How we use AI.

Our commitments

Your data stays out of AI training. We enter client information only into AI tools we have approved, that do not train on customer data, and whose data-retention terms we have reviewed. We never put client data into consumer or free-tier AI tools.

You decide. If you prefer that we don't use AI tools on your data, tell us, and we will follow that choice for your engagement.

People are accountable for the work. We use AI to help us work faster and more thoroughly, for example in analysis, drafting, generating test cases, and meeting transcription and summaries. Every finding, recommendation, and deliverable is reviewed and validated by a NextPuzzleAI professional before it reaches you.

Meetings are recorded only with your consent. We record or transcribe meetings only when everyone on the call agrees. If anyone declines, we take notes by hand instead. Recordings and transcripts are deleted after 90 days unless needed for an engagement you've agreed to.

We're transparent. On request, we'll tell you which AI tools we used in your engagement and how.

AI in security testing stays within the rules. Some of our testing uses AI-assisted techniques to probe your systems, the way real attackers increasingly do. We use them only within the scope, timing, and techniques you approve in our signed Testing Authorization and Rules of Engagement.

We apply our own framework to ourselves

We manage our own AI use with The Corner Piece Framework™, the same model we use with clients. We know what our AI tools can access, we limit what they're allowed to do, we keep clear ownership of every decision, and we check that our controls work.

Questions

For questions about how we use AI, contact us at hello@nextpuzzleai.com.