AI Policy

AI is opt-in,
board-auditable,
and fully disable-able.

Renewal automations, search, and analytics all work without AI. Every AI call is logged with member-data scope for audit. Built for regulated professions that need to prove what the system did — and what it didn't.

AI is opt-in, not opt-out

Every AI capability ships behind a per-org toggle and defaults to off for regulated industries. Drafting, proactive inbox, inline suggestions, analytics insights, search, chat, and external calls each have independent switches.

The platform works fully without AI

Renewal automations, keyword search, rule-based churn scoring, analytics dashboards, and campaign delivery all run without a single LLM call. AI-off is a first-class mode — not a degraded one.

Every AI call is logged for audit

Each LLM call writes an ai_call_log row with org, user, capability, operation, provider, model, tokens in/out, latency, and success status. AI-off orgs get auditable zero-call reports for board meetings.

What happens when AI is off.

Every capability has a designed, tested non-AI path. Toggle a capability off and the UI, performance, and correctness all degrade gracefully.

Capability
AI on
AI off — fallback
Drafting (emails, summaries)
LLM-generated drafts grounded in member context and voice profile.
Blank editor. Staff write from scratch. Voice profile unused.
Proactive inbox
Up to 5 AI-suggested actions per day (at-risk renewals, lapsing engagement, overdue invoices).
Rule-based triggers only — configured thresholds fire without AI ranking.
Inline suggestions on member profile
Summarize activity / Explain engagement / Draft message buttons live in the profile header.
Buttons hidden. Raw timeline and engagement score remain visible.
Analytics insights
Natural-language narratives over cohort, retention, and revenue charts.
Charts, tables, CSV export. No narrative summary.
Search
Semantic search across resources, events, and member records.
Keyword search with filters. Same index, same data.
Churn prediction
ML model scores churn risk using engagement, tenure, and billing signals.
Rule-based scoring from engagement threshold + days-since-login. No model.
Per-call attestation

Every AI call writes an audit row.

MemberRun uses AsyncLocalStorage and a withAiRecorded() wrapper so no LLM call can bypass the log. AI-off orgs can hand their board a one-line attestation: "Zero AI calls in period X, scope: all capabilities."

Table: ai_call_log — append-only, exportable to CSV, retained for 7 years by default.

Fields logged per call

  • Organization ID
  • User ID (who triggered the call)
  • Capability (drafting, proactive, inline, analytics, search, chat, external)
  • Operation name
  • Provider + model ID
  • Tokens in / tokens out
  • Latency (ms)
  • Success / failure
  • Timestamp

Governance controls staff can actually use.

Master + per-capability toggles

Flip the master off and every capability disables immediately. Granular toggles let you run with analytics AI on while keeping drafting off.

Board-ready reports

Export period-based AI usage — total calls, capabilities touched, tokens consumed, avg latency. AI-off orgs get a clean zero-call attestation.

Member-data scope

The log records whether a call touched member PII vs only aggregate/anonymized data. Regulators asking "did any member record leave your system?" get a filterable answer.

Common questions.

Is member data used to train AI models?

No. Member data is never used to train foundation models — yours or any other customer's. AI calls run inference only; no data leaves your org boundary for training purposes.

Which AI providers does MemberRun use?

Anthropic (Claude) and OpenAI (GPT-4 class models) for general drafting, summarization, and search. All calls go through enterprise API tiers with zero data retention for training.

Can we disable AI for the entire organization?

Yes. Flip the master toggle in Admin → Settings → AI. Every capability will refuse to run and fall back to its non-AI path. Member-facing UI hides AI buttons entirely.

Can we prove to our board that no AI calls happened?

Yes. The AI settings page exports a period report (e.g. 'Q1 2026 — 0 AI calls, scope: all capabilities disabled'). The ai_call_log table is append-only and cryptographically consistent with platform audit logs.

What's the latency cost of AI-off mode?

Faster, not slower. Rule-based churn and keyword search run in milliseconds; LLM calls typically take 800–3000ms. AI-off orgs see snappier dashboards.

Does AI-off work for every tier?

Yes. AI governance ships on every plan, including Free. The toggles are an architectural feature, not an upsell.

How does the voice profile work when AI is on?

Staff upload up to 5 real past emails as few-shot examples plus a preferred-term glossary. Those are threaded into drafting prompts. toneMatch.source honestly reports org_voice vs default.

Who can view the AI audit log?

Super-admins and any staff with the 'audit:view' permission. The log is read-only and exportable to CSV for regulator or board review.

Want the full governance walk-through?

We'll show your board, compliance officer, or IT lead the exact toggles, audit log, and attestation flow — live, in your own tenant.

Book a free demo