Skip to content

AI data egress (paired technical twin)

Plain-language version: What we send to AI, and where it goes

Relationship to the disclosure doc. The canonical engineering disclosure source of truth is ai-data-egress-disclosure.md (WING-418). This file exists so the basename ai-data-egress.md is paired on both tracks: the plain track historically used the short name, and CI requires exact basename siblings with no rename-only escape.

Do not fork policy between the two technical files. If facts change, update ai-data-egress-disclosure.md first, then keep this twin consistent.

Edition split (non-negotiable)

Desktop Cloud / pilot (WorkWingman__Edition=server)
Whose provider account User BYOK API key or signed-in CLI WorkWingman-owned secrets and/or tenant-configured keys
Vendor relationship User ↔ vendor WorkWingman ↔ vendor (plus optional tenant keys)
Retention promises Only what the user’s vendor/plan states Only what written commercial terms state — currently unresolved for several claims

Cloud is not a fixed subprocessor list: deployment config and tenant-supplied integration keys can light different providers. Enumerate from EgressSurfaceRegistry and deployment plan, not from a one-line marketing sentence.

Content that leaves (summary)

Identity (preferred or legal name; not email/phone/address on the drafting prompt), structured profile blocks, full resume text on extraction, interview-coach serialization of history/stories/ retros, job descriptions and company research, student fact packs, and media prompts (plus image bytes on Magnific-class paths). See the disclosure doc for field-level precision and known gaps (PromptSafety not universal; codex CLI tools not fully disabled — WING-431).

Rules that must not appear in published copy until true

  • “Anonymized before the model sees it” — false; deliberate field selection, not redaction.
  • Product-wide “AI has no tools” — false while any CLI preset leaves tools enabled.
  • Cloud training / retention / region — blocked until written vendor terms (WING-415).

Inventory location

src/WorkWingman.Core/Privacy/EgressSurfaceRegistry.cs is the checkable producer inventory. Coverage tests currently prove listed types exist; they do not yet prove every producer is listed. Treat the registry as a floor.

  • Full disclosure: docs/technical/ai-data-egress-disclosure.md
  • Plain short name: docs/plain/ai-data-egress.md