Who Controls Your Data?

One of the most important distinctions is the difference between the public consumer version of ChatGPT and OpenAI's business API platform.

Phronesis uses OpenAI's API infrastructure through Pickaxe.

This matters because different data protection rules apply.

When organisations use OpenAI's API services, OpenAI states that customer inputs and outputs are not used to train AI models by default. This means information submitted through Phronesis is not automatically incorporated into future AI model training datasets.

In practical terms:

• Questions entered into Phronesis are not automatically fed back into future AI models.
• Your conversations are not used to train public AI systems.
• Other users cannot access your information.
• Confidential business information remains within the service delivery chain.

For most SMEs, this is one of the most important safeguards available when selecting an AI-powered business tool.

This is where many people are surprised.

A common misconception is that when an organisation enters information into an AI platform, ownership or control of that information somehow transfers to the platform provider.

In reality, the opposite is usually true.

When an organisation uses Phronesis to obtain HR guidance, the organisation entering the information typically remains the Data Controller under UK GDPR.

This is because the organisation:

• Decides what information is entered into the platform.
• Determines why the information is being processed.
• Chooses the lawful basis for processing.
• Controls the employee and business information involved.
• Retains responsibility for the underlying data.

The organisation remains in control of its own data throughout the process.

Phronesis simply processes information on behalf of the customer in order to generate HR guidance and support.

This is the same principle used by many cloud software providers, including HR systems, payroll providers, accounting platforms and CRM systems.

Within the Phronesis technology ecosystem, the roles are typically:

Security is about more than simply restricting access.

The data also needs to be protected while it is being transmitted and stored.

OpenAI states that API data is encrypted:

• In transit using TLS encryption.
• At rest using AES-256 encryption.
• Behind strict access-control processes.

These are the same categories of controls commonly used by major SaaS providers, financial institutions and enterprise technology platforms.

While no technology platform can ever claim to be completely risk-free, these measures help ensure information is protected throughout the processing lifecycle.

Another common concern relates to where information is processed.

Because OpenAI is a US-based organisation, some processing may occur outside the UK.

However, OpenAI states that international transfers are supported through recognised legal mechanisms, including:

• Standard Contractual Clauses (SCCs)
• UK GDPR Addendum protections
• Other recognised international transfer safeguards where applicable.

International data transfers are already common across many business systems used every day.

The key issue is not whether data crosses borders, but whether appropriate legal safeguards are in place when it does.

At Phronesis, responsible AI extends beyond security and legal compliance.

It also requires transparency, governance and clear operational guardrails.

That is why Phronesis has been designed around a framework intended to help users understand not only the answer provided, but also how that answer was reached.

This reflects a simple principle:

AI should support professional judgement, not replace it.

Even with strong safeguards in place, good data governance remains important.

Organisations should avoid entering unnecessary Special Category Data into AI systems unless appropriate safeguards and assessments have been completed.

Examples include:

• Health information
• Ethnicity
• Religious beliefs
• Political opinions
• Biometric data
• Criminal offence information

As with any technology platform, organisations should follow their own internal data protection policies and ensure employees understand appropriate usage.

The future of HR technology will not be determined simply by who has the most advanced AI.

It will be determined by who can combine powerful technology with strong governance, transparency and accountability.

At Phronesis, we believe organisations should remain in control of their own data.

That's why customer information entered into the platform remains under the control of the organisation that provides it. Phronesis processes that information solely for the purpose of generating HR guidance and support, while operating within a framework designed around privacy, transparency and responsible AI use.

Combined with confidence scoring, source transparency, HR-specific guardrails and access to experienced human HR professionals when issues become complex, Phronesis has been designed to help organisations adopt AI responsibly rather than simply automate decision-making.

AI can transform access to HR expertise.

But trust, governance and transparency are what make that transformation sustainable.