H2CYBER · AI SECURITY POSTURE · UPDATED 2026-05-05

How we use AI, in plain English.

H2Cyber generates plain-English score explanations, monthly report memos, policy documents, take-action guidance, and form auto-fills with Anthropic’s Claude models through Amazon Bedrock inside our AWS account. Your prompts and outputs are not sent to Anthropic, are not used to train models, and per Amazon Bedrock data handling are not stored or shared by Bedrock. This page lays out the architecture, the data flow, and what you can verify yourself.

THE THREE COMMITMENTS
01

No training.

Inference runs inside our AWS account through Amazon Bedrock. Your prompts and outputs are not sent to Anthropic and are not used to train models. This applies whether the data is your assessment answers, an uploaded policy, or a question on a vendor form.

02

No retention.

Per Amazon Bedrock data handling, prompts and model outputs are not stored or shared by Bedrock for abuse-detection review. We keep a minimized audit log on our side so you can see what was generated when, for whom, and at what cost. That log is yours; you can request a copy.

03

Cited inputs.

Every AI-generated answer in the platform carries a citation back to the assessment field, audit history, regulatory section, or device record it was drawn from. If we don’t have the data, the answer says so. We don’t make things up.

Where AI runs in the platform
FeatureWhat it doesInputs cited
Score translatorPlain-English explanation of any score numeral on the dashboard or report cover.Assessment, audit history, NIST CSF 2.0, regulatory profile.
Monthly report memoTwo-paragraph cover memo and the “This month” interior page. Everything else on the report is structured templating, not AI.Assessment, prior month, regulatory bulletins.
Policy studioInformation Security, DR/BCP, AUP, and Incident Response policies generated from your company info and assessment state.Assessment, company info, regulatory profile.
Adaptive guidanceThe take-action drawer prose that names your actual devices, your regulatory cites, and what’s already implemented.Assessment, Syxsense device fleet, audit history, NIST CSF 2.0.
Form auto-fillCyber-insurance applications, customer security questionnaires, vendor-risk forms, populated from your assessment.Assessment, Syxsense, company info.
DATA FLOW
  1. 01

    Your data stays in your tenant.

    Assessment answers, device records pulled from Syxsense, and company info live in a tenant-isolated database row keyed to your account. They never leave your tenant on the H2Cyber side.

  2. 02

    We compose a prompt with three parts.

    A voice file (the H2Cyber writing voice), a task-specific instruction, and the task-specific input drawn from your data. The voice file is the same for every customer; the input is yours.

  3. 03

    The call runs through Amazon Bedrock inside our AWS account.

    We call Claude through Bedrock’s Converse API. Bedrock processes the prompt, runs the model, and returns a response inside our AWS account; prompts and outputs are not sent to Anthropic, not used to train models, and not stored or shared by Bedrock.

  4. 04

    We log the call, not the content.

    Our audit log records the task type, the model used, the latency, the cost, and the timestamp. The full prompt and response are kept only as long as needed to render the response in your UI; after that, only the structured output (e.g., the explanation text) is retained as part of your assessment record.

  5. 05

    You can see what was generated.

    Every AI-generated answer in the platform carries a “Why this number?” or “Why this advice?” reveal that lists the inputs the model used and the model that generated the answer. Settings → AI features shows your monthly compute spend and a link to the full audit log of every call we made on your behalf.

MODELS IN USE
CLAUDE HAIKU

Score translation.

The fastest, lightest model. Used for the 1–3 sentence popovers that explain what a score means in your business context. Optimized for low latency so the popover opens within a second.

CLAUDE SONNET

Guidance & forms.

The balanced model. Drives the take-action drawer prose and the form auto-fill answers, where length is moderate and citation discipline matters.

CLAUDE OPUS

Policies & reports.

The largest model. Used for the long-form deliverables: policy documents and the monthly report memo. We use Opus only where the prose has to hold up to regulator review.

WHAT THE PLATFORM WILL NOT DO
  • ·The platform will not roleplay as a security agency, a threat-intel feed, or a compliance auditor. It is a writing tool that pulls from your assessment data.
  • ·The platform will not make legal claims on your behalf. A generated policy document is a starting point, not a substitute for legal review. Every policy output carries a footer that says so.
  • ·The platform will not promise security outcomes. It will not say “this will protect you from ransomware” or “you are compliant.” It will tell you where your posture stands and what the next move is.
  • ·The platform will not fabricate a citation. If your assessment data does not support an answer, the answer will say so plainly.
  • ·The platform will not recommend specific vendor products outside the H2Cyber marketplace. It will not push you toward a vendor it has no relationship with.
QUESTIONS, CORRECTIONS, OR A REQUEST FOR YOUR AUDIT LOG

Email security@h2cyber.com. We respond within one business day. If you are a regulator or an underwriter asking on a customer’s behalf, we’ll route you to the right person and include a copy of the customer’s audit log on request, with their authorization.