ALLi - Privacy & Data Security FAQS
ALLi Privacy & Data Security FAQs
ALLi is built to operate within a secure, controlled environment designed to protect customer data and support responsible use of artificial intelligence inside FRONTSTEPS.
This article answers common questions about how ALLi handles data, where it runs, how access is controlled, and how privacy and security are maintained.
Quick Takeaway: ALLi runs inside FRONTSTEPS’ controlled Azure environment, keeps customer data isolated, uses encryption in transit and at rest, and does not use customer data to train AI models.
Overview
What is ALLi?
ALLi is FRONTSTEPS’ artificial intelligence system designed to support business operations and customer interactions within a secure, controlled environment.
Why does ALLi need to process data?
ALLi processes data only to provide functionality, improve response accuracy, support troubleshooting, and maintain service reliability. Data use is limited to legitimate business purposes.
Data Isolation and Architecture
Is my company’s data isolated from other customers?
Yes. Customer data is isolated using a single-tenant database for Caliber accounting data, and secure partitioned environments for Suite Manager and ALLi conversations. This prevents any cross-customer access.
Where is ALLi hosted?
ALLi runs within FRONTSTEPS’ own Microsoft Azure tenant using enterprise-only Azure OpenAI Service instances. All processing stays inside this controlled environment.
Does ALLi use shared or public AI infrastructure?
No. ALLi uses enterprise-only Azure OpenAI instances configured and maintained exclusively within FRONTSTEPS’ Azure environment.
What this means: Customer data stays separated and processed within a controlled FRONTSTEPS environment rather than a shared public AI system.
Encryption and Secure Transmission
How is data protected while stored?
Data at rest is encrypted using AES-256, an industry-standard encryption method. This applies to databases, backups, and archived records.
How is data protected while moving between systems?
Data in transit is encrypted using TLS 1.2 or higher, ensuring secure communication between users, applications, and services.
Access Controls and Monitoring
Who can access ALLi data at FRONTSTEPS?
Only authorized FRONTSTEPS personnel with a verified business need, such as support, engineering diagnostics, or security review.
How is access controlled?
Access is managed through Role-Based Access Control (RBAC). Users receive only the minimum permissions required to do their job, following the principle of least privilege.
Are access permissions reviewed?
Yes. Privileges are reviewed quarterly by the Information Security Team to ensure access remains appropriate.
Is access logged and audited?
Yes. Administrative and user access events are logged, monitored, and periodically audited to detect unusual activity and maintain accountability.
Security principle: Access is limited to approved personnel and reviewed regularly to help protect customer information.
Conversation Logs and Retention
Does ALLi store conversation data?
Yes. ALLi creates logs of user conversations to support performance, troubleshooting, and service quality. Logs include inputs, outputs, timestamps, and the minimal context needed for support.
How long are conversation logs retained?
Logs are retained for up to 90 days, then permanently deleted through an automated verified deletion process.
Are conversation logs segregated by customer?
Yes. Conversation logs are stored in partitioned repositories segmented by management company ID, ensuring customer separation.
Model Training and Data Use
Is my data used to train AI models?
No. Data processed by ALLi is not used to train AI models and is not shared outside FRONTSTEPS’ enterprise Azure environment.
Will OpenAI or Microsoft access or reuse my data?
No. Enterprise agreements with Microsoft Azure and OpenAI ensure data stays in FRONTSTEPS’ tenant and is not used for training or external purposes.
Important: Customer data processed by ALLi is not used to train external AI models.
Compliance and Regulatory Alignment
What security and privacy standards does ALLi follow?
ALLi aligns with major frameworks and privacy principles including:
- SOC 2 Type II for security, confidentiality, and privacy
- NIST SP 800-53 security controls
- GDPR and CCPA privacy principles
Is ALLi compliant with GDPR and CCPA?
Yes. Data handling follows GDPR and CCPA principles, including purpose limitation, minimal data collection, and honoring applicable access and deletion rights.
Client Rights and Requests
Can I request a copy or confirmation of what ALLi has processed?
Yes. Clients may request confirmation of data processing activity. Requests are reviewed and handled by Information Security and Legal teams.
Can I request early deletion of conversation logs?
Yes, where technically feasible. Requests go through identity verification and feasibility checks before permanent deletion is completed.
What if my deletion request cannot be completed?
If deletion is not possible due to technical, legal, or contractual reasons, FRONTSTEPS will explain why and outline any available alternatives.
Legal Requests and Third-Party Sharing
Does FRONTSTEPS share ALLi data with third parties?
No. FRONTSTEPS does not voluntarily share or disclose customer data to third parties.
What happens if FRONTSTEPS receives a subpoena or legal order?
Any subpoena or legal request is validated by Legal and Information Security. Only the minimum required data is provided, and customers are notified where permitted by law.
Note: If disclosure is legally required, FRONTSTEPS limits the response to the minimum necessary information and follows applicable legal requirements.
Security Governance
Who is responsible for ALLi security and privacy?
FRONTSTEPS’ Information Security Team owns, maintains, monitors, and enforces the ALLi Data Security & Privacy Policy.
What happens if policy standards are not followed internally?
Non-compliance is investigated and may result in disciplinary action, up to termination or legal escalation in severe cases.