Trust
Responsible AI
Two features use a model. Neither of them is allowed to decide anything. Here is exactly what stops them.
Last updated August 19, 2026
The short version
A model reads uploaded service contracts and answers questions inside the product. That is the complete list of where AI is used.
Nothing a model extracts is trusted. Every field lands marked unverified, a person has to confirm each one against the paper, and the coverage engine still lowers its confidence afterwards — on purpose — and says so on the advisor’s screen.
No customer data is used to train models. Every confirmation is written to an append-only audit log with the name of the person who made it.
With no AI provider configured, the product tells you so and refuses to proceed rather than producing something plausible.
Where a model is used
Reading an uploaded service contract
A service contract arrives as a PDF or a photograph. Instead of an advisor typing a dozen fields off it — administrator, contract number, tier, deductible, term in months and miles, whether prior authorisation is required — a model reads it and proposes them. The advisor checks each one against the document in their hand and confirms.
The Co-Pilot
An in-product assistant that answers questions about the screen the user is on and about how the product works. It reads the context of the current surface; it does not act on the user’s behalf, and it is not shown on any screen a customer holds.
Nothing else. There is no AI in the coverage engine, the pricing, the wear projections or the prep-sheet ranking. Those are deterministic rules over your data, each one unit-tested, each one able to explain which rule fired and which did not. That is deliberate — the answers a customer is quoted from should be reproducible, not generated.
The invariants
1. Extracted fields arrive unverified, and stay that way
A contract created from an upload is stored with its source recorded as machine-read and its verification timestamp left empty. Both facts follow the record for the rest of its life.
The coverage engine treats machine-read-and-unverified as a reason to distrust: any determination resting on such a contract is capped at low confidence, and the reasoning trace the advisor sees says so in words — read from a document and not yet verified; confirm the terms before relying on them. The vehicle screen marks the contract the same way.
The grouping is what makes it durable. The rule keys off a list of machine-read sources rather than being written at each place that checks, so a new extraction method added later inherits the suspicion by default instead of by somebody remembering to add it.
2. Nothing reaches the coverage engine without a person
Confirmation is the only path from an extraction to a usable contract. There is no automatic acceptance, no confidence threshold above which a field is taken as read, and no batch approval. A person looks at every field beside the document and agrees to it, or it does not exist as coverage.
3. A person’s confirmation does not mean the contract is verified
This is the invariant we are most proud of and it is the least obvious one.
It would be easy — and it would look like a feature — to treat the advisor’s confirmation as verification and clear the engine’s low-confidence penalty. It is deliberately not done, because the two are answers to different questions.
What the advisor did was agree that the transcription matches the paper in their hand. That is a real check, and it is why nothing saves without it. But the question the engine’s penalty is asking is a different one: does this policy exist, is it in force, and will the administrator pay? A contract can be transcribed perfectly and still be cancelled, lapsed for non-payment, void on a salvage title, or simply not the copy the administrator holds.
Only the administrator can answer that. Until somebody has rung them, “a human read the document” is the honest ceiling — so the source stays machine-read, the record stays unverified, and the engine keeps warning on every answer it drives. The verification field exists to record a real verification when it happens, not to be filled in by the nearest available person.
4. Every confirmation is on the record
Confirming a contract writes an append-only audit entry naming the person, the document, the vehicle, and the values they accepted. If a customer is later told a repair is covered and the administrator disagrees, that entry is who accepted what, and when. The audit table carries no update or delete policy, deliberately, and credentials are stripped before anything is written.
5. With no provider, it refuses rather than invents
A deployment with no AI provider configured does not fall back to fabricated data or a demonstration mode dressed as a real answer. The upload records that nothing read it, and the advisor is told plainly to enter the fields by hand. A model that will not run is an inconvenience; a model that quietly makes something up is a coverage answer given to a customer on the strength of nothing.
Training and data handling
- We do not train models on customer data. Not our own models, not anyone else’s.
- Our provider is Anthropic, whose commercial API terms state that data submitted through the API is not used to train their models.
- What is sent is what the feature needs: for extraction, the document being read; for the Co-Pilot, the context of the screen the user is on. Not a dealership’s database.
- The Co-Pilot is never shown on a customer-facing screen — not the paired tablet, and not the menu link a customer opens on their own phone.
What we will not do with it
- No model decides what a customer is charged. Prices resolve from your own op-code price book, and where no op code matches the product shows “price to be confirmed” rather than guessing.
- No model decides whether something is covered. That is a deterministic waterfall with a reasoning trace, and the administrator adjudicates the claim regardless.
- No model writes to a customer’s record without a person confirming it.
- No model talks to your customers. There is no AI chat on any customer-facing surface.
- No model scores or ranks your staff. Advisor coaching numbers exist, and they deliberately stay with the advisor.
No certification, and what that means
We hold no AI-governance certification — not ISO 42001, not anything else. The larger vendors publishing a Responsible AI page usually have one, and it is a real thing to have.
What we have instead is that every claim above is a property of the code rather than a policy, which means it is checkable and it fails loudly if someone breaks it. The machine-read confidence rule, the human-confirmation requirement and the audit entry all have tests that exist for the sole purpose of failing if the behaviour changes. A policy document cannot do that.
The rest of the security posture is on the security page, and what we do and do not hold is listed on compliance.
Questions
If your group has an AI-use policy DealerTech.io needs to fit inside, send it to info@dealertech.io.
This document was written from the software it describes, and has not been reviewed by counsel. It is the honest starting text, not legal advice. If a term here matters to your dealership’s decision, tell us and we will get it right rather than argue it later.