ClaimMaster and Data Policies for LLM Services

ClaimMaster's LLM tools enable end-users to interact with both local and cloud-hosted LLM services to generate text and images.  ClaimMaster Software itself does not utilize any proprietary LLMs - instead, ClaimMaster can connect end-users to base (immutable) LLMs via enterprise-level API, as shown in the system diagram below.  Locally-running LLMs (e.g., deployed via Ollama) are inherently private by design and do not transmit any information off the machine where they are installed.  Moreover, the specific cloud-hosted LLM platforms that are accessible within ClaimMaster (i.e., OpenAI, AzureOpenAI, Anthropic) are industry leaders and have been designed with a heavy emphasis on data confidentiality. They employ advanced encryption, secure data storage, and strictly controlled access protocols.  While these measures are in place to protect your information at every step of our interaction with theses LLM models, you should still determine whether OpenAI API policies , Azure OpenAI API policies,  or  Anthropic API policies suit your needs and satisfy your organization's security requirements. 


Your Data Is Never Automatically Transmitted to LLMs 


ClaimMaster does not automatically send data to the configured LLM service without your explicit permission.  Every LLM-enabled feature in ClaimMaster will communicate with the configured LLM service only after your explicit command (i.e., pressing a specific button in Word interface). You control exactly what data/prompt is being sent to the configured LLM service.  


Your Data Will Not Traverse Intermediate Servers


When communicating with either local or cloud-based LLM services, ClaimMaster Word add-in will send and receive data only to/from the configured LLM service using API directly from the machine where ClaimMaster is installed, so that your data will not traverse any other intermediate servers (either controlled by ClaimMaster or 3rd parties).  All end-to-end communications between the local ClaimMaster add-in and the configured LLM service will be encrypted and will use HTTPS.  ClaimMaster will not interact with or expose your information to public-facing models or external third parties outside of the configured LLM service, ensuring that your data remains fully protected in transit at all times.


Your Data is Not Used for LLM Training,  Not Retained, or Monitored by 3rd Parties


1.        No Model Training


As explained above, ClaimMaster Software LLC itself does not have access to your confidential data when the ClaimMaster Word add-in is executing locally in your environment and we do not train any LLMs using your data.  Moreover, ClaimMaster only integrates with base LLMs for interference (i.e., generating text/images based on the provided prompts), which are immutable during inference by design. In other words, LLMs are made in such a way that they do not change or learn new things while they are answering questions or performing tasks.  Data provided to LLMs model does not change the state or knowledge of the LLM while it is running, which is why LLMs have a knowledge cut-off date.  The data provided to the configured LLMs via API is processed and returned as a response and is not retained.  


The specific cloud-based LLM services that can be accessed by ClaimMater (i.e., OpenAI, Azure OpenAI, Anthropic) have provided strict and repeated assurances that API data sent through to their platform is NEVER used to train future models.  These are strict policies enforced by both contractual measures and technical safeguards. Specifically, according to OpenAI API policies , Azure OpenAI API policies,  and Anthropic API policies, the use of API ensures that your prompts (inputs), completions (outputs), and any other transmitted data will not be available to other customers and will not be used to improve the models. Moreover, to further enhance data privacy, you can also configure ClaimMaster with your own API key (OpenAI, Anthropic) and endpoint (Azure) to connect to private models set up in OpenAI, Azure OpenAI, or Anthropic services. 

2.        No Data Retention


Text data provided to the configured LLMs via API is processed and returned as a response and is not retained.  To the extent you upload any PDF/image files to the cloud-based LLM service file storage (i.e., OpenAI, Azure OpenAI, Anthropic) during a particular LLM chat session, they will be immediately deleted from the LLM service provider's file storage at the end of the chat session. In addition, all uploaded files can be explicitly deleted from the ClaimMaster's UI during the chat session. The deletion process from LLM file storage is governed by stringent controls allowing for the complete and irreversible removal of the uploaded files from the configured LLM service storage.

3.        No 3rd Party Data Monitoring


Given the internal, non-public nature of the cloud-based LLM services accessible from ClaimMaster, there will be no access or active monitoring of your data by any organization besides the configured LLM service provider (i.e., OpenAI, Azure OpenAI, Anthropic).


Specific Data Policies of Cloud-hosted LLM Platforms 


Below are the specific excerpts to the relevant sections of cloud-based LLM providers' policies, which provide strict and repeated assurances that API data sent through to their platform is NEVER used to train future models:

I. Open AI Data Policy


ClaimMaster has configured a stateless (immutable), private OpenAI GPT models (e.g., GPT-5) to use for its customers.  In addition, you can specify your own API key to access your own private models from OpenAI. 


The OpenAI API data usage policies currently state the following:

      • OpenAI will not use data submitted by customers via API to train or improve their models, unless you explicitly decide to share your data with OpenAI for this purpose (emphasis added). You can opt-in to share data.
        • Note: ClaimMaster has not opted-in to share data and will never do so in the future. 
      • Any data sent through the API will be retained for abuse and misuse monitoring purposes for a maximum of 30 days, after which it will be deleted (unless otherwise required by law).
      • A limited number of authorized OpenAI employees, as well as specialized third-party contractors that are subject to confidentiality and security obligations, can access this data solely to investigate and verify suspected abuse.
      • OpenAI website's states that its servers are currently located in the US.


Please contact OpenAI for any further information/questions about OpenAI GPT or their data usage policies.  A list of all OpenAI policies is available here.


II. Azure OpenAI Data Policy


ClaimMaster has configured a stateless (immutable), private OpenAI GPT model to use for its customers on Microsoft Azure.  In addition, you can specify your own custom end-point to use with ClaimMaster if you have a separate agreement with Microsoft Azure in place. 


The Azure OpenAI's data usage policies currently state the following:


Your prompts (inputs) and completions (outputs), your embeddings, and your training data:

      • are NOT available to other customers.
      • are NOT available to OpenAI.
      • are NOT used to improve OpenAI models.
      • are NOT used to improve any Microsoft or 3rd party products or services.
      • are NOT used for automatically improving Azure OpenAI models for your use in your resource (The models are stateless, unless you explicitly fine-tune models with your training data). 
        • Note: ClaimMaster is not fine-tuning the data, so the models are stateless and are not trained based on the prompts/data of other users. 
      • Your fine-tuned Azure OpenAI models are available exclusively for your use.
      • The Azure OpenAI Service is fully controlled by Microsoft; Microsoft hosts the OpenAI models in Microsoft’s Azure environment and the Service does NOT interact with any services operated by OpenAI (e.g. ChatGPT, or the OpenAI API).


Please contact Microsoft Azure for any further information/questions about Azure OpenAI GPT or their data usage policies.  A list of all Azure policies is available here.


III. Anthropic Data Policy


ClaimMaster has configured a stateless (immutable), private Anthropic Claude models to use for its customers.  In addition, you can specify your own API key to access your own private models from Anthropic. 


Anthropic's Commercial Terms, which govern API access to Anthropic LLMs, currently state in section B. Custom Content :


    • As between the parties and to the extent permitted by applicable law, Anthropic agrees that Customer (a) retains all rights to its Inputs, and (b) owns its Outputs. Anthropic disclaims any rights it receives to the Customer Content under these Terms. Subject to Customer’s compliance with these Terms, Anthropic hereby assigns to Customer its right, title and interest (if any) in and to Outputs. Anthropic may not train models on Customer Content from Services. “Inputs” means submissions to the Services by Customer or its Users and “Outputs” means responses generated by the Services to Inputs (Inputs and Outputs together are “Customer Content”).


Please contact Anthropic for any further information/questions their data usage policies.