AI and product terms

1. AI drafting

How answers are produced

• Retrieval-Grounded Drafting. For each questionnaire item, the Service searches your organization’s answer library and knowledge base and instructs the underlying AI models to draft a response grounded strictly in the retrieved passages rather than general external knowledge.
• Citations and Confidence Indicators. Drafts display the source passages retrieved, along with an estimated confidence level and trust score. The Service applies automated verification checks designed to strip citations that do not correspond to retrieved source passages. Confidence and trust scores are heuristic estimates only and do not guarantee factual accuracy.
• Insufficient Sources and Expired Documents. When retrieved sources do not contain sufficient information to answer a question, the Service is designed to mark the question as requiring human input rather than fabricating an answer. Documents marked with a past expiry date in your knowledge base are excluded from retrieval for new AI drafts.
• Prompt Injection Defenses. The Service applies technical boundaries designed to treat text inside your documents and imported web pages as passive reference data rather than executable instructions to the AI. However, because large language models are probabilistic systems, no prompt-injection filter or grounding control is infallible.
• Your Own Input. Text a User types when regenerating or re-drafting answers is used both as a source, cited as Bid team input, and as an instruction. If it contradicts your documents, the answer is designed to be flagged as a conflict at low confidence. You are responsible for the accuracy of what you type.
• Answer Rules and Scope. Owners and admins may set answer rules that restrict or phrase answers; rules are never a source of facts. A questionnaire can be limited to tagged documents, and a document can be kept out of drafting.
• Automated Checks. The Service applies checks designed to take out details no retrieved source contains, to keep a past customer’s name and prices out of answers drafted for someone else, and to flag sources that state a fact differently. These checks can miss errors and do not replace your review.

Your responsibilities

• Verification Before Use. AI-generated Output can be incomplete, miscontextualized, or inaccurate even when accompanied by citations and a high confidence or trust score. Every answer requires explicit approval by a User before it can be included in a customer-facing export. You are solely responsible for verifying the accuracy of every answer you approve, export, or submit to a third party.
• Knowledge Base Hygiene. Draft quality depends directly on the accuracy and currency of your knowledge base. You are responsible for maintaining accurate documents, setting appropriate review and expiry dates, and removing obsolete materials.
• High-Risk Prohibitions. You must not rely on Output as legal, regulatory, compliance, or audit advice, and you must never approve or submit Output that claims security controls, legal commitments, or third-party certifications (such as SOC 2, ISO 27001, HIPAA, or FedRAMP) that your organization does not actually hold.

Your data and AI training

• Scoped Context. Each drafting request sends to the AI model only the specific questions and the relevant retrieved passages from your knowledge base needed to process that request.
• Zero Model Training. Customer Content and Output are never used to train, fine-tune, or improve any AI models, whether operated by us or by our third-party AI Subprocessors. All AI Subprocessors are bound by contractual terms and API configurations that prohibit training on Customer data.
• Model Evolution. We may update, swap, or upgrade the underlying AI models and search algorithms powering the Service at any time to improve quality, speed, or security, provided our data protection and no-training commitments remain in full effect.

2. Languages and translation

Your organization configures a primary knowledge base language. When an imported questionnaire is written in another supported language, the Service translates its questions to search your knowledge base and generates draft answers in the questionnaire’s target language. When an approved library answer from one language is reused in another language, it is machine-translated and flagged for human review. Machine translation can subtly alter legal, technical, or contractual meaning; you are responsible for having qualified personnel review all translated answers before approval and export.

3. Answer library

Approved answers may be saved to your organization’s answer library for reuse in future questionnaires, via the Slack and Microsoft Teams bots, and through the browser extension. Only approved answers enter the library. Library entries approved more than 12 months ago are automatically flagged as stale for your review. You may also bulk-import historical Q&A pairs via Excel or CSV; because imported entries are treated as approved library records upon import, you are responsible for reviewing their accuracy prior to import.

4. Collaboration and notifications

Question assignments, internal comments, @mentions, and due dates are visible to authorized Users within your organization. The Service sends related notifications in-app and via email. Individual Users may disable routine notification emails in their account settings, except for mandatory administrative, security, or organization-deletion notices.

