What leaves EstatesBase and to whom

This page explains the data notice your administrator accepts before switching AI assistants on, point by point.

When anything leaves

EstatesBase never sends your data to an assistant on its own. Data leaves only when a person's connected assistant asks for it. Every request is recorded in your organisation's activity log.

Nothing leaves until three things have happened: EstatesBase has switched AI assistants on for your organisation, your administrator has accepted the data notice and switched the policy on, and a person has connected their own assistant.

What an assistant can see

Only what the person who connected it can see in EstatesBase. That is limited further by:

• Your organisation's policy: who may connect, which assistants, which areas, and how people are named.
• The person's own choices when they connect: which areas, which sites, read only or not, and for how long.

Who receives it

The assistant's provider. For example Anthropic (Claude), OpenAI (ChatGPT), Microsoft (Copilot) or Google (Gemini). The provider receives:

• what the assistant reads from EstatesBase, and
• what the person types into the assistant.

The provider is your organisation's processor, not ours. Your organisation needs its own agreement with each provider whose assistant it allows, as it would for any other service its staff use. How long the provider keeps the conversation, and where, is set by that agreement and by the provider's own terms.

EstatesBase does not pass your data to anyone else because an assistant is connected.

What never leaves

Whatever the policy or the person chooses, an assistant never receives:

• email addresses, phone numbers or home addresses
• the contents of files (it can say what a piece of evidence proves, never open the file)
• confidential incidents
• DBS, barring and clearance documents or outcomes
• sensitive risk assessments, unless the person is on the assessment's list
• witness statements, or the people taking part in an off site visit
• passwords, two-factor settings, single sign-on settings, API tokens or encryption keys

Colleagues named in records are shown as your administrator chooses: first names only, full names, initials only, or roles only.

What EstatesBase records

For each call an assistant makes, EstatesBase keeps:

• when it was made, by whose connection and through which assistant
• which tool was used and what happened (done, refused, and so on)
• a short summary of what was asked, with personal details removed
• how long it took

For each connection, EstatesBase keeps what the person chose (the areas, kinds of action, sites and length), when it was made, approved, last used and ended.

Sign-in tokens are stored only in a scrambled form that cannot be turned back into the token.

Administrators read all of this on the Activity and Connections tabs. Each person sees their own on Connected apps.

Switching off

Your administrator can switch AI assistants off at any time. Doing so ends every connection at once. Each person can also disconnect their own assistant at any time.