AI Disclosure

1. How FlowForma uses AI

FlowForma Products use AI to support business processes, procurement and contract management, AI agent governance and vendor risk assessment. AI analyzes the information you provide and may generate recommendations, findings, summaries, rationale and supporting citations.

AI-generated output is decision support. It is designed to help people make decisions, not to replace their judgment.

2. How each product uses AI

What AI does differs by Product.

FlowForma Process Automation

AI may be used to

• Generate forms and workflows from a description of a process
• Power AI agents that carry out or assist with process steps, such as reading documents, extracting data, and drafting content
• Summarize and classify information submitted through forms
• Suggest improvements to processes and form designs

Typical outputs

• Generated forms and workflows
• AI agent actions and decisions within a process
• Extracted data, summaries, and classifications
• Drafted documents and messages

FlowForma Contract

AI may be used to

• Summarize contracts, tender submissions, and supplier documents
• Extract key terms, dates, obligations, and renewal information
• Draft contract clauses, requests, and correspondence
• Compare documents against templates, playbooks, or evaluation criteria
• Suggest risk flags, scores, and next steps

Typical outputs

• Contract and tender summaries
• Extracted terms, obligations, and key dates
• Clause comparisons and suggested risk flags
• Drafted clauses and correspondence

FlowForma Agent Trust

AI may be used to

• Summarize and classify the activity and outputs of AI agents
• Detect agents that may be making errors, using real corrections from people
• Generate risk scores, alerts, and suggested controls
• Route agent work to people for review

Typical outputs

• Agent activity summaries
• Risk scores, alerts, and classifications
• Suggested reviews, controls, or pauses
• Reports on agent performance

FlowForma Assure

AI may be used to

• Summarize vendor-provided documentation (e.g. security policies, questionnaires, certifications)
• Analyze and structure risk-related information
• Generate risk insights, classifications, and scoring suggestions
• Assist users in identifying potential compliance, security, operational, and financial risks

Typical outputs

• Risk summaries and classifications
• Suggested risk ratings or severity levels
• Extracted key points from vendor documentation
• Automated responses to questionnaires or assessment frameworks

3. AI provider and models

FlowForma Products use Microsoft Azure OpenAI Service. FlowForma may change or update the model, version, deployment or configuration as technology develops, provided this does not materially reduce the overall functionality or security of the Product.

Process Automation only You can connect your own AI provider instead. Where you do, that provider's terms, data location and training policies apply to the data you send to it.

4. Your data and model training

FlowForma does not use customer data to train a general-purpose AI model. Microsoft states that Azure OpenAI customer prompts and outputs are not used to train Microsoft or third-party foundation models.

FlowForma does not sell customer data or share it with unauthorized third parties. FlowForma may use anonymized or aggregated information to keep the Products performing reliably. All processing is subject to applicable data protection law, including the GDPR, and to our Data Processing Agreement.

5. Where AI processing happens

For FlowForma Contract, FlowForma Agent Trust and FlowForma Assure, stored data is held in the European Economic Area: Ireland (primary), the Netherlands (backups and replicas) and Sweden (AI service data). The Azure OpenAI resource is in Microsoft Azure Sweden Central and uses Microsoft's Global deployment type, so individual AI requests may be processed in any Azure region where the model is available. AI processing is therefore not limited to the European Economic Area.

Process Automation only Process and form data stays in your own Microsoft 365 tenant. Built-in AI features use Microsoft Azure OpenAI Service. If you connect your own AI provider, that provider's data location applies.

Where each Product stores data is also set out on our Security page.

6. How long AI data is kept

Microsoft's standard Azure OpenAI abuse-monitoring arrangements apply. Microsoft may keep prompts and outputs for up to 30 days for abuse monitoring.

Process Automation only Files uploaded to FlowForma Copilot are not stored beyond your session.

7. Human oversight

FlowForma Products are designed so that people stay in control. You are responsible for:

• reviewing AI-generated outputs before you use them;
• testing workflows, forms and AI agents before using them in live processes;
• making final decisions, including vendor, supplier, contract and AI agent decisions; and
• meeting applicable legal, regulatory and internal governance requirements.

In FlowForma Assure, the AI does not approve or reject a vendor, project or other third party on its own. A human assessor is responsible for completing each assessment and can review and override AI recommendations. If an assessment is completed while findings are still unreviewed, the assessor must give a written reason, which the platform records.

8. Safeguards

FlowForma applies technical and organizational measures designed to protect your data, including:

• encryption in transit and at rest;
• role-based access controls and secure sign-in;
• isolating AI requests to your workspace;
• treating uploaded documents as untrusted input, kept separate from system instructions to reduce prompt-injection risk;
• requiring AI findings to cite supporting evidence, and checking quoted evidence against the source; and
• a human review and override process.

More detail is on our Security page.

9. Limitations of AI outputs

AI outputs may be incomplete, inaccurate, out of date or wrong in context. AI may misread documents, instructions or activity, or draw incorrect conclusions. Outputs are probabilistic, not guaranteed, and AI does not understand risk, contracts or your obligations in a human or regulatory sense.

FlowForma does not warrant that AI outputs will be accurate, complete or fit for purpose; that they will identify every risk or issue; that a vendor, agent or organization is secure; or that outputs meet the regulatory requirements of any jurisdiction. AI outputs do not replace professional legal, regulatory, security or risk judgment, and should not be treated as authoritative or final.

10. Prohibited uses

AI outputs from FlowForma Products must not be used for:

• fully automated decisions with legal or similarly significant effects without human review;
• legal or regulatory compliance certification;
• security guarantees or assurances about vendors or AI agents; or
• replacing formal due diligence, legal review or audit processes.

11. Your responsibilities

You are responsible for making sure that:

• you have lawful grounds to submit data into the Products;
• any personal data you share is limited, relevant and lawful to share;
• confidential or sensitive data is handled in line with your internal policies and applicable law; and
• AI outputs are reviewed before they are used in any decision.

You remain responsible for your own procurement, risk, security, compliance, remediation and risk-acceptance decisions.

12. Changes to this statement

FlowForma may update this AI Disclosure to reflect changes in technology, law or product features. The current version and its last-updated date are always published on this page.

13. Contact

For questions about this AI Disclosure, email info@flowforma.com or call +1 (617) 398 4990, +44 (0) 20 3481 1319 or +353 (0)1 5369 650.