AI features and providers
AI features are optional and off until an administrator turns them on. Everything else in HouseGRC works without them.
What they do
- The assistant answers questions from your own records, such as "which high risks have no treatment plan" or "what is blocking our ISO/IEC 27001 readiness". It can read; it cannot create, change or delete anything, and it sees only what the person asking is allowed to see.
- Drafts: suggested risks, threat models, impact assessments, post-incident review hypotheses and control suggestions arrive as drafts that fill only empty fields; a person reviews and keeps or discards them.
- Summaries: executive summaries and the narrative in the board pack.
Providers
In Settings ▸ AI, choose a provider, a model and an API key from your organisation's own account: Anthropic (Claude), OpenAI, Google Gemini, Cohere, Mistral, DeepSeek, or any service with an OpenAI-compatible API, including models you run yourself. Test connection shows the provider's answer.
What is sent, and where
When someone uses an AI feature, the question and the records needed to answer it go to the provider you chose, under your organisation's agreement with that provider. Nothing goes to us. Text that came from outside your organisation, such as vendor questionnaire answers and uploaded documents, is marked as data and screened before it is sent, so that instructions hidden in it are not followed.
Each AI feature's instructions (its system prompt) can be reviewed and changed in Settings ▸ AI ▸ Prompts.