Find out how the AI Assistant handles your content and your visitors' questions, and what you're responsible for as the operator of your help center.
What's Changing
The AI search used a large language model through your own OpenAI API key. The AI Assistant runs on Amazon Web Services (AWS) Bedrock, AWS's managed service for AI models. You no longer need to provide or maintain your own API key.
Which AI Models Are Used
The AI Assistant uses AI models through AWS Bedrock:
A text generation model answers questions. Today, this is an Anthropic Claude model.
An embedding model indexes your published content for search.
K15t selects and manages the models, so you can't choose them. We may change the models over time as they improve. In every case, we only use models that run with zero data retention. Models that would need your data to be stored or reviewed aren't used.
Frequently Asked Questions
Are my content or my visitors' questions used to train AI models?
No. Inputs and outputs sent through AWS Bedrock aren't used to train AI models and aren't shared with the model providers. The model providers license their models to AWS and don't receive your inputs or outputs.
What happens to the questions my visitors type?
A question is sent to the AI model through AWS Bedrock to answer that request. With zero data retention, AWS Bedrock doesn't store the question or the answer after processing.
So that visitors can ask follow-up questions and come back to a conversation, K15t stores the conversation in its own service for a limited time. After that, the conversation is deleted automatically.
Where is the data processed?
Processing takes place within AWS, in the AWS environment that already hosts your Scroll Sites content. This may involve a transfer of personal data to the United States. The international transfer and sub-processor provisions of the K15t Data Processing Addendum govern this transfer. They rely on the EU Standard Contractual Clauses under Art. 46 GDPR, and AWS is also certified under the EU-US Data Privacy Framework.
K15t operates an ISO 27001-certified information security management system and maintains a SOC 2 report. Scroll Sites is penetration tested regularly. For details, see the K15t Trust Center.
AWS Bedrock is in scope of AWS’s independently audited certifications and reports, including SOC 2 Type II, ISO 27001, and BSI C5.
Is AWS a new sub-processor? Are the model providers sub-processors?
AWS isn't a new sub-processor. It's already listed for hosting, and we're extending its purpose to include AI processing. The model providers aren't sub-processors: they license their models to AWS and don't receive or process your data.
Is personal data sent to the AI model?
We don't add personal data about your visitors to what's sent to the model. The model receives the question, the conversation so far, the page the visitor is on, and the passages found in your content. Visitors’ questions and the conversation are sent to the AI model through AWS Bedrock as typed, so they can contain personal data if visitors enter it.
Does the AI Assistant respect access restrictions?
Yes. The AI Assistant only answers from your site's published content. On a protected site, only visitors who can open the site can use it, and they get answers only from content they can already read. Pages with view restrictions in Confluence aren't in your site's search index, so the AI Assistant can't use them.
Is the AI Assistant labeled as AI?
Yes. The AI Assistant is clearly identified as AI, so visitors know they're interacting with an AI system.
How reliable are the answers?
The AI Assistant answers from your published content but, like any AI system, its answers can be incomplete or inaccurate. Answers are meant as first guidance. Visitors should check important information against the linked articles or with your team.
Does the EU AI Act apply?
Based on our assessment, the AI Assistant isn’t considered a high-risk AI system under the EU AI Act. We identify it as AI in line with the Act’s transparency requirements. If you enable it in your help center, assess your own obligations under the AI Act. We’re happy to provide the information you need for that assessment.
Is the AI Assistant optional?
Yes. The AI Assistant is off until a site admin enables it, and it can be disabled again at any time.
What do I need to do as the operator of the help center?
As the controller, you remain responsible for your own obligations under data protection law. In particular, you need a valid legal basis for the processing and must inform your visitors about it, for example in your privacy statement.
