1.Purpose
This policy sets out how fullthrottle.ai® acquires, develops, deploys, uses and oversees AI Systems securely and responsibly. It supports alignment with:
- Applicable laws and regulations
- Our information security requirements
- Our contractual obligations to customers
- Generally accepted industry practices
- Our security, privacy and compliance programs
Our AI governance practices are informed by the NIST AI Risk Management Framework (AI RMF 1.0) and operate alongside our broader security and privacy program.
2.Scope and Definitions
This policy applies to AI Systems used by or on behalf of fullthrottle.ai®, in production and non-production environments. It covers employees, contractors, temporary personnel, and third-party providers using AI Systems on our behalf to the extent set out in their agreements with us. It also covers AI capabilities built into the fullthrottle.ai® platform, including the AI Media Agent.
AI System. Any software, model, service or feature that uses machine learning, large language models or other statistical or inference-based techniques to generate outputs such as content, predictions, recommendations, classifications or decisions. It includes generative AI tools, AI features embedded in third-party software and AI-assisted business processes. It excludes conventional software that operates solely on rules explicitly defined by people, such as standard reporting and deterministic data processing.
AI Agent. An AI System that can take actions in other systems, such as creating records, sending messages, changing settings or initiating transactions, rather than only producing content for a person to review.
Customer Data. Data that customers provide to, or that is collected on their behalf through, the fullthrottle.ai® platform.
3.Governance Principles
Security first. AI Systems are designed and operated in line with our information security requirements, including least-privilege access, authentication controls, monitoring and logging, secure development practices and incident response.
Human accountability. AI Systems assist our people. Responsibility for business decisions, regulatory compliance, legal obligations and customer commitments remains with people.
Transparency. Where practical, AI-generated outputs used in business processes are identifiable, reviewable and auditable. Where our products provide interactive AI features, we make clear that users are interacting with an AI System.
Privacy protection. AI Systems are used in a manner designed to protect personal information, confidential information and Customer Data.
Risk-based management. Controls are matched to the purpose, autonomy and potential impact of each AI System (Section 4).
Industry frameworks. Our practices are informed by the NIST AI RMF, a voluntary framework applied as an ongoing practice rather than a point-in-time certification. Our broader security and privacy program is subject to independent SOC 2 Type 2 examination. We apply the framework’s four functions as follows:
| Function | How fullthrottle.ai® applies it |
|---|---|
| Govern | Documented policies define permitted and prohibited uses, accountability and ownership. We maintain an inventory of AI Systems in use. |
| Map | Risk is assessed in context before deployment, based on purpose, autonomy, data sensitivity and the consequences of error. |
| Measure | Where appropriate to risk, AI interactions are logged and monitored, and feedback mechanisms surface accuracy and quality issues. |
| Manage | Controls may include input screening, limits on permitted actions, content safeguards and vendor review, revisited as the AI landscape evolves. |
4.Risk-Based Approach
Every AI System is assigned a risk tier before use. The tier sets the level of review required. A read-only assistant whose output a person reviews carries a very different risk from an AI Agent that takes actions affecting spend or Customer Data.
| Tier | Examples | Required before use |
|---|---|---|
| Low | Drafting, summarization and coding assistance with human review of outputs | Use of an approved tool, in line with Section 7 |
| Medium | Customer-facing content; internal AI Agents with read access to business systems | Business owner approval, logging, periodic review |
| High | AI Agents that take actions affecting campaign spend, Customer Data, financial or contractual systems; AI features in our products | Security and privacy review, pre-release testing, documented approval, ongoing monitoring |
Risk factors considered include data sensitivity, security impact, potential customer harm, degree of autonomy, vendor and supply chain risk, operational dependency, and legal and regulatory implications.
5.AI in fullthrottle.ai® Products
AI features in the fullthrottle.ai® platform, including the AI Media Agent, are treated as High tier. They are governed by the following practices.
- Customer control of consequential actions. Actions that commit or change media spend, launch campaigns or activate audiences require customer confirmation, or operate within limits the customer sets.
- Action records. Actions taken by the AI Media Agent are logged and visible to the customer.
- Pre-release testing. AI features are tested for accuracy, reliability and safety before release.
- Model change management. Changes to underlying AI models or AI providers are reviewed and tested before reaching production.
- Disclosure. Users are informed when they are interacting with an AI feature.
- Customer responsibility. Customers remain responsible for their campaign decisions, creative approval and compliance with laws that apply to their advertising.
