Privacy & safeguards FAQ

A client-controlled behavioral concern intake and triage workspace. It is separate from CAL TTX and is not an automated threat assessment, emergency reporting service, clinical tool, forensic evidence system, or replacement for your case-management process.

The client organization directs case access, sharing, and retention. CPPS operates the application but does not receive routine case access. Expert review requires the client to intentionally share a defined package.

No. CAL Threat does not score or rank cases, diagnose people, determine credibility, or choose a risk level. An authorized human may document the organization’s own structured professional judgment and supporting narrative.

Never upload CSAM, clinical or medical records, sexual or intimate imagery, graphic harmful media, credentials, malware, or raw forensic collections. Use a brief, non-graphic, source-attributed description or a non-clickable reference to an authorized internal record where appropriate.

No. AI starts off and requires a separate authorized action. Guided intake, manual entry, forms, and reporting must remain usable without AI.

No. Client case data, uploads, prompts, outputs, edits, and feedback are not authorized for model training or fine-tuning. When optional AI preparation is enabled, requests go directly to the CAL OpenAI account with response storage disabled. Model-improvement data sharing is disabled on the CAL OpenAI account.

Under standard OpenAI API terms, inputs and outputs may be retained for up to 30 days for abuse and safety monitoring, with exceptions where longer retention is required by law or necessary to protect against harm. This is separate from model training and from records saved in CAL Threat. Response storage is disabled, but this does not provide Zero Data Retention. Organizations requiring ZDR should contact us about a separately approved arrangement.

AI can make mistakes or omit important context. Verify source citations and every suggestion before use. AI supports authorized human review; it does not replace professional judgment, provide legal or clinical advice, or make decisions about a person.

Only the category and message you enter, your signed-in email, a generalized page label with record identifiers removed, and the application version. It does not copy page content, case answers, Case Tray entries, files, query parameters, or browser storage. Do not put sensitive case information in feedback.

Every document upload shows the retention choice. When optional document review is available, you can keep a client-controlled case attachment or choose a temporary AI-review copy. Uploading alone does not authorize AI processing: you must separately request each review. The request includes the selected document, the intake question catalog, and existing Case Tray labels and names to help identify possible matches. You approve, edit, or decline each suggestion, then complete the temporary-file deletion step. Review decisions and content you approved or edited and saved remain in the intake.

No. The initial live pilot is text-first. Keep source files in your organization’s authorized case-management or records system and enter only a non-sensitive reference or minimum-necessary summary in CAL Threat. Client logos are optional, non-authoritative presentation assets that can be re-uploaded if necessary.

No. Delivery requests consideration only. It does not establish monitoring, review, response, or another professional service unless separately accepted.