Compliance for AI that actually runs processes

Carol personalises on work context, not on the person. Specifically: the employee's role and team, the permissions granted to them, the systems they are authorised to access, the processes they are involved in, and their interaction history within Carol. Carol does not process performance evaluations, HR records, private communications, or behavioural indicators. It does not build a behavioural profile of the employee, and it does not infer traits, productivity or engagement. Personalisation is bounded by the same permission model that governs every other part of BRAIAN: Carol cannot surface information the employee is not authorised to see.

The personalised instance is deactivated when the employee's account is deactivated. Carol stops operating immediately. Personalisation data and conversation history are deleted within 30 days of deactivation. Audit records of business actions remain. If Carol was used to start a supplier onboarding or approve an expense, that action stays in the audit log under the organisation's business record retention policy — it is a record of a business decision, held on a separate legal basis from personalisation data. The two are deliberately separate: personal data is deleted, business records are preserved.

Voice input is transcribed to text in real time and the audio is discarded immediately after transcription. Audio recordings are not stored. Transcripts are retained for 30 days and are then deleted. Retention is configurable per deployment and can be set to zero. All processing — transcription and inference — takes place within Switzerland or the EU. Voice data is not transmitted outside the configured region and is not used to train any model, ours or a third party's.

No. Carol produces no metrics on individual employees: not usage frequency, not question volume, not response quality, not any derived indicator. Carol is not an evaluation system and is not designed to become one. No report, export or API exposes per-employee activity data. Process metrics in BRAIAN measure processes, not the people who run them.

No. Carol conversations are visible only to the employee who had them. Managers, administrators and ÆTERION personnel have no access to conversation content. What is recorded in the audit log is the action, not the conversation: if a conversation results in a business process being started, the audit log shows that the process was initiated, by whom and under which policy — not what was said. Access to conversation content is possible only through a documented exceptional-access procedure, which requires written authorisation from the organisation's data controller and is itself logged. This is a design constraint, not a configuration option. Swiss labour law prohibits systems designed to monitor employee behaviour, and Carol is built to that constraint.