AI Governance & Data Handling Policy

What Happens When Data Is Uploaded

1. Access is gated — data submission requires an authenticated, authorized login; it is not open to anyone.
2. Every record is validated against a required schema (state, zone, male/female account ownership) before acceptance.
3. Records with missing or inconsistent fields are explicitly flagged and reported back — never silently dropped or imputed with a guessed value.
4. The submitting institution and an ingestion timestamp are recorded alongside the data itself.
5. Once real data is ingested, every analytical engine on the platform switches from the illustrative baseline to the real dataset — nothing runs on a silent mix of both.
6. The action is reversible: a revert function restores the illustrative baseline if an institution needs to withdraw or correct a submission.
7. No customer-identifiable data is requested or accepted — only aggregated, state-level fields are validated and stored.

AI Governance Principles

1. Every AI-generated output is explicitly labelled Observed, Derived, or Inference — real cited data, computed figures, and AI-generated hypotheses are never blended without saying which is which.
2. The AI never has decision authority. Every prompt instructs it to project and hypothesize, never to assert certainty or make a policy or eligibility determination itself.
3. Illustrative and real data are never silently merged in an AI narrative, even when a single answer touches both.
4. Human review is the final step throughout — certificates, screening hits, opportunity scores. None of it acts autonomously; all of it is decision support.
5. Data minimization by design: the AI Data Assistant and analytical engines see only aggregated fields, never customer-identifiable records.
6. Model transparency: Claude Sonnet 4.6, accessed via Anthropic's commercial API, which does not train on customer data under Anthropic's standard terms.
7. All of the above operates under AGXII's registered NDPC Data Controller/Processor status (NDPC/DCP/10797) — a real, verifiable registration, not an unsupported claim.

At a Glance