This FAQ addresses common legal and security questions RevSure receives regarding AI usage, PII handling, data protection, and platform-level guarantees. It provides clarity on our configuration options, contractual commitments, and the safeguards we’ve implemented in collaboration with Google Gemini.

1. Does RevSure’s AI have access to PII?

No. RevSure supports PII masking configurations that guarantee no personally identifiable information is shared with GenAI tools. Customers can activate these controls to ensure full compliance with internal AI use policies.

2. Is customer data used to train RevSure’s or any third-party AI models?

Absolutely not. RevSure:

Does not train or fine-tune any GenAI models (e.g., Google Gemini) using customer data.
Uses customer metadata and behavioral context solely to generate insights and summaries, not for model training.

3. Does RevSure indemnify customers in the event of data misuse or breach?

Yes. RevSure is contractually bound to indemnification clauses and a Data Processing Agreement (DPA) which cover failures to comply with data usage terms or unauthorized data exposure.

4. Where and how is customer data processed by GenAI?

RevSure uses Google Gemini via Google Cloud, which provides the following protections:

a. Prompt and Response Guardrails

Prompts and GenAI responses are not used for training any models.
Enterprise customer data is ringfenced and compartmentalized.

b. Encryption Standards

Data is encrypted in transit and at rest using enterprise-grade protocols.

c. Identity & Access Management

Fine-grained access controls and authentication safeguards are in place to enforce least-privilege access.

d. Regulatory Compliance

Google Gemini complies with: GDPR, CCPA, ISO/IEC 27001‍
Practices include sensitive data masking, auditable controls, and privacy-first governance models.

5. Can RevSure isolate our data within our own environment?

Yes. All customer data stays within your RevSure instance, and access to GenAI can be governed by PII redaction settings, ensuring no sensitive data leaves your control boundary.