Soryx
Legal

AI Policy

Soryx uses AI to help you understand and act on your own exposure. This policy sets out exactly how - and the hard limits we place on it.

Last updated

1. Where we use AI

Soryx offers an AI assistant that helps you interpret your scan results, understand what a given exposure means, and decide which removals to prioritise. It runs on Amazon Bedrock within the EU and operates only on the data already in your own account.

2. Scoped to your own data

The assistant is strictly scoped to your own personal data. It cannot look up information about other people, cannot browse the open web on demand, and cannot be used as an investigation or profiling tool. This mirrors our Acceptable Use Policy.

3. No model training - our binding commitment

We do not use your personal data to train, fine-tune, or improve any AI model, and we contractually require our AI provider not to either. Your prompts and data are processed only to generate the response you asked for, and are not retained by the model provider for training purposes.

4. A human stays in control

AI in Soryx is assistive, not autonomous. We do not make solely automated decisions that produce legal or similarly significant effects about you within the meaning of Article 22 GDPR.

  • Removal and erasure requests are sent on your authority and follow defined rules, not opaque model judgement.
  • AI suggestions are recommendations you can accept, edit, or ignore.
  • You can use Soryx fully without engaging the AI assistant at all.

5. Accuracy and limitations

AI output can be incomplete or occasionally wrong. We design prompts to ground responses in your actual data and to avoid speculation, but you should treat suggestions as guidance rather than legal advice. If something looks off, the underlying data in your dashboard is always the source of truth.

6. Data handling for AI features

  • AI processing happens within the EU on Amazon Bedrock.
  • Only the data needed to answer your request is sent to the model, and only for that request.
  • Inputs and outputs are protected by the same encryption and access controls as the rest of Soryx.
  • See our Privacy Policy and Subprocessors page for the full data picture.

For more detail, read our Privacy Policy and Subprocessors page.

Encrypted · EU-hosted · Never sold · Delete anytime

Questions about this document? Email privacy@matrix.eu or write to our Data Protection Officer at dpo@matrix.eu. This page is provided for transparency and does not constitute legal advice.