AI transparency

AI Use Disclosure

Version 1.0 · October 2026

1. 1. Scope of this disclosure. This AI Use Disclosure describes how Bridgham Cyber, LLC ("Bridgham", "we") uses artificial intelligence in the services it provides to its clients (each, a "Client") and on this website. It supplements, and does not replace, the Client's services agreement, the Privacy Policy, and the Terms of Use. Where this disclosure and a signed agreement differ, the signed agreement governs. Nothing on this page creates a client relationship or a warranty of any kind.

2. 2. Tasks in which AI is used. Bridgham uses AI systems as tools within work that its people direct and answer for. Those tasks are: drafting and summarizing findings, reports, and policy documents; sorting and ranking signals gathered from a Client's systems and from public sources; answering a Client's questions through the AI security advisor in the client portal, including by voice; checking written work against a stated brief before it is published; and drafting the fortnightly reading list described in section 11. AI is not used to make a final decision about a Client's security posture, to approve a deliverable, or to take an action on a Client's systems without a person's instruction.

3. 3. The model built for each Client. In an engagement, Bridgham trains a model on the Client's own systems so that it learns what is normal for that firm and can flag what is not. The model is built for the Client and is used during the engagement. The model itself, including its design and weights, remains Bridgham's property, and the Client's access to it ends when the engagement ends.

4. 4. Model providers. Bridgham's language features are currently powered by models from Anthropic, PBC, accessed through Anthropic's commercial service. The voice of the AI security advisor is currently provided by ElevenLabs. Bridgham may add or replace a provider; when it does, this page and the subprocessor list are updated before the new provider receives any Client data. Each provider is engaged under written terms that restrict its use of the data it processes to providing the service to Bridgham.

5. 5. What data is and is not sent to a provider. Only the context a task needs is sent to a provider, and Bridgham removes or replaces names, account identifiers, and credentials before sending where the task allows it. Bridgham does not send to any model provider: passwords, keys, or other authentication secrets; payment card data; protected health information except where a business associate agreement covers that provider and that use; or any record a Client has told Bridgham in writing to keep out of AI processing. A Client's data is never shown to another Client, by a model or otherwise.

6. 6. No training on Client data by providers. Bridgham does not permit any model provider to use Client data to train or improve that provider's models. Anthropic's commercial terms state that it does not train its models on content customers send through its commercial service; Bridgham relies on that commitment and on its agreements with each provider. Separately, Bridgham learns across the firms it protects so that a threat seen at one firm can be guarded against at the others. Only de-identified, pooled signals feed that shared layer, and those signals contain nothing that points back to any Client, firm, person, or dataset.

7. 7. Opting out of the shared layer. If a Client's own rules do not allow its data to contribute to the shared intelligence described in section 6, Bridgham turns that contribution off on request made within the first 30 days of the engagement. The full service continues. A later request is handled under the Client's services agreement.

8. 8. Human review and verification. No AI-generated finding, figure, or recommendation reaches a Client until a Bridgham person has reviewed it. Every figure Bridgham presents is backed by research and checked against data through the Bridgham Technology Institute before it is delivered, and every source is named. The person who signs a deliverable answers for all of it, including any part an AI system drafted.

9. 9. Known limitations. AI systems can state incorrect facts with confidence, misread context, omit relevant information, and give different answers to the same question. Their error rates vary by task and by input, and Bridgham does not publish a single error rate because no single figure would describe every task honestly. Answers from the AI security advisor in the client portal are given without a person's review in the moment, are for information only, and are not legal, regulatory, or insurance advice; a Client should confirm anything it intends to rely on with its Client Advisor.

10. 10. Asking what was AI-assisted. A Client may ask, for any deliverable, which parts were drafted or processed with AI assistance and which provider was used. Requests go to the Client Advisor or to support@bridghamcyber.com, and are answered in writing within five business days.

11. 11. The week in security and AI. The reading list published on the Insights page is drafted every two weeks by an AI system working under a written editorial brief. Every run is checked automatically against that brief before it publishes. No Client data is used in it.

12. 12. Retention, deletion, third-party terms, and changes. A Client may export its reports at any time during the engagement. When the engagement ends, access ends, and Bridgham deletes identifiable Client data on request, subject to the retention periods in the Privacy Policy and any legal hold. Data held by a model provider is subject to that provider's own retention terms, which Bridgham reviews before engaging it and which a Client may request. This page is versioned: the version and date appear below, a material change is noted to active Clients before it takes effect, and earlier versions are available on request.