AI Usage & Transparency Policy

• Document extraction: uploaded or emailed invoices (PDF/images) are rendered and sent to a vision language model that returns structured header and line-item data, with confidence scores. Vietnamese e-invoice XML is parsed deterministically — no AI involved.
• Matching assistance: semantic embeddings help link invoice lines to purchase orders and ERP items; a scorer ranks candidate POs for no-PO invoices.
• Copilot & intelligence engines: explanations of matching results, dispute-letter drafts, exception-resolution suggestions, and fraud/ duplicate/anomaly scoring (the scoring itself is rule- and statistics-based; the LLM writes the explanation, not the verdict).

Only what the feature needs: document images/text for extraction, invoice and PO fields for explanations and drafts. We route requests by stakes — a lightweight model for low-stakes classification, a frontier model for deep reconciliation — all via the provider API listed in the Subprocessor List. API traffic to our AI providers is not used to train their models under their business API terms, and we never use one customer's data to improve results for another.

• AI never approves an invoice or executes a payment. Approval workflows, amount thresholds, and payment execution are deterministic and human-driven.
• Low-confidence extractions and matching mismatches are routed to humans as exceptions, not silently accepted.
• Bounded autonomy is opt-in: if an organization enables copilot autonomy, it is capped by tenant-configured confidence floors and amount ceilings, defaults to off, and every autonomous action is audited and reversible.

Extraction accuracy is measured continuously against validation rules (tax arithmetic, GDT registry checks, duplicate detection) rather than assumed. Known limits: handwriting, poor scans, and non-standard templates lower confidence — such documents route to manual review. Per-tenant AI processing statistics (documents processed, copilot interactions) are visible to administrators on the in-app Security Dashboard.

Vietnam has no AI-specific statute in force today; our obligations flow from PDPL (personal data in documents sent for extraction) and accounting law (human accountability for books and records). We track draft AI regulation in Vietnam and the region and will update this policy — versioned, with re-acknowledgement — when obligations change.