Data Privacy & content ownership.

1. What Gets Sent to AI Providers

ChatLMS uses two AI providers. OpenAI produces semantic embeddings of your content (so the system knows which module is relevant to a question) and powers the "Generate with AI" authoring tools. Anthropic (Claude) generates the chat answers and the step-by-step instructions drafted from your content. Here's exactly what travels to those providers and what stays in your own database.

Video and audio files are transcribed by a self-hosted Whisper service running on our own infrastructure. The audio is not sent to OpenAI, Anthropic, or any third-party transcription API. Only the resulting transcript text is then used for embeddings and instruction generation as described above.

2. How Our AI Providers Handle Data

Anthropic (chat answers + generated instructions) does not use data submitted through its commercial API to train its models. See Anthropic's Commercial Terms of Service.

OpenAI (embeddings + AI authoring) likewise does not use customer-submitted API inputs, outputs, or embeddings to train its models, as documented in their API data usage policies. Inputs and outputs may be retained briefly for abuse-and-misuse monitoring, then deleted. ChatLMS does not opt in to any data-sharing or fine-tuning program with either provider that would override these defaults.

If you have a contractual requirement that no customer data leave a specific jurisdiction or pass through these providers at all, contact us about a self-hosted deployment with the models running in your own infrastructure.

3. Per-Organization & Per-Knowledge-Base Scoping

Every content row in our database is tagged with an org_id AND a knowledge_base_id. Application code rejects any query that doesn't filter by both. Cross-org data exposure has three independent guards:

• Application-layer query filters (every endpoint scopes to the caller's org and active KB).
• Postgres Row-Level Security policies that enforce the same scope at the database driver layer, so an accidental missing filter still produces no rows.
• JWT claims that bind a session to an organization; tokens issued for one org are invalid for another.

Knowledge bases inside the same organization are also strictly scoped. A customer- facing widget on one knowledge base can never surface content from your internal employee training KB even if both belong to the same org.

4. How Your Data Is Stored

• Database: managed PostgreSQL with encryption at rest (AES-256 provided by the cloud provider) and daily backups. Connections use TLS 1.2+.
• File assets (videos, audio, PDFs, page-builder images): stored in private S3-compatible buckets. Direct URLs are time-limited signed URLs, not public objects.
• Embeddings: stored in your organization's database alongside your content using pgvector. They never leave our infrastructure.
• Chat conversations: stored per-user with a soft-delete flow. Conversations a user removes from their history are hard-deleted from the database after 30 days, including the underlying queries, results, and ratings.

5. Who Can See Your Data

• Within your organization: only users you've invited and approved. Admins can manage everything; editors can manage content; standard users see the content visible to their profile (per-profile visibility rules are configurable).
• ChatLMS staff: a small operations team may access production infrastructure for debugging, deploys, or incident response. All such access is logged and limited to least-privilege roles.
• Subprocessors: see the table below. We never share your content with a subprocessor for any reason other than delivering the service you've signed up for.

6. Data Deletion & Portability

You can delete an organization, knowledge base, user, module, or page at any time via the admin portal. Deletes go to the recycle bin first (15-day window for restoration); after that the underlying rows + S3 assets are hard-deleted on the next reaper run.

If you cancel your subscription, your data remains accessible during the current billing period and is purged after 30 days unless you request export. Export currently happens on request: email us and we'll deliver a JSON archive of your content, users, and chat history within 5 business days.

7. Subprocessors

We use the following third-party services to deliver ChatLMS. Each is bound by its own data processing agreement; none is used to surface your content to anyone outside your organization.

Provider	Purpose	What they receive
Anthropic anthropic.com	Chat answers & generated instructions (Claude Haiku 4.5)	End-user chat questions + the retrieved snippets used to answer them, and transcripts used to draft step-by-step instructions. Not used for training (per Anthropic's commercial API terms).
OpenAI openai.com	Embeddings & AI authoring (Generate with AI)	Module text for embedding, and the author's prompt + retrieved org context when an admin generates content. Not used for training (per OpenAI's API policy).
Stripe stripe.com	Subscription billing & payment processing	Org name, billing address, and payment method. No content or user data beyond what's needed to bill the account.
AWS aws.amazon.com	Hosting (compute, database, file storage), email delivery (SES)	All your data, encrypted at rest. AWS does not access content; they're a hosting provider only.

When we add or change a subprocessor we'll update this list and notify customers with active enterprise agreements at least 30 days in advance.

8. Contact

For privacy questions, data-processing agreement requests, deletion requests, or to report a security concern, email us at privacy@chatlms.ai. Security-sensitive reports get a response within one business day.

Related: Terms of Service →