6.Customer Data and Privacy
Customer Data processed by AI Systems is handled under the same privacy-first commitments that govern the rest of the fullthrottle.ai® platform.
- Processed for the customer. Customer Data is processed on behalf of the customer, for that customer’s business purposes, in accordance with our agreement with them and applicable law.
- No cross-customer use. One customer’s data is not used to generate outputs, recommendations or audiences for another customer, except as permitted by agreement.
- No model training without permission. We do not use Customer Data to train AI models except as permitted by our agreement with that customer.
- No sale. AI processing does not change our commitment that Customer Data is not sold or shared for cross-context behavioral advertising.
- Proportionate controls. Where approved AI Systems process protected information, controls may include access restrictions, encryption in transit and at rest, interaction logging, retention limits and vendor security review.
7.Internal Use of AI
Approved tools only. Personnel may process company information only with AI platforms approved by fullthrottle.ai®. Approval considers data handling, security, retention and whether the provider may use our data to train its models.
Data restrictions. Approval of a tool does not approve every data type for that tool. Each approved tool is cleared for specific classes of information. The following may not be entered into any AI System unless that system is specifically approved for it:
- Consumer personal information, including data received from or about customers’ shoppers
- Confidential client information
- Authentication credentials, passwords and API keys
- Financial information
- Trade secrets
- Information protected by law or regulation
- Security-sensitive information
AI Agents and integrations. Connecting an AI System to business systems requires separate approval. Access is limited to the minimum permissions needed. Actions that affect financial, customer or contractual records require human confirmation before they take effect.
8.Human Oversight
AI-generated output is not treated as authoritative without review appropriate to its use. Human review, proportionate to risk, applies where AI output materially informs customer communications, legal or compliance decisions, security decisions, financial decisions, contractual commitments or strategic business decisions.
Where AI operates within automated processes, oversight is provided through design, testing, monitoring and periodic review rather than review of each individual output. Personnel remain accountable for decisions made using AI-assisted outputs.
9.Third-Party AI Providers
Third-party AI providers are assessed through vendor review before use and periodically after. Review considers data handling and retention, security controls, subprocessors, and whether the provider may use fullthrottle.ai® or Customer Data to train its general-purpose models. Material changes to a provider’s terms or models are reviewed before continued use with protected information.
10.Advertising-Specific Safeguards
- Sensitive ad categories. AI-assisted audience building and targeting for credit, housing and employment offers is subject to additional restrictions and review designed to support compliance with applicable anti-discrimination and fair lending laws.
- AI-generated creative. Where the platform generates or suggests ad copy or creative, customers review and approve it before it runs.
- Accurate claims about AI. Our statements about what our AI can do are reviewed for accuracy and substantiation before publication.
11.Security, Monitoring and Incident Response
Monitoring. Where technically feasible and proportionate to risk, we keep the records reasonably necessary for security monitoring, incident investigation, compliance review and audit.
AI-related threats. Threat actors increasingly use AI for phishing, social engineering, malicious content and automated attacks. AI Systems that read external content can also be targeted by instructions hidden in that content. We address these threats within our existing security operations, monitoring and incident response programs.
Incident reporting. Personnel must promptly report any AI-related event involving data exposure, security or regulatory concerns, vendor misconduct or material AI System malfunction. These events are managed through our established incident response process.
12.Compliance, Training and Policy Status
Legal and regulatory compliance. AI use complies with the laws that apply to fullthrottle.ai®, including those relating to privacy, data protection, consumer protection and AI, and with our contractual obligations. We monitor legal and regulatory developments and update this policy and related controls as needed.
Training. Personnel acknowledge this policy at onboarding and complete AI usage training annually, covering approved tools, data handling, privacy, security and emerging AI risks.
Exceptions and enforcement. Exceptions require written business justification and approval from DevSecOps Security and Compliance, and may be time-limited. Violations may result in removal of system access, corrective or disciplinary action, or vendor review.
Review. This policy is reviewed at least annually and when material changes occur in our AI use, technology or legal requirements.
Status of this policy. This policy describes our internal governance practices. It does not create contractual commitments, warranties or rights for any third party. Our obligations to customers are set out in our agreements with them, which prevail in the event of conflict. We may update this policy at any time.
Questions about this policy: Contact your fullthrottle.ai® representative, or reach DevSecOps Security and Compliance directly.