Idira Responsible AI Policy
Scope and Purpose
This Idira Responsible AI Policy, including the Features FAQs, applies to use of those artificial intelligence services, features, and functionalities that we provide within Idira’s products and services (collectively, “AI Features”). This policy supplements Idira’s SaaS Terms of Service. Reference to “you” or “your” in this Policy means the “Customer”, as defined in Idira’s SaaS Terms of Service.
Responsible Design and Governance of AI Features
Idira is committed to developing safe, fair, and accurate AI Features and providing you with tools designed to enhance your security and user experience. An AI Impact Assessment is conducted for AI Features in accordance with standard market practice, designed to identify biases or unethical use of AI and to address transparency, fairness, accountability, and privacy and security by design. These principles are applied throughout the lifecycle of AI Features, from design and development through deployment, with the objective of supporting secure, reliable, and appropriate use in enterprise environments. Idira periodically reviews AI Features and related safeguards in light of evolving technologies, customer expectations, and applicable legal and regulatory requirements.
Idira assesses the accuracy of its AI Features, for example by using a validated reference (“golden”) dataset, running the model against it, and comparing the results to the labeled data. Idira may also perform manual validation on a representative portion of the results to provide additional assurance. In addition, Idira collects user feedback to help measure the accuracy and efficiency of AI outputs and continuously improve the AI Features.
Idira applies various layers of monitoring and alerting, to identify anomalies, data quality issues, or unintended model behavior, including potential data or model corruption, designed to support the reliability of AI Features.
Where applicable, Idira provides clear explanations within the user interface describing the reasons behind each recommendation. This includes transparent insight into the different factors and statistical categories that influence the recommendation. These explanations are continuously enhanced by incorporating additional data to further strengthen and improve the reasoning mechanisms.
Idira incorporates security-by-design principles, aligned with industry standards, into AI Features, including controls intended to reduce the risk of misuse, unintended behavior, or unauthorized access. These controls may include technical and organizational measures, as well as contractual safeguards, depending on the nature of the AI Feature and its intended use.
Use of Third-Party Generative AI Services
Certain AI Features use third-party generative AI services (currently through Azure OpenAI, AWS Bedrock and GCP Vertex AI), and some AI Features may be provided from a different region to the region where your SaaS Products are hosted. The third-party generative AI services that Idira uses do not use your customer data to train their models nor do they store your customer data. For limited purposes, such as abuse monitoring, as further described in the applicable third-party generative AI service provider policies, these third-parties may temporarily store data as required for those limited purposes. Idira or the third-party generative AI services may detect and mitigate instances of recurring content and/or behaviors that suggest use of the product in a manner that may violate this Policy or other applicable product terms, in accordance with industry standards.
Limitations and Human Oversight
AI Features utilize models to generate predictions or recommendations based on data patterns, producing probabilistic outputs. AI introduces the potential for inaccurate or inappropriate content. It is crucial to evaluate these outputs for accuracy and suitability in your specific use case. Both you and your end users are accountable for decisions, advice, actions, and failures to act resulting from the use of AI Features.
Please refer to the specific AI Feature page in Idira’s documentation for detailed information about each feature.
Acceptable Use of AI Features
You may not use, or facilitate or allow others to use, the AI Features:
- for any illegal or fraudulent activity;
- for intentional disinformation or deception;
- to violate the rights of others, including privacy rights, unlawful tracking, monitoring, and identification;
- to harass, harm, or encourage the harm of individuals or specific groups;
- to intentionally circumvent safety filters and functionality or prompt models to act in a manner that violates law, regulation or this Policy;
- to violate the security, integrity, or availability of any user, network, computer or communications system, software application, or network or computing device.
Opt-Out and Updates
If you do not wish to receive the AI Features, your authorized system admin may opt out of the AI Features on behalf of your organization as described in the AI Preference Center.
Idira may update this policy from time to time without prior notice.
Idira AI Features FAQs
Q: How does Idira ensure responsible use of AI and bias mitigation?
A: Idira conducts AI Impact Assessments for AI Features in accordance with standard market practice, designed to identify biases or unethical use of AI and to address transparency, fairness, accountability, and privacy and security by design.
Q: Can I opt-out of using AI Features?
A: Yes, if you do not wish to receive the AI Features, your authorized system admin may opt out on behalf of your organization as described in the AI Preference Center.
Certain detections within Privileged Threat Analytics (PTA) use proprietary machine learning-based algorithms that are configured at the product level. These detections may be individually enabled or disabled through the applicable product user interface. For more information, see the PTA Security Configuration documentation page.
Q: Where can I find detailed information about each AI Feature?
A: Please refer to the specific AI Feature page in Idira’s documentation for detailed information about each feature.
Q: Will I know when AI technology is used within the Idira product?
A: Idira will inform users when AI is used to produce results or recommendations, by indicating this in-product, as well as in the supporting documentation.
Q: Do the AI Features use any third-party generative AI services?
A: Yes, certain AI Features use third-party generative AI services (currently through Azure OpenAI, AWS Bedrock and GCP Vertex AI), as further detailed in each specific AI Feature documentation page. Idira’s use of these services within its products and services is subject to Idira’s contractual agreements with the respective vendors of these services.
Q: Does Idira or any third party monitor my use of the AI Feature?
A: Idira or the third-party generative AI services may detect and mitigate instances of recurring content and/or behaviors that suggest use of the product in a manner that may violate Idira’s responsible AI Policy or other applicable product terms.
Q: Will Idira process personal data for the purpose of providing AI Features?
A: Idira may process personal data for the purpose of providing AI Features to you in accordance with your Data Processing Agreement with Idira.
Q: Is human oversight required prior to applying the AI Feature’s recommendation?
A: Yes. AI Features utilize models to generate predictions or recommendations based on data patterns, producing probabilistic outputs. AI introduces the potential for inaccurate or inappropriate content. It is crucial to evaluate these outputs for accuracy and suitability in your specific use case. Both you and your end users are accountable for decisions, advice, actions, and failures to act resulting from the use of AI Features.
Q: What is the Machine Identity AI Assistant and how may it be used?
A: The Machine Identity AI Assistant is a chatbot available on Idira Machine Identity Security documentation pages (e.g., https://docs.cyberark.com/mis-saas/). It is trained on Machine Identity Security documentation to assist users in navigating and understanding product information. The AI Assistant processes user inputs through third-party providers, OpenAI and Chatbase (chatbase.co). Users are not required to log in to any Idira account to use the AI Assistant, and CyberArk does not cross-reference account data to AI Assistant interactions.
Use of the AI Assistant is subject to Idira’s Responsible AI Policy and the acceptable use restrictions as set forth above. Users may not submit personal, proprietary, or sensitive data to the AI Assistant. User inputs are processed anonymously when the AI Assistant is used in accordance with these restrictions.
Users assume the risk of any errors, omissions, or misinformation generated by the AI Assistant. Idira shall not be liable for AI Assistant outputs.