AI Governance & Data Processing

1. Overview & Principles

XBert Pty Ltd uses artificial intelligence to power intelligent automation, data analysis, and agent-based workflows that help accounting firms identify risks, anomalies, and opportunities in their financial data. This policy outlines how XBert governs AI usage, protects customer data during AI processing, and ensures responsible AI practices.

XBert’s AI governance is guided by the following principles:

Data protection first: Customer financial data is never used for AI model training. All AI processing data is ephemeral.
Transparency: Users are informed when AI is involved in generating recommendations or performing analysis.
Human oversight: AI recommendations are presented to users for review. Automated actions require explicit user configuration.
Accountability: AI interactions are logged for quality assurance, compliance, and auditability.
Continuous improvement: AI capabilities are monitored, evaluated, and improved based on performance data and user feedback.

2. AI Providers & Architecture

2.1 AI Providers

XBert integrates with the following AI providers:

Provider	Models Used	Purpose	Data Handling
OpenAI	GPT-5.4, GPT-5-mini, GPT-5-nano, GPT-4.1, GPT-4.1-mini, GPT-4o-mini	AI agent workflows, data analysis, document processing, automation	Ephemeral processing; no data retention per DPA
Anthropic	Claude Opus 4.8, Opus 4.7, Sonnet 4.6, Haiku 4.5	MCP tool execution, code generation, analysis, recommendations	Ephemeral processing; no data retention per DPA

All communication with AI providers is secured via TLS 1.2 or higher.

2.2 Architecture

XBert’s AI architecture consists of the following components:

Component	Purpose
AI Agent Framework	Built on Microsoft Agent Framework; orchestrates agent-based workflows and multi-step analysis
AG-UI Protocol	Server-Sent Events (SSE) streaming protocol for real-time delivery of agent responses to the user interface
MCP Server	Model Context Protocol server providing structured tools for AI agents to retrieve data and perform actions within defined boundaries
AI Memory Service	Mem0-based memory service hosted on Azure Container Apps within Australia; provides persistent context across agent sessions
Azure Functions	Hosts model orchestration, versioning, and monitoring capabilities

2.3 Data Flow

User initiates a request via the XBert web application
The request is processed by the API backend, which invokes the appropriate AI agent
The agent retrieves relevant data via MCP tools (scoped to the user’s permissions)
Data is sent to the AI provider for analysis via encrypted API calls
The AI provider processes the request and returns results (data is not persisted by the provider)
Results stream back to the user interface via the AG-UI protocol
All data returns to and remains within Australian-hosted XBert systems

3. Data Handling & Sovereignty

3.1 Data Processing Principles

Ephemeral processing: All data sent to AI providers is processed in real time and is not stored, cached, or retained by the provider beyond the duration of the API call
No training data: Customer financial data is never used for training, fine-tuning, or improving AI models by any provider
Pattern detection: XBert’s AI capabilities use pattern detection and anomaly detection rather than labelled training data derived from customer records
Minimum data principle: Only the data necessary for the specific analysis or task is included in AI processing requests

3.2 Data Sovereignty

Data Type	Location	Notes
Customer financial data (at rest)	Australia (Azure Australia Southeast / Australia East)	All persistent storage remains within Australia
AI memory and context data	Australia (Azure Container Apps)	Mem0 service hosted within Australian Azure regions
AI processing requests	May transit to US-based API endpoints (OpenAI, Anthropic)	Data is ephemeral; not persisted by providers; returns to Australian systems
AI interaction logs	Australia (Azure Australia Southeast)	Audit logs stored within Australian Azure regions

XBert acknowledges that AI processing requests may flow to API endpoints located outside Australia. This is mitigated by:

Data Processing Agreements with each provider prohibiting data retention
Ephemeral processing with no persistence at the provider
All persistent data remaining within Australian Azure regions
TLS 1.2+ encryption for all data in transit

4. Data Processing Agreements

XBert maintains Data Processing Agreements (DPAs) with all AI providers. These agreements ensure:

Requirement	Coverage
No data retention	Providers must not store, cache, or retain customer data beyond the API call
No model training	Customer data must not be used for training, fine-tuning, or improving models
Sub-processor disclosure	Providers must disclose any sub-processors involved in data handling
Breach notification	Providers must notify XBert within 24 hours of any data breach
Data deletion	Confirmation that data is not persisted and therefore requires no deletion
Audit rights	XBert retains the right to request evidence of compliance

DPAs are reviewed annually and updated when provider terms change or new providers are onboarded.

