Contact us Not a customer? Login
Contact us Not a customer? Login

AI Insights Feature - Security Overview and Opt-out

Simeon Drage
  • Updated

Contents

 

AI Insights

IRIS Connect has introduced a new feature that combines Forms with AI analysis.

This means that videos can be quickly analysed against a rubric using AI to output feedback on the recording.  Further information about the AI Insights feature and how to use it can be found here, and the FAQ here.

 

How the feature works

We are using OpenAI to provide the AI technology for this feature

All IRIS Connect videos are held on Amazon S3. We use a process on Amazon to export the transcript from the video. No video or images are sent for analysis.

When a user requests an AI analysis of a video through the IRIS Connect web interface, the following steps occur:

1. User Request

The user initiates an AI job on a specific video via the IRIS Connect web application.

2. Video Transcription Check

The IRIS Connect web application, hosted on AWS, checks AWS S3 storage to see if a transcription of the video already exists.

3. Transcription Request

If the video has not been transcribed, the web application requests transcription from an AWS-based transcription service. The transcription service processes the video and stores the transcription back in AWS S3.

4. Transcription Availability

Once the video transcription is complete and available in AWS S3, the transcription data is sent to an external AI service provider for analysis.

5. AI Analysis

The external AI service provider performs the requested analysis on the transcription and sends the analysis results back to AWS S3. The AI service provider then destroys any data related to the job.

6. Display Results

The IRIS Connect web application retrieves the AI analysis results from AWS S3 and displays the feedback to the user through the web interface. 

 

Flow Process

Infrastructure Diagram

User Options

In line with the permission-based, teacher-centric, design of the platform:
  • Users are not obliged to use the AI features, the submission of a video to an AI Insight is an explicit step taken by a user 
  • Users can only submit a video to an AI process that they own or that has been explicitly shared with them (shares can be revoked at any time)
  • Users can select to change the privacy setting on videos that they own such that a video may not be submitted to an AI Insight
  • By default, the AI feature is turned on/off for all of the users, but upon request, we can configure the setting for specified individual users

 

Securing your Data

To ensure your data is secure we have undertaken a number of steps. These include:

  • Data access restriction -transcripts access is limited to the engineering team and the end user
  • 30 days data retention period set on OpenAI systems
  • Audit trails through automated event logging 
  • Conducting a security review of OpenAI. See their documentation here
  • Conducting a security review of Microsoft Azure. See their documentation here
  • Data is transmitted over an encrypted TLS connection
  • Only transcriptions are sent to the AI service provider, not video or audio
  • Data is not stored at rest with the AI service provider, once the AI output is complete and returned to the IRIS Connect system, no data is stored by the AI service provider
  • Our BETA disclaimers are associated with the consistency of response from the AI feature, or the possibility that AI request may on occasion may not be possible or completed (an error in transcribing / audio quality etc).  This is absolutely not in relation to how securely the data is transmitted, processed or stored, all of these elements are as robust and secure as the existing features on the platform.

GDPR, Data Regulations and Lawful Basis

For existing customers, IRIS Connect is already being used to store video, audio and other PII of students and staff, along with the data associated with the professional development process (feedback and dialogue between teachers).  The addition of a transcription of the audio and the processing of that by an AI, in our view, does not significantly change your current stance in terms of GDPR.  The PII is already being processed by the system and the purpose of the collection of that data has not changed (teacher professional development) and therefore your existing lawful basis for that data collection should not need to be adjusted (presumably 'Public Task', as teacher professional development is a statutory obligation for schools). 

We recommend customers review their DPIAs and privacy notices to ensure that they are happy that this use is covered and consult with their DPO to ensure they are complinat with their regional data regulations. 

 

AI Provider Options:

Customers that wish to use AI can choose between two providers:


OpenAI:

OpenAI offers the most advanced models and features. However, compliant use requires agreeing to the Standard Contractual Clauses (SCCs) in our new terms, as OpenAI does not currently offer regional data processing.


Microsoft Azure: 

Azure provides highly data-compliant cloud services with a data centre hosted in the EU, making it easier for customers (many of whom may already be using Microsoft Teams etc) to agree to its use. The trade-off is that Azure does not offer the most advanced AI models and features.

Use of your Data - OpenAI

OpenAI's Business Terms states:
3.2 Our Obligations for Customer Content. We will process and store Customer Content in accordance with our Enterprise privacy commitments. We will only use Customer Content as necessary to provide you with the Services, comply with applicable law, and enforce OpenAI Policies. We will not use Customer Content to develop or improve the Services.

 

International Data Transfers - OpenAI

Whilst the chance of any PII being sent for AI analysis is low, to mitigate for the possibility of it occurring we have covered this by adding additional data protections within our Data Processing Agreement. 

  • For EU-based customers, any international data transfers are covered by the inclusion of Standard Contractual Clauses (SCCs)
  • For Oceania and UK-based customers, any international data transfers are covered by the inclusion of Standard Contractual Clauses (SCCs) plus UK addendum 

For further information please see OpenAI's Data Processing Addendum 

 

International Data Transfer - Opt-out

OpenAI doesn't have regional data centres so this information is sent to their central data centre in the US for process. For users who would prefer not to use OpenAI, we can configure your organisation's setting to use Microsoft Azure instead to provide the AI analysis.

Azure has regional data centres meaning the data is never sent outside your region. The Azure data centres are based:

  • UK-based customers: UK South - London, UK
  • EU-based customers: Sweden Central - Gävle, Sweden
  • US-based customers: US East Richmond - USA
  • Oceania-based customers: Australia East - New South Wales, Australia

OpenAI has the latest in AI developments which is why we have chosen to use them as our default providers. Please be aware that Azure may have decreased performance and accuracy compared to OpenAI. 

To request Microsoft Azure, please complete this form (this form must be submitted by Organisation Administrators only).

You can submit this request at any time. 

 

Use of your Data - Microsoft Azure

Microsoft Azure states:

Your prompts (inputs) and completions (outputs), your embeddings, and your training data:

  • are NOT available to other customers.
  • are NOT available to OpenAI.
  • are NOT used to improve OpenAI models.
  • are NOT used to improve any Microsoft or 3rd party products or services.
  • are NOT used for automatically improving Azure OpenAI models for your use in your resource (The models are stateless, unless you explicitly fine-tune models with your training data).
  • Your fine-tuned Azure OpenAI models are available exclusively for your use.

The Azure OpenAI Service is fully controlled by Microsoft; Microsoft hosts the OpenAI models in Microsoft’s Azure environment and the Service does NOT interact with any services operated by OpenAI (e.g. ChatGPT, or the OpenAI API).

 

 

AI Insights Feature - Opt-out

We understand that there may be some customers who don't want the feature to be used by their organisation. If you wish to opt out of AI Insights you can request this via this link (this form must be submitted by Organisation Administrators only).

We will then turn off this feature for all your users. You will be able to use the non-AI enabled Insights feature.  With AI switched off, the AI features do not appear for your users and the AI service providers are not used as sub-processors 

You can submit this request at any time. 

 

New Data Processing Agreement (DPA)

We have updated our DPA to include OpenAI and Microsft Azure as sub-processors. All customers will need to agree to the new agreement, whether they are using the AI Insights feature or have decided to opt out. The agreement makes it clear that the use of OpenAI and Azure as sub-processors is optional and will only be used in conjunction with the AI Insights feature. 

For further information on the changes we have made to our DPA please see this article. 

 

 

 

Related articles