AI IN CYNOMI

AI in Cynomi: What Happens to Your Clients’ Data

When your team uses Cynomi’s agentic platform and AI coworkers, your client’s evidence and policies are processed by a short list of named providers, stay inside their own region, and are never used to train an AI model. Want to know how your client data is protected? This page provides all the answers.

See the provider list Back to CISO Intelligence

The Short Answer

If a client asks what happens to their evidence and policies when your team uses Cynomi’s AI features, this is the whole answer.

Every AI provider is named.

Client material is processed by a short list of providers that Cynomi publishes and dates, with each one’s role and retention position. You do not have to establish whether an undisclosed public AI service sits somewhere in the path, because the full list is further down this page.

Data stays in your client’s region.

US customers are served from US tenants and EU customers from EU tenants, and that covers the AI providers themselves rather than only storage. Regional separation is built into the architecture, so it holds whichever feature a user opens.

No model training on client material.

Client evidence, policies, procedures, and assessments are not used to train, fine-tune, or improve AI models, at Cynomi or at our providers. Material submitted through Cynomi does not enter a public AI service’s general data pool.

Anonymized data is the one exception.

Cynomi may use anonymized, aggregated data to train and improve models. That data cannot be traced to any customer and never includes anything a partner or client uploaded to the portal.

The providers keep nothing.

The AI model providers operate under Zero Data Retention or equivalent enterprise terms, so nothing remains with them once a request completes. Cynomi’s AI observability platform is the single exception, holding operational logs for six months so the service can be run and debugged.

Client environments stay separate.

One client’s material is not surfaced into another client’s environment, and no service provider can reach another’s data. Functionality that works across a service provider’s own client base is scoped to that provider’s clients and never spans providers.

Ownership does not move.

Your client keeps ownership of its evidence, policies, procedures, and assessments, and that material stays subject to the confidentiality, security, and data-processing commitments in your agreement. Using AI does not change any of it.

What the AI Is Allowed to Do

This is what Cynomi’s AI is permitted to do with client data once it has it. Every AI feature runs in response to something an authorized user did, only the data the task requires is sent for processing, and every AI action is logged.

Cynomi’s AI can
  • Read data inside the client account you are working in
  • Draft policies, remediation plans, risk treatments, reports, and implementation guidance
  • Apply a change in the platform after you review and confirm it
  • Label every output as AI-generated
  • Log every AI action
Cynomi’s AI cannot
  • Reach data outside the current client and service provider scope
  • Act without an authorized user starting the task
  • Change anything before you approve it
  • Widen a user’s permissions or bypass platform controls
  • Invent data it does not have. Where there is not enough, it says so

AI features can be disabled at the sub-account level, so a client who does not want AI used on their account is a supported configuration rather than a policy promise.

The AI Providers That Process Client Data

Every provider that processes customer data is used through regionally separated tenants: a US tenant serving US customers and an EU tenant serving EU customers. Google Cloud Platform is listed for transparency only. It powers partner-initiated prospecting research and does not process customer or client data.

Google Cloud Platform
OpenAI
Langfuse GmbH
Amazon Web Services
Role
Prospecting research (partner-initiated)
AI model inference
AI observability and monitoring
Compute, storage, AI
US customers
US tenant
US tenant
US tenant
US tenant
EU customers
EU tenant
EU tenant
EU tenant
EU tenant (Germany)
Retention
Not applicable, no customer data processed
Zero Data Retention
6 months log retention
Zero Data Retention for AI usage

Current as of 18 Aug. 2026. For EU customers the authoritative list is the sub-processor schedule in the EU Data Protection Addendum. The Cynomi Trust Center carries the current list for all regions.

Where This Sits in Your Agreement

Here’s where our AI usage and AI overviews sit within your contract clauses. Review your executed agreement and reach out to your Partner Account Manager with any questions.

Is our material confidential?
What data does Cynomi process, and on what basis?
Who owns what?
How is personal data handled, and which sub-processors are involved?
Audit and certification
Where it is addressed
Partnership Agreement, Confidentiality
Partnership Agreement, Partner Data
Partnership Agreement, Proprietary Rights
Data Protection Addendum (EU or US, as applicable), including the sub-processor schedule and, for EU and UK transfers, the Standard Contractual Clauses
Partnership Agreement and DPA audit provisions. SOC 2 Type II available through the Trust Center

Frequently Asked Questions

Does Cynomi use client data to train AI models?

No. Partner and client evidence, policies, procedures, and assessments are not used to train, fine-tune, or improve AI models, at Cynomi or at our providers. Cynomi may use anonymized, aggregated data that cannot be traced to any customer and contains no material uploaded to the portal.

Where does the AI processing happen?

In your region. Cynomi runs separate US and EU tenants with each provider, so US customers’ data is processed in US tenants and EU customers’ data in EU tenants. AI inference follows the same split as storage, and data is not routed cross-region for AI processing.

Does Cynomi staff read our prompts?

Cynomi staff have no access to live prompt sessions. AI interactions are logged in our observability platform for a limited period, currently six months, and may be used for quality improvement and debugging.

What if we don't want AI features used on a particular client?

AI features can be disabled at the sub-account level, so you can run a specific client without them.

Are we told when a new AI provider is added?

Yes. Cynomi notifies partners before adding any sub-processor, and AI sub-processors are no exception.

Is the AI's output guaranteed to be accurate?

No, and no vendor can honestly claim otherwise. Cynomi’s AI supports a qualified practitioner’s judgment rather than replacing it, and output should be reviewed before it reaches a client, which is consistent with the warranty terms in your Partnership Agreement.

Ready to See What Cynomi’s AI
Can Do for Your Team?

Book a demo and see the insight Cynomi CISO Intelligence generates, using your own team and client context.

Book a Demo