The uses we refuse, and the architecture that enforces it.

The platform is built to capture workforce intelligence and turn it into intelligence executives can act on. It is not built to surveil named individuals, identify respondents, sell respondent-level data, or feed military targeting. In accordance with Anthropic’s usage policy and compliance, and through our own contractual and architectural enforcement, we refuse those uses. The architecture is set up so the refusals are difficult or expensive to circumvent even with insider access.

We do not editorialize the strategic decisions our customers make on the basis of aggregate intelligence. Closing stores, restructuring business units, redesigning roles: those are decisions the operator was in a position to make. The corpus exists to inform them.

Individual re-identification, surveillance of named people, and the other uses below are a separate category. They are refused.

This refusal sits on top of, and is consistent with, Anthropic’s usage policy and compliance regime. Anthropic is the LLM partner on every plan, and any attempt to run the pipeline in violation of their policy fails on the partner side before it reaches our architecture.

Contract language: “Customer shall not use the platform, the corpus, or any derived intelligence in connection with military targeting, military decision-support systems, weapons-system design, weapons procurement, or any application intended to direct or authorize the use of force against persons.”

Architectural enforcement: Plans whose intended use indicates military application are rejected at the tenant provisioning step. Anthropic and ElevenLabs have their own usage policies that exclude military applications; an attempt to run the pipeline in violation of those policies fails on the partner side as well.

Contract language: “Customer shall not use the platform to identify the views, conduct, or characteristics of any specific named respondent. Aggregate intelligence is the permitted output; named attribution is not.”

Architectural enforcement: The synthetic voice substitution removes the audio handle to a named person. The redaction stage removes names from transcripts before enrichment. The fact rows store derived intelligence against segment slices. Respondent identifiers are absent from the row. The security cascade in the data access path filters every query by the caller’s scope; a scope that would permit named-respondent queries is rejected at tenant provisioning.

An OAuth scope that would enable a named-respondent query does not exist on the platform. An attempt to introduce one would be a code change against the published schema and the contract.

Contract language: “Customer shall not attempt to re-identify any respondent from any artifact produced by the platform, whether through voice analysis, transcript correlation, segment-vector reconstruction, or any other technique. Customer shall not request, contract for, or accept any third-party deliverable that produces respondent identification.”

Architectural enforcement: The original audio leaves no trace in any system we operate, and none in ElevenLabs under the no-retention contract. Re-identification by voice requires a recording to exist. There is none. The redaction stage removes person identifiers from the transcript before enrichment, and the cleaned transcript is the only artifact downstream stages see. The fact store carries segment vectors but not respondent identifiers; the segment vectors describe slices (tier, geography, store format) at coarse enough granularity that single-respondent reconstruction is below the threshold of practical recovery.

Contract language: “Customer shall not sell, license, or otherwise transfer respondent-level data, including raw transcripts and per-respondent fact rows, to any third party. Aggregate, segment-scoped intelligence may be shared under separate brand-partner agreements with their own consent and use terms.”

Architectural enforcement: The brand-partner API and the agent feed serve from entity rows and segment aggregates. Neither surface reads raw transcripts. Raw transcript access is restricted to the operator surfaces inside the customer’s tenant. There is no “export raw transcripts to a third party” surface on the platform.

Contract language: “The Customer corpus shall not be used to train, fine-tune, or otherwise improve any machine-learning model operated by Nexa Intelligence, by Customer, or by any third party, including the LLM and voice partners named in the subprocessor list.”

Architectural enforcement: The Anthropic no-training contract on every plan and the ElevenLabs no-training contract on every plan are the partner-side enforcement. Inside the customer tenant, the platform does not run a training pipeline. The methodology calibration we perform tunes deterministic parameters (half-lives, threshold values), not model weights.

Contract language: “Customer shall not inject synthetic, AI-generated, or otherwise non-human respondents into the corpus as if they were real capture. The corpus integrity claim requires every fact to trace to a real interview with a real worker.”

Architectural enforcement: The capture pipeline requires the respondent consent record. The consent record is associated with a real person who confirmed at interview start. The pre-enrichment gate filters conversations that look synthetic (too short, too mechanical, no audio waveform). Synthetic-respondent augmentation as a permitted use does not exist on the platform.

Contract language: “Customer shall not use the platform to identify, target, retaliate against, or otherwise act against any individual respondent on the basis of statements made during the interview, including statements relating to union activity, whistleblowing, disclosure of workplace conditions, or any other legally-protected activity.”

Architectural enforcement: The same anonymization chain that prevents general re-identification applies here. Respondent identifiers are removed before enrichment. The fact store does not carry respondent identifiers. The dashboards do not show per-respondent attribution. The operator cannot query “which workers said X” from the platform; the platform does not have the data to answer it.

When a request comes in that would violate one of the refusals, the response is procedural. We tell the customer the refusal is in the contract and that we will not implement the request. If the customer disputes the interpretation, the matter goes through the contract dispute resolution clause. The engineering team does not re-litigate it informally.

For requests that come from outside the customer relationship (a partner asking for respondent-level data, a regulator requesting a search of the corpus), the refusal is communicated in writing and the customer is notified. The customer’s legal team handles any external escalation; we cooperate within the scope our contract and the law allow.