AI Usage and Risk Policy
1. Purpose and Scope
This policy describes how Docwright Software LLC ("DocWright") manages risk associated with the optional AI-assisted alt-text feature within the DocWright application. It applies specifically to DocWright's use of the Anthropic Claude API; DocWright does not develop, train, host, or operate any AI or machine learning model itself.
2. Two-Layer Risk Model
DocWright's AI risk posture rests on two distinct layers, and this policy is deliberate about not conflating them:
Layer 1 — Underlying infrastructure (Anthropic's responsibility)
Anthropic, the provider of the Claude API used for the AI alt-text feature, holds SOC 2 Type 2, ISO 27001, and HIPAA compliance certifications covering its own infrastructure, security program, and data handling. DocWright relies on this underlying certified infrastructure rather than duplicating it.
Layer 2 — DocWright's own integration risk (DocWright's responsibility)
Separately, DocWright is responsible for how it integrates and constrains its use of that API. This policy addresses that second layer specifically — it is not a restatement of Anthropic's certifications, but a description of DocWright's own design choices that limit risk in how the API is used.
3. DocWright's Risk-Limiting Design Choices
- Minimal data exposure: Only a single, individually extracted image is sent per AI request — never the surrounding document text, file, or metadata. This is a fixed architectural constraint, not a configurable setting that could be loosened.
- Opt-in by design: The AI feature is never invoked automatically. A user must explicitly click "Generate AI Descriptions" for each document, and an institution can disable the feature entirely by not providing an Anthropic API key.
- Institution-controlled API relationship: Each institution supplies and manages its own Anthropic API key. DocWright does not provide, proxy, or have visibility into this key, and is not a party to the data-handling terms governing that institution's own API usage — those terms are between the institution and Anthropic directly, under Anthropic's commercial (not consumer) terms of service.
- No model training or fine-tuning: DocWright does not train, fine-tune, or otherwise modify any AI model. It is solely a consumer of Anthropic's existing commercial API.
- No plugin or multi-step automation: Each AI request is a single, direct API call with no chained actions, plugins, or downstream automated decisions based on the model's output beyond inserting the generated description text into the document.
4. Human Oversight
AI-generated descriptions are inserted into the processed document automatically, without requiring approval prior to insertion. However, the user retains the original file alongside the processed file and a fix report listing all AI-generated content, allowing review and manual editing of any description before final use (e.g., before uploading to the institution's LMS). DocWright considers this post-hoc review workflow appropriate given the low-stakes, easily reversible nature of the output (descriptive alt text, not a decision affecting any individual).
5. Incident Response for the AI Feature
Because the AI feature depends entirely on an institution-supplied API key, it can be disabled immediately by removing or not renewing that key in the application's Settings panel — no DocWright-side action or reinstall is required. This is the primary control available in the event of an identified issue with the feature.
6. Current Limitations
DocWright does not yet have a formal, written AI risk-management framework modeled on a published standard (e.g., NIST AI RMF), nor a dedicated AI governance function, consistent with the company's current single-founder structure. This policy represents DocWright's current, good-faith documentation of its actual AI risk-limiting practices, and will be expanded as the company grows.
7. Related Documents
- DocWright Data Privacy Policy
- DocWright Information Security Policy
- DocWright Data Privacy Impact Assessment
8. Contact
Gregory Buthusiem, Founder & Managing Member
Docwright Software LLC
(856) 817-5100