At USJP Business Advisors LLC("USJP"), safe guarding client confidentiality and personal data is paramount. This policy sets mandatory standards for all personnel on data protection and the use of artificial intelligence ("AI") — generative AI and large language models, machine learning, predictive analytics, agentic tools, and automated decision systems — whether standalone or embedded in software we license.
- Approved Tools Only: AI is used solely on approved enterprise-tier platforms governed by written zero-data-retention and no-training-on-customer-data terms, with encryption in transit and at rest, role-based access controls, and audit logging. Consumer accounts, browser plug-ins, and unapproved "shadow AI" are prohibited.
- Data Minimization: Client-confidential and personal data may be processed only on approved enterprise platforms where USJP is the data controller and the vendor is contractually bound as a processor that does not train on our data. Personnel share only the minimum necessary on a need-to-know basis. Where the client agreement or NDA restricts third-party processing, or where data is highly sensitive (personal identifiers, financial account data, M&A-sensitive material), inputs are de-identified or client consent is obtained first.
- Human-in-the-Loop: Unreviewed AI output is never delivered to a client. A consultant verifies facts, sources, and calculations, and screens for bias, edits the work into USJP's own analysis, and retains full professional responsibility for it. Once reviewed and adopted, the document is USJP work product, not "AI output."
- Compliance and Governance: We comply with U.S. and California privacy law, including CCPA/CPRA, align with the NIST AI Risk Management Framework, conduct vendor due diligence, and maintain records-retention, secure-disposal, and incident-response procedures.
- Continuous Improvement: Controls, tool approvals, and annual personnel training are reviewed as AIcapabilities and threats evolve.
