Yes. Like most software companies, Steplab's staff use AI assistants for everyday work such as drafting replies, summarising documents and writing software. This article explains what that means for your data, so you can answer questions from your own data protection officer or trust.
Which AI tools does Steplab use?
We use three tools, all on business plans with a data processing agreement in place:
Gemini, through our Google Workspace account (Google Cloud EMEA Limited).
Claude Team, including the Claude assistant in our internal Slack (Anthropic Ireland, Limited).
ChatGPT Business (OpenAI OpCo, LLC).
None of the three vendors uses our data to train their models. That is a contractual commitment on each business plan, and we have switched off the optional feedback features that would create an exception. Staff are not permitted to use personal or free AI accounts for any work data.
Is the Steplab platform itself using these vendors?
No. The AI features inside the Steplab platform run on Amazon Bedrock in the same regions as the rest of your data (London for the UK and most of the world, Sydney for Australia, New Zealand and Asia Pacific). This article concerns internal tools, not the Steplab platform. See Where is my school's data stored? for the platform regions.
What data can reach these tools
Only what a member of staff needs for the task in front of them. In practice that is the sort of information you would expect to appear in a support conversation: a teacher's or school leader's name, work email address, role and school, and the content of the support request. Our staff policy prohibits entering:
pupil data of any kind, including classroom video, images, names or class lists;
safeguarding or welfare information;
special category data such as health or SEN information;
passwords or other credentials;
bulk exports of user data.
Everything an AI tool drafts is checked by a person before it is sent to a school.
Where the data goes
Gemini prompts and responses are stored at rest in the EU under our Workspace data region setting, and processing may take place in the United States. Claude Team and ChatGPT Business store data in the United States. Each transfer is covered by a lawful mechanism under UK GDPR: Google is certified under the UK Extension to the EU-US Data Privacy Framework; Anthropic and OpenAI process under the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, and we have completed a transfer risk assessment. The assessment is available to data protection officers on request through our Privacy & security hub.
How long it is kept
Gemini conversation history is deleted automatically after 3 months. ChatGPT Business and Claude Team retain conversations until they are deleted by the member of staff or an administrator, and staff are asked to delete conversations containing personal data once a task is complete.
Who is the controller?
Steplab is an independent controller of the personal data on the platform under our Subscription Terms, so these vendors act as processors for Steplab. They are listed as processors in clause 6.8 of our Subscription Terms and on the sub-processor list in our Privacy & security hub.
What this means for you
Nothing changes in how you use Steplab, and there is nothing you need to sign. If your trust keeps a register of your suppliers' sub-processors, add Google (Workspace), Anthropic and OpenAI to Steplab's entry. If your data protection officer wants the transfer risk assessment, the vendors' data processing agreements, or our staff AI policy, request them through security.steplab.co or email [email protected].