How we use AI
How Capstan uses AI, and what it never does
The category slaps "AI-powered" on software that scores, ranks and screens people. We do the opposite, on purpose, and we would rather write down exactly where the line is than leave you to guess.
There are two halves to this, and both matter. Capstan includes a genuinely useful assistant. It also refuses, by construction, to let any AI pass judgment on a person. A stance that only stated the refusal would sound like a company with nothing to offer; a stance that only sold the assistant would sound like every other vendor. Here is both.
What our assistant does
Capstan includes one optional assistant. It is off until an administrator turns it on for the workspace, and it can be turned off again at any time. When it is on, it answers plain-language questions from aggregate figures a caller could already see, such as headcount by department. It reflects only what that person is allowed to see, it explains rather than acting on anyone’s behalf, and it can be wrong, so it tells you to check anything important against the record.
To answer a question it sends a small amount of aggregate, non-sensitive context, for example the organisation name and per-department headcounts, to OpenAI, our named sub-processor. OpenAI’s API does not use that data to train its models, and the sub-processors page names exactly who receives what. No personal record is sent to an outside model, and none is ever used to train one.
What our AI never does
No AI in Capstan evaluates your people. It never scores, ranks, rates or screens a person. It never makes, or recommends, a decision about a person: not hiring, not performance, not pay, not promotion, not an exit. A human makes every one of those decisions. The product does the work, and the person confirms it.
What the software itself determines, an entitlement, an access decision, a line in a letter, comes from a rule you can read, never from a model’s guess. There is no attrition score, no sentiment analysis, and no algorithmic candidate screening anywhere in the product, because those are exactly the places where software quietly decides a person’s prospects, and we will not build them.
Why you can believe it: it is built this way
This is architecture, not a promise we ask you to take on trust. Reporting composes so a shared view can only ever narrow who sees what, never widen it, and small groups are suppressed so no individual is re-identified from an aggregate. The optional assistant is opt-in per workspace and aggregate-only. There is, quite simply, no evaluative model to switch on, so there is nothing to switch off.
If we ever ship an AI feature that would make a line on this page untrue, the line changes first. That is a rule we hold ourselves to (it is Gate 2 in how this site is built), and it is why this page can be short: there is not much to hedge. The fuller version of the argument sits in the manifesto, and the controls behind it are on the security page.