Our Policies | Toyon Solutions

Purpose and scope

At Toyon Solutions, we aim to turn AI into reliable, understandable systems that serve people. This policy framework covers Sappr and our AI access infrastructure, our observability and privacy work, our robotics research, and the use of AI within our organization.

Our principles apply throughout research, design, data selection, development, procurement, testing, deployment, operation, and retirement. Responsibilities for employees, collaborating specialists, and suppliers are defined according to their roles and contractual scope. Customers’ responsibilities for their own intended uses and decision processes are defined separately.

Responsible AI policy

We commit to establishing, maintaining, and continually improving our AI management system in line with our business objectives, and to meeting the legal, contractual, and other requirements applicable to our activities.

Human oversight: Uses that affect people or physical safety are designed to allow authorized people to review, intervene, and stop operation. AI outputs must not be treated as final decisions without verification appropriate to the risk.
Fairness and harm reduction: We assess discrimination, misleading outputs, misuse, and adverse effects on different user groups, and select safeguards appropriate to the context of use.
Transparency: AI functions, intended uses, known limitations, and necessary human oversight are explained clearly to users. The possibility of incorrect outputs is taken into account.
Accountability: Responsible owners are assigned for systems, decision authority, and significant changes, and necessary records are retained.

Responsibilities and objectives

Top management is responsible for approving the policy, providing resources, assigning roles and authority, and reviewing the effectiveness of the management system. The designated AI management owner coordinates risk, objectives, incidents, and improvement activities, and reports to management. System owners are responsible for intended use, testing, monitoring, and change records. Employees are responsible for authorized use and reporting concerns.

This policy provides a framework for setting AI objectives. Each objective must have a documented owner, measure, target, resources, deadline, and evaluation method. Areas to monitor include the coverage of risk and impact assessments, validation results, data quality, employee awareness, and completion of corrective actions. Results inform management review.

Risk, impact, and lifecycle

Before deploying a new system or making significant changes, we assess its purpose, stakeholders, data and model resources, effects on individuals and society, safety, security, privacy, and foreseeable misuse. Physical harm and safe stopping are also considered for robotics applications.

Risk acceptance criteria are defined, and risks are assessed and prioritized by likelihood and consequences. Necessary controls, the risk treatment plan, and the authority accepting residual risk are documented. Uses with unacceptable risk are not approved. Controls are selected according to the system’s context, with their applicability and rationale recorded.

Testing and acceptance criteria, data and model versions, changes, necessary human and technical resources, and monitoring plans are defined. Performance, errors, drift, and unexpected effects are monitored during operation. When necessary, use is restricted, stopped, or rolled back to a previous safe version. Retirement planning covers revoking access and appropriately deleting or transferring data.

Data, privacy, and information security

Data use follows purpose limitation, data minimization, appropriate access, and defined retention periods. Data sources, rights of use, quality, representativeness, and processing history are assessed. Unnecessary logging of sensitive content is avoided, and access, retention, and deletion rules are defined for telemetry and audit records.

Personal data, trade secrets, and customer content are used only for authorized purposes with appropriate safeguards. New uses, such as model training or transfer to an external provider, must not proceed without assessing the relevant rights, obligations, and permissions. Security controls address authorization boundaries, secrets management, vulnerability remediation, and incident response.

This section sets out data and information security principles for AI activities. Service-specific details of personal data processing are explained separately in the relevant privacy notices and agreements.

Acceptable use and suppliers

AI may be used only for approved purposes and within authorized boundaries. Uses intended to enable unlawful discrimination, deception, unauthorized processing of personal data, circumvention of security controls, or harm to people are not acceptable. Unverified outputs must not be presented as reliable facts or expert approval.

Model, data, and infrastructure providers are assessed for security, data use, performance limitations, licensing, and service continuity. Responsibilities between Toyon, providers, and customers are clearly defined for data processing, change notification, incident management, and service termination. Supplier changes and critical dependencies trigger reassessment.

Concerns, appeals, and incidents

If you have a question or concern about one of our AI systems, including incorrect outputs, discrimination, privacy, or security, contact hello@toyonsolution.com. You may also use this channel to request human review or appeal an outcome.

Please identify the relevant product or function, the time of the incident, its potential impact, and any example you can share safely. Do not send passwords, API keys, or unnecessary personal data.

Reports are recorded, prioritized by impact, and assigned to a responsible person. The process includes investigation, any necessary restriction or correction, communication of the outcome, and follow-up on effectiveness. Relevant parties are notified of significant incidents in accordance with applicable obligations. People who report concerns in good faith must not face retaliation, and information is shared only as needed.

Communication and continual improvement

The policy is communicated internally during onboarding and through updates, and is made available to interested parties on this page. Competence and training needs are identified for relevant roles.

The policy is reviewed at least annually and following significant changes to systems, requirements, or risks, or significant incidents. Performance measures, internal audits, management reviews, and stakeholder feedback inform improvements. Nonconformities are investigated to identify causes, corrective actions and owners are assigned, and their effectiveness is checked.

Policy approval, effective dates, reasons for changes, and previous versions are maintained in the organization’s controlled document records. Alignment with data, information security, human resources, and procurement processes is reviewed.