5. Integrations

• Connection and Revocation. Organization owners and admins may connect third-party integrations on behalf of the organization. Disconnecting an integration immediately halts further synchronization and permanently deletes the stored OAuth/API tokens from our systems; documents previously imported into your knowledge base remain until you delete them.
• Slack and Microsoft Teams Bots. Users who are members of your organization may query the bot. The bot is configured to answer strictly from approved answer library entries and non-expired knowledge base documents, with source citations, and to decline to answer when retrieval confidence falls below threshold. In Slack, bot responses are delivered as ephemeral messages visible only to the requesting User.
• Google Drive, Microsoft SharePoint, and OneDrive. The Service accesses only the specific files explicitly selected by an authorized User. Selected files are re-synchronized periodically and on manual request, and are automatically removed from your knowledge base if deleted or unshared at the source.
• Token Security. Integration access tokens are encrypted at rest (AES-256-GCM) with a key held outside the database and are accessible solely to backend worker processes—never exposed to client browsers.

6. Website import

You may import public web pages (and direct links to public documents) into your knowledge base. Our crawler fetches each specified URL upon import (and weekly thereafter, if scheduled by you), identifies itself via the User-Agent string AcuityRFP-Importer, and respects robots.txt directives. The importer connects only to public IPv4/IPv6 addresses and never transmits authentication cookies or credentials.

Customer Warranty for Imported URLs: When you submit a URL to the Website Import tool, the Service fetches that URL strictly at your initiation and direction. You represent and warrant that you own the target website or have all necessary legal rights and permissions under applicable law and the target website’s terms of use to copy and ingest its content into your knowledge base. You must not use the Website Import tool to ingest third-party proprietary content without permission or to probe third-party networks. Third-party web content may change or become unavailable at any time without notice.

7. Exports and share links

• Document Exports. Approved questionnaires can be written back into the original uploaded file format (questionnaires uploaded as PDF are returned as a Word document that mirrors the PDF) or exported as a new document (Word, Excel, or HTML), optionally styled with a custom Word template/theme uploaded by your organization. Uploaded Word themes undergo automated security validation, and files containing macros (VBA), ActiveX controls, or embedded OLE objects are rejected. You are responsible for verifying the formatting and completeness of exported files before sending them to recipients.
• Review Draft. The internal review draft is a Word file that can be exported before anything is approved. It shows unapproved drafts, drafting notes, sources, owners, and points to settle, and states that it is internal. You are responsible for not sending it to third parties. It cannot be shared as a link.
• Share Links. You may generate a read-only share link to a static HTML snapshot of an export with an expiration window of 7, 30, or 90 days (unless revoked earlier by an editor, admin, or owner). Anyone in possession of an active share link URL can view and copy the contents of that export without logging in. You are solely responsible for controlling how share links are distributed and for revoking links if shared inadvertently.

8. Trust center

• Publishing Controls. Owners and admins choose which knowledge base documents to make available on your organization’s public Trust Center page and configure the access tier for each document (e.g., email verification, clickwrap acceptance of your NDA, or manual admin approval). Documents whose expiry date has passed are automatically hidden from public view on the Trust Center.
• NDA Gate and Legal Disclaimers. If you require Trust Center visitors to accept a Non-Disclosure Agreement (NDA), you are solely responsible for supplying the NDA text and ensuring its legal validity. AcuityRFP is not a party to any NDA between you and a Trust Center visitor, provides no legal advice regarding your NDA, and makes no representation or warranty that the Trust Center clickwrap workflow satisfies the legal requirements for an enforceable electronic signature or binding contract in any particular jurisdiction. We log the visitor’s submitted name, email address, company name, timestamp, and NDA version on your behalf, and you assume all risk regarding any unauthorized disclosure or misuse of documents downloaded by Trust Center visitors.
• Visitor Data Roles. With respect to personal data submitted by visitors to your Trust Center, your organization is the data controller and AcuityRFP acts as your data processor under the DPA.

9. Browser extension

The AcuityRFP browser extension (for Google Chrome and Microsoft Edge) authenticates using your individual User session and role permissions, searches only your organization’s approved answer library, and inserts an answer into a web page solely when you explicitly click to insert or copy it. The extension does not perform background scraping of web pages you visit and never reads keystrokes or password fields. For each answer inserted or copied, it records in your organization’s activity log only the library entry, whether it was inserted or copied, the User, the timestamp, and the hostname (domain) of the portal, never the full page address. Accounts with two-factor sign-in cannot currently sign in to the extension.

10. Single sign-on (SSO) and two-factor sign-in

Organizations on any Plan may configure SAML 2.0 Single Sign-On and enforce it for all members. Organization owners retain password-based authentication as an emergency “break-glass” recovery mechanism in the event your identity provider experiences an outage or misconfiguration. You are solely responsible for properly configuring your SAML identity provider, managing user provisioning/deprovisioning, and securing owner break-glass credentials.

Users may protect their accounts with two-factor sign-in, using an authenticator app and single-use recovery codes. Owners may require it for admins or for all members. SSO sign-ins meet that requirement, because your identity provider handles the second factor. You are responsible for keeping recovery codes safe.