eiso Data Handling Principles

1. Source data stays on your computer: Original files and source data are kept in the designated folder on your computer. eiso reads them in your browser and uses them only for that task.
2. Uploaded files are deleted when the task is finished: Files are not uploaded to the eiso server in the first place. Text read from a file is also cleared from the screen when the task is finished, and is not kept in this browser's input autosave (text you type yourself is kept).
3. eiso analyzes, processes and consolidates: Operational data (measurements, records, complaints, evaluations, incidents, objectives) is kept in eiso, encrypted with a different key for each company, for analysis. eiso provides your company with the analyzed and consolidated additional information (determinations, trends, summaries, management review inputs).
4. Output appears on screen first: Results are shown on screen, and saving, downloading or printing happens only when your company chooses to.
5. Consolidated storage in a designated folder, if you wish: Once you designate an "eiso archive folder", outputs are saved in function and step folders. Outputs in the company workspace can be saved to your folder all at once with "Save all outputs to my folder" (including the archive list), and downloads from the operational data screen can also go to the archive folder. Only the folder name and permission are remembered in your browser; file contents do not go to eiso.
6. No training: Your company's materials, outputs and opinion texts are not used for AI training. Only numbers such as usage counts and scores are used to improve the quality of eiso.

Where does your data go?

Functions used	What is sent	Where to	What remains
Document folder designation, reference materials, reference files, customer materials	Files are not sent. Only the text read by the browser is sent when you press "Write with AI".	AI service (Anthropic, United States)	Not stored in eiso
Images in reference materials (organization charts, process charts, etc.)	Images reduced in the browser. The company logo is not sent; it is added only to the Word download.	AI service (Anthropic)	Not stored in eiso
Ask with AI, guide chatbot	The question (a question asked with Ask with AI may be used as a web search query)	AI service (Anthropic)	Questions are not stored (only the number of uses per day is counted)
Web research on industry, legal requirements and risks: Management System Operation 1 Context of the Organization and 3 Risk Assessment; ICT Management System Operation 1 AI Context Analysis and 13 Legal Requirements Identification and Monitoring	Only the industry, business region, selected standards and AI role that your company entered (for legal requirements identification, the applicable items and the subjects of periodic checks; for risk assessment, the departments and processes) are used in the search request. The company name, basic information, website and uploaded files are not sent. Do not enter a company name in these fields.	Web search by the AI service (Anthropic): the public web (for legal requirements and risks, within designated sites such as the Korea Ministry of Government Legislation's National Law Information Center and iso.org)	Not stored. The sources found are listed at the end of the result under "Web sources referenced"
Management System Operation and ICT Management System Operation: designation of folders and files on your computer (division of roles)	Files are not sent. Only the text read by the browser is sent when you press "Write with AI".	AI service (Anthropic)	Not stored in eiso. Original source data stays on your computer (only processed and analyzed results appear on screen)
Management System Operation and ICT Management System Operation: sharing results between steps (ICT Management System Operation also remembers the selected scope in the browser)	Results of previously written steps (sent together when you write another step)	Your company's browser and the AI service (Anthropic)	Kept only in your company's browser (not stored in eiso); can be turned off or cleared on screen. Please clear it on shared PCs.
17 Internal Audit; ICT Management System Operation 12 Internal Audit, Mock Audit	Your company's answers and the previous Q&A (sent together with each question)	AI service (Anthropic)	The Q&A stays only in that browser tab: eiso keeps only the session number and the number of questions
Company Workspace	Outputs that your company chose to "Save to workspace"	eiso server (Cloudflare)	Encrypted and stored for each company; deleted automatically after the retention period
Operational data: Operational Data Management, IATF 16949 Core Tools, Social Value Operational Data, AI and Information Asset Lifecycle Management, Objectives and Performance Monitoring	Records that your company entered on screen or imported from Excel (measurements, records, complaints, evaluations, incidents, objectives)	eiso server (Cloudflare)	Encrypted and stored for each company for analysis (numbers, figures and determinations are kept as they are so they can be analyzed); follows the retention period and workspace deletion. Not used for AI training
AI feature: "Contact the person in charge"	The input your company left in the inquiry (situation, company name, auditor name, etc.) and member information	eiso server (Cloudflare) and the email of the person in charge	Kept as an inquiry record: 1 year after handling is completed (5 years for inquiries about items that require payment). "Not stored" above applies only to "Write with AI" · Privacy Policy
Applications, questions and answers, payments	The content your company entered	eiso server (Cloudflare)	Retention period in the Privacy Policy

* Operation and maintenance of the website are handled by a contractor; the entrusted tasks and overseas transfers are described in the Privacy Policy. The AI service's retention policy follows that company's policy.

Company workspace (repository) management guide

• Created only with consent: The company administrator must consent to storage when creating the workspace. Without consent, nothing is stored.
• Encrypted with a different key for each company: The company name, document titles and body text are encrypted with AES-256 (GCM) before storage. AGENT's operations screens have no place where workspace contents can be viewed.
• Roles are separated: administrator · author · reviewer · approver · view only (for example certification auditors who only view). The company administrator adds and removes members by member ID (up to 30 per company). Please remove people who have left or moved right away.
• You set the retention period: Choose from 90 days, 1 year, 3 years or 5 years; documents past the period are deleted automatically. If you change the retention period, the new period also applies to documents already saved.
• Delete at any time: You can delete a single document or the entire workspace. When a member withdraws (member deletion), that member's membership seat is also cleared, and a workspace where that person was the only administrator is deleted along with it.
• Downloaded files are under your company's control: Please keep, distribute and dispose of documents downloaded as Word in accordance with your company's documented information control procedure (e.g., ISO 9001 and ISO/IEC 27001 clause 7.5).

* Deleted content disappears immediately from the screen and the database. However, it may remain in encrypted form for a certain period in the hosting provider's database recovery records.

Information security practices recommended for your company

Before uploading

• Delete or replace personal information such as resident registration numbers, employees' personal contact details and health information before uploading.
• Do not upload trade secrets such as costs, unit prices by customer and design drawings. If they are essential, replace the numbers with example values.
• For customer and partner names, enter them in the "Names to mask" field on screens that have one (Management System Documentation, Integrated Management System Document Development, Standard Revision Response); they are replaced with "XX Co." before sending. On screens without this field, replace them yourself.
• Your company's logo, company name, address and main contact details may be uploaded as they are. They are used as they are in the output.

Accounts

• Each person in charge signs up separately. Do not share accounts (Terms of Use).
• Use a password of at least 8 characters that differs from those on other sites. On shared computers, log out when you are done.
• If you think your password may have been leaked, set a new one right away with Find ID / Password.

Outputs and records

• Use AI drafts only after the responsible department has reviewed and approved them.
• In the workspace, assign authoring, review and approval to different people, and set the retention period to suit your work.
• Delete records you no longer need, even before the retention period ends.

Impersonation and incidents

• AGENT does not ask for deposits to any account other than the Shinhan Bank account we have provided. If you are given a different account, do not comply, and please contact us.
• If you receive an email impersonating eiso or notice anything suspicious, please report it right away to the address below.

* If you need manuals or procedures for an information security management system (ISO/IEC 27001), your company can write them yourselves with Individual Document Development or Integrated Management System Document Development.