS Manual 9. Guidance changes; always check a citation against the current GOV.UK source before you act on it.

No AI output in SponsorGuard is applied automatically. Every extraction and every answer is routed to an authorised human in your workspace, who must confirm it before anything is recorded against a worker or used in a submission. There is no automated decision-making with legal or similarly significant effect for an individual.

Regulated advisers remain responsible for the advice they give their clients. Sponsors remain responsible for their sponsor-licence duties and for every report they make to the Home Office.

8. Questions

Ask us anything about this disclosure at privacy@sponsorguard.com. If your own DPIA needs more detail about the AI route, tell us what you need and we will answer in writing.