Squadcast Guidelines for the Safe and Secure Use of Generative AI

I. Coding with AI Tools

The use of generative AI solutions as part of coding and development must align our with secure system development lifecycle discipline, including the following overall guidelines:

1. Design Principles: When designing new features, the functional specifications must be clear, accurate and comprehensive, regardless of whether an AI tool is used to help develop any code. Alignment with the functional specifications must be validated during the overall testing phase.
2. Development Principles: Using an AI tool to create code should not preempt any component of Secure System Development Lifecycle (S-SDLC) discipline for developing that code. Development timelines must continue to include time and effort to review any code created with AI assistance, including logic and function tests, as part of Squadcast’s standard S-SDLC.
3. Training Principles: Training of AI assisted functionality must be performed using artificial data sets. Artificial datasets may be generated from Squadcast’s own datasets resulting from Squadcast’s use of Squadcast’s products and services following Squadcast’s approved anonymization practices.
4. Testing Principles: Testing of new features, including AI-assisted code generation, must include explicit testing for logic and functional alignment with the functional specifications identified during the design phase.
5. Code Review: All code proposed by a third-party (generative AI or other) must be reviewed for correctness and completeness. Particular care must be taken with any external references or file inclusions proposed by a generative AI solution to ensure that there are no unintended consequences from linked code.
6. Promotion to Production: Using an AI tool to create code should not preempt any component of S-SDLC discipline for moving that code to production. Whether code is generated with the assistance of AI tools, reused from another internal project, or written by a Squadcast employee, it should not be promoted to production without the required code reviews and tests.

II. Use of Generative AI Capabilities in Squadcast Products and Services

We use the following principles when offering generative AI solutions within our products must align with our secure architecture and data protection requirements, including the following principles:

1. Customer Choice Over Whether to Use an Generative AI Feature (Opt-In and Opt-Out): Generative AI will not be used to provide the Squadcast service to a customer unless that customer opts-in to the use, such as through purchasing a stand-alone service or enabling an offered feature. Likewise, a customer may choose to stop using, or “opt-out” of, an AI feature at any time. If an AI feature is enabled for the customer as part of their existing plan, unless they use the feature, the AI feature will not access their data.
2. Clear Explanations of how we use Generative AI for Squadcast Features: We are committed to providing clear, easy-to-understand explanations of AI involvement and AI-assisted features and how these features may enrich the customer’s experience, allowing a customer to make an informed opt-in decision.
3. Training Generative AI Models: If a customer opts-in for a generative AI feature, we will use that customer’s data for their own functionality; as we as an industry learn the limits of generative AI and data protection, we will not use that customer’s data to train an AI model that may benefit other parties unless that customer gives explicit permission for that type of training.
4. Human in the Loop: Squadcast recognizes that with current generative AI technology, outputs may not contain all the pieces a human specialist would have included, and may not even be correct. We are committed to designing our AI offerings to allow for a “human in the loop” who is given the opportunity to review, modify, and decide whether and how to use AI proposed outputs, such as proposed incident response summaries.

As a reminder, adherence to these principles does not change our commitment to data protection as laid out in our Trust portal.