Last updated: September 21, 2026 · Version 1.0
In short: assessments are made by a deterministic algorithm, not by artificial intelligence. The artificial intelligence cannot know who you are: the data that identify you are confined by architectural measures it cannot get past.
1. The principle: the artificial intelligence cannot know who you are
The data that identify Tal4Biz users are held within an architectural confinement that the artificial intelligence cannot get past. This is not a rule of behaviour entrusted to the artificial intelligence, which could be circumvented or ignored: it is how the infrastructure is built. The artificial intelligence has neither the access nor the keys to reach those data.
By "identifying data" we mean first name, last name, email, personal and profile details, the company a person belongs to and any other element that makes it possible to trace a person. None of these data is read, received or processed by an artificial intelligence system.
The artificial intelligence may read questionnaire answers and the algorithm's results, but separated from the identity of the respondent: it has no way of linking them to a person.
2. Who assesses: the algorithm, not the artificial intelligence
Every assessment produced by Tal4Biz is calculated by a proprietary deterministic algorithm: the same answers always give the same result. The artificial intelligence does not calculate scores, does not assign positions and does not change the results.
When it is used, the artificial intelligence receives results that have already been calculated, separated from people's identities, and explains them. The assessment remains the algorithm's.
3. What we use artificial intelligence for
- Cybersecurity — monitoring the infrastructure, detecting anomalies and risky configurations.
- Maintenance — technical maintenance of the platform and preparation of questionnaires and report templates, based on texts written by Tal4Biz and its consultants.
- Explaining results — explaining the algorithm's results in plain language, only for complex reports such as team reports.
4. What the artificial intelligence never does
- It does not read data that identify a person.
- It cannot link answers or results to the person who produced them.
- It does not assess people, teams or companies and does not express judgements: it explains what the algorithm has calculated, without adding assessments of its own.
- It does not change the algorithm's scores, positions or results.
- It does not take decisions that produce legal effects or similarly significantly affect people.
- It is not trained on the data of Tal4Biz customers.
5. How this is guaranteed
The confinement is architectural: it rests on technical measures the artificial intelligence cannot get past, not on organisational rules or instructions given to the artificial intelligence.
- Encryption of identifying data. Identifying data are encrypted in the database with keys kept in a protected vault. The key used by the artificial intelligence systems cannot decrypt them.
- Access denied by the database. The database denies the artificial intelligence systems read access to the tables containing personal and company data.
- Identity removed before the artificial intelligence. Answers and results are separated from the identity of the respondent before being passed to the artificial intelligence. The link between answers and person stays in the encrypted database, out of its reach.
- Dedicated machine. The artificial intelligence systems run on a dedicated machine, with no public address and separate from the systems that monitor them.
- Tamper-proof log. Every action of the artificial intelligence systems is recorded in an archive that the systems themselves cannot modify or delete.
- Infrastructure in Italy. The platform and personal data reside on Microsoft Azure infrastructure in the Italy North region.
6. The model provider
The artificial intelligence models are provided by Anthropic Ireland, Limited (Claude models), with business access governed by the provider's commercial terms, and it is appointed as a data processor under Art. 28 GDPR.
- It receives only technical infrastructure data (configurations and logs, which may contain IP addresses), questionnaire texts, and answers and results with no identifying elements. It never receives personal details or answers linked to a person.
- Under the commercial terms, the data transmitted are not used to train the models.
- Processing may take place outside the European Economic Area, in particular in the United States, with the safeguards provided by the GDPR (European Commission standard contractual clauses).
7. Human oversight and transparency
- Labelling. In reports, explanations generated by artificial intelligence are marked as such and kept separate from the algorithm's assessment.
- Human approval. No content prepared by artificial intelligence is published on the platform without the approval of a person at Tal4Biz.
- Decisions stay with people. How results are used, for example within an organisation, is decided by people, not by artificial intelligence.
8. Legal framework
This policy applies Regulation (EU) 2016/679 (GDPR) and Regulation (EU) 2024/1689 on artificial intelligence (AI Act): data protection by design (Art. 25 GDPR), no automated decisions about people (Art. 22 GDPR), transparency about AI-generated content (Art. 50 AI Act) and training of staff who use artificial intelligence systems (Art. 4 AI Act). The processing of personal data is described in the Privacy Policy.
9. Contact
For questions about this policy or the use of artificial intelligence, write to privacy@tal4biz.com.
