How ReDorm Uses AI

This policy explains where ReDorm Inc. uses artificial intelligence, what it is never used for, and how we manage the risks. It applies to everyone who works for ReDorm and to every ReDorm service.

Where we use AI

We use one AI service: Anthropic's Claude, through Anthropic's commercial API. Only ReDorm staff use it, inside ReDorm's internal staff tools, for two jobs:

• Keeping our product catalog consistent. When a campus adds a product that is not yet in our shared catalog, a ReDorm staff member can ask Claude to draft a recommendation: match it to an existing product, or suggest a standard name, brand, category, weight and typical retail price, and find clean product photos on public brand and store pages. Claude sees only the product's own details and photos, which become part of ReDorm's catalog under section 24.11 of our Terms of Service, together with our catalog and our written standardization guide.
• Drafting our newsletter. Claude drafts each edition from material we have already published, network-wide impact totals, and short descriptions of product changes.

Campus staff and students never use AI features in ReDorm, and nothing in the campus platform or the campus shops is generated or decided by AI.

What AI is never used for

• No student personal information is ever sent to an AI service: no names, email addresses, orders, residence halls or anything else about a student.
• No campus records are sent either: not which campus a product came from, how many units it holds, the prices it sets, or anything about its staff or volunteers.
• AI makes no decisions about people, such as orders, refunds, access or eligibility.
• AI cannot change anything on its own. It has no access to our database or systems; it returns a draft, and nothing is written to the catalog or sent until a person approves it.
• We do not train or fine-tune AI models, and our AI provider does not train its models on what we send through its commercial API.
• ReDorm staff do not put student personal information or campus records into any AI tool, including chat assistants, outside the uses described on this page.

A person reviews every result

Every AI draft is a suggestion. A ReDorm staff member reviews it, edits it if needed, and approves or rejects it; approving is a separate, deliberate step. Each draft is stored with who asked for it, when, the model version and the full result, so it can be reviewed later.

How we manage AI risk

We manage AI risk using the four functions of the NIST AI Risk Management Framework (AI RMF 1.0):

Govern

• ReDorm's Founder & CEO, who is also our Information Security Officer and Privacy Officer, is accountable for every use of AI and approves any new one.
• Everyone who works with an AI feature at ReDorm completes responsible-AI training before using it, and acknowledges this policy when they join and every year after.
• This policy is reviewed at least once a year and before ReDorm uses AI in a new way.
• AI providers are reviewed under our vendor policy before use, including whether they use our data to train models.

Map

• Each use of AI is recorded in our Data Privacy Impact Assessment with what data it receives, who uses it and what could go wrong.
• The risks we have identified are: a wrong suggestion entering the catalog (which would affect impact figures), content being sent that should not be, the provider using our data, and text entered by a campus trying to steer the model.

Measure

• Every result must match a strict format or it is discarded, and its suggestions are checked automatically against the live catalog (for example, a suggested product or category must really exist) before a person sees it.
• Reviewers see what the AI was unsure about and what to double-check, and drafts are marked out of date when the product or our guide changes.

Manage

• Only the minimum data is sent, chosen in code rather than by the model; the model has no tools that can act and a fixed limit on each request.
• AI features can be switched off immediately, for example during an incident, without affecting anything else in ReDorm.
• Problems with AI output are handled like any other incident under our incident response plan, and lessons feed back into this policy.

Your choices

A campus that prefers its products not be drafted with AI can tell us at info@redorm.org. We switch AI drafting off for that campus in our staff tool, which then never sends its products to an AI service, and we standardize them by hand.

Questions

Questions about this policy can be sent to info@redorm.org. See also our Privacy Notice and Terms of Service.