AI Principles
Version 1.0.0
Qualsis AI Principles
Why we wrote this
We build software that uses artificial intelligence. So do most of our peers. What we want our customers, our prospects, and the people whose data flows through our products to know is how we think about it, specifically and not in the abstract.
The AI conversation is loud, and much of it is marketing. The principles below are what we do, expressed as positions we are willing to be held to.
Six principles. Then the things we will not do. Then how we govern this, and how you can check it.
Our principles
1. Intelligence you can explain
We design every forecast, signal, and recommendation our products surface to carry the reason behind it. If our software says a margin is eroding, you see the drivers. If it says a client is fading, you see the evidence. A conclusion we cannot explain is a conclusion we do not want to show you.
This is a design commitment. It rules out a category of features that would have been faster to build, and we made that choice deliberately.
2. The human decides
Our products support decisions made by the people who use them. They do not make consequential decisions on their own. A QortexOS recommendation is an input to your judgment. Where a decision affects a person, such as their employment, their finances, or their access to services, a human reviews it before it stands.
We build for that checkpoint even where the law does not require it, because the failure of an automated consequential decision costs more than the inconvenience of a review.
3. Your data trains models only if you opt in
We do not use customer data to train models, and we do not authorize anyone else to. The AI features in QortexOS run on foundation models operated within AWS infrastructure through Amazon Bedrock, under our AWS agreements. On our current approved Bedrock deployment and models, the companies that build the models do not receive or otherwise process customer data, and customer data is not used to train models.
If we ever offer a feature where your data improves a model for your benefit, it will be an opt-in: off by default, specific to the model and the kind of data, and reversible. The binding version of this commitment is in our Terms of Service and Data Processing Addendum.
4. Compliance is structural
We build compliance into how the software works. Tenant isolation, encryption, audit trails, breach notification, and deletion are parts of the product, not features added at the end to satisfy a checklist.
The full set of obligations we accept under data protection law is in our Data Processing Addendum. How the platform is secured is described in our Security Overview. These principles explain why we accept them.
5. Truth and privacy can coexist
A product can tell you the truth about your business and protect the privacy of the people inside it. The analyses we surface are based on your own data, or on data that has been aggregated and de-identified. Our peer benchmarking is engineered to prevent participants from being identified: the pipelines enforce minimum group sizes, add statistical noise, and suppress or merge small groups before any benchmark is produced. We do not expose your business in order to help you compare it with others.
6. Earned autonomy
Where our products act with some independence, such as surfacing a signal before you ask or suggesting a next step, that independence is bounded, observable, and earned. Bounded by what you authorized. Observable in audit trails. Earned by results and by your trust over time. We start with a human in the loop, and we remove the loop only when we and you agree it is safe.
What we will not do
These positions apply to every product we operate, and to our own use of AI in running the company. The binding statement of each is in our Responsible AI Policy at https://qualsis.com/legal/trust/responsible-ai, which also applies them to customers.
- No fully automated adverse decisions about people in matters affecting employment, credit, housing, education, healthcare, government benefits, or legal status. Software can assist the decision. It does not make it.
- No biometric identification, emotion detection, or social scoring of people. We do not build it, and we do not enable it.
- No processing of children's personal data through our products, which are not designed for it.
- No deepfakes, impersonation, or intentional deception of real people.
- No use of AI to harm minors, or to harass, harm, or discriminate against anyone.
- No circumventing the safety mechanisms of the AI models we use.
- No models trained on customer data without an explicit, specific, reversible opt-in. It is restated here because it is fundamental.
A customer that uses our products against these positions is in breach of the Acceptable Use Policy.
How we govern this
We treat AI governance as part of how the company is run.
- AI system inventory. We keep an inventory of the AI systems we build and use: what each one is for, the data it handles, its risk classification under the EU AI Act and similar frameworks, and any conditions on its use.
- Impact assessments. Before a material AI feature reaches general availability, it goes through a structured impact assessment covering regulatory classification, privacy, risk to the people affected, and mitigations. Where the assessment finds an unresolved issue, the feature waits.
- Vendor review. Every AI vendor is reviewed against our positions on training rights, ownership of outputs, notice of model changes, incident response, and regulatory exposure. Vendors that do not meet them are not used.
- Human accountability. Every material AI decision in our products and operations has a named accountable person. Today that is the founder. As we grow, the responsibility will be shared and still named.
- A written trail. Decisions about AI features, vendors, and policy are written down. We are too small to have institutional memory, and we intend to be too large to rely on it.
How you can check these principles
Published principles are sometimes statements a company hopes are true. These are statements we are willing to be held to. Here is how to check them:
- Read the Data Processing Addendum at https://qualsis.com/legal/trust/dpa. Our commitments on training, deletion, breach notification, audit rights, and support for individuals' rights are binding there. If these principles and the Addendum ever differ, the Addendum controls.
- Read the Responsible AI Policy at https://qualsis.com/legal/trust/responsible-ai and the Acceptable Use Policy at https://qualsis.com/legal/trust/acceptable-use. The "we will not" positions are binding rules there.
- Review our subprocessors at https://qualsis.com/legal/trust/subprocessors. It names every company that processes customer data for us, and the companies whose AI models we run.
- Review our Security Overview at https://qualsis.com/legal/trust/security. Tenant isolation, encryption, access control, audit trails, and incident response are described there.
- Ask us. We answer security and AI questionnaires from customers and prospects. Use the Qualsis Security contact form for security documentation, or the Qualsis Privacy contact form for questions about data and AI.
- Hold us to it. If you believe we have not lived up to these principles, in a feature, a vendor choice, or a public statement, tell us through the Qualsis Privacy contact form. We answer in writing.
Specific products
QortexOS
QortexOS is operational intelligence software for managed service providers and similar businesses. Its AI surfaces signals, forecasts, recommendations, and peer benchmarks. Each is designed to be explainable, and each is an input to your judgment, not a substitute for it. QortexOS does not make decisions about your employees, your clients, or anyone else. You do.
QoherenceAI (in development)
QoherenceAI is the platform we are building for AI agents in regulated industries. Where QortexOS surfaces signals to people who decide, QoherenceAI will let customers build agents that act for them. That is a step up in autonomy, and we treat it that way. QoherenceAI agents will, by design:
- Operate within the bounds their operator authorizes
- Leave an audit trail for every action they take
- Stop for human review before actions that the operator or the law marks as consequential
- Refuse configurations that would break the positions in "What we will not do"
We will publish QoherenceAI-specific commitments before it becomes generally available.
How this changes over time
These principles will change as the law moves, as our products mature, and as we meet uses we did not anticipate. When we make a material change, we will tell existing customers, record it in the change log, and keep the earlier version available. If you have a view on how these principles should change, send it through the Qualsis Privacy contact form. We respond to substantive feedback.
About this version
This is version 1.0.0 of the Qualsis AI Principles, the first published version. The effective date shown below is the date this version started applying. Archived versions and a change log of material updates are kept at https://qualsis.com/legal/trust/changelog.
Last updated: September 21, 2026 · Effective: September 21, 2026