5. Responsible AI Practices

5.1 Human Oversight

All AI-generated recommendations are presented to users for review before action is taken
Automated actions (such as recurring checks or alerts) require explicit user configuration before they are activated
Users can review, accept, modify, or dismiss any AI recommendation
Critical financial decisions always require human approval

5.2 Bias Mitigation

XBert does not use customer-specific labelled training data, reducing the risk of reinforcing biases present in individual datasets
AI models are evaluated for consistency and fairness across different data profiles
Regular review of AI outputs is conducted to identify and address any systematic biases in recommendations

5.3 Explainability

AI recommendations are accompanied by confidence scoring to indicate the reliability of the analysis
Contextual explanations are provided alongside suggestions, helping users understand the reasoning behind each recommendation
Where applicable, the specific data points that contributed to a recommendation are highlighted

6. Model Management

6.1 Versioning & Deployment

AI model integrations are version-controlled alongside application code
Model updates and prompt changes follow XBert’s standard SDLC process, including code review and testing
Deployments are managed through CI/CD pipelines with rollback capability
Changes to AI prompts, agent behaviour, or model selection are tracked in version control

6.2 Monitoring

Monitoring Area	Method
Model performance and response quality	Periodic manual review of AI outputs
Response latency and availability	Azure monitoring and alerting
Error rates and failures	Application logging and Sentry error tracking
Token usage and cost	Provider dashboard monitoring
Anomalous behaviour	Automated alerting on deviation from expected patterns

6.3 Model Selection and Updates

XBert selects AI models based on:

Task suitability and capability for financial data analysis
Provider security posture and compliance certifications
Data processing terms and DPA coverage
Performance characteristics (latency, accuracy, reliability)
Cost effectiveness

Model selection governance:

Activity	Frequency	Authority
Review of active model selections	Quarterly	CTO
Evaluation of new models or providers	As released by providers	CTO + Development Manager
Deprecation of existing models	As required by provider or performance review	CTO
Addition of new AI providers	As needed	CTO + Director approval (per Vendor Management Policy, Critical tier)

All changes to model selection, prompts, or agent behaviour are tracked in version control and deployed through the standard CI/CD pipeline with rollback capability.

7. AI Audit Trail

AI interactions are logged for quality assurance and compliance purposes:

Log Data	Retention	Purpose
AI interaction metadata (timestamps, model used, request type)	90 days	Quality assurance and troubleshooting
AI responses and recommendations	90 days	Audit trail and compliance
User actions on AI recommendations (accepted, dismissed, modified)	90 days	Feedback loop and quality monitoring
Error and exception data	90 days	Reliability monitoring

Logs are stored within Australian Azure regions and are accessible to authorised XBert personnel for audit and compliance purposes.

8. Customer Controls

XBert provides customers with the following controls over AI functionality:

Visibility: Clear indication when AI is involved in generating recommendations or analysis
Override capability: Users can override, dismiss, or modify any AI recommendation
Configuration control: Automated AI-driven actions require explicit user configuration before activation
Feedback: Users can provide feedback on AI recommendations, which is incorporated into ongoing quality improvements
Data scope: AI processing is scoped to the data the user has permission to access, respecting existing role-based access controls

9. Compliance

This AI governance policy supports compliance with:

Privacy Act 1988 (Cth) - APP 6 (use or disclosure of personal information), APP 8 (cross-border disclosure of personal information), APP 11 (security of personal information)
Australian AI Ethics Principles - Alignment with the Australian Government’s voluntary AI Ethics Framework (human oversight, transparency, accountability, fairness)
GDPR Articles 13, 14, and 22 (transparency, automated decision-making) where applicable to EU/UK users
ISO 27001 Annex A controls relating to information processing and third-party data handling
Provider-specific compliance: OpenAI SOC 2 Type II, Anthropic SOC 2 Type II

10. Change History

Version	Date	Changes
1.0	April 2026	Initial creation