How Spryng manages AI risk

Spryng offers a small number of optional AI features to help research and engagement projects work with stories:

  • transcribing audio;
  • translating text;
  • automatically redacting personal information;
  • analysis aids, such as sentiment and classification of responses;
  • language-model assistance, such as summaries and suggested drafts. This is optional and is turned off for your organization on request.

We don't build or train our own AI models. These features use commercial AI services from established providers, under their business terms. Our settings with every language-model provider do not allow them to train on our data, and their business API terms say they don't train on it.

Our approach

Our approach follows the NIST AI Risk Management Framework (AI RMF 1.0).

  • Govern. A written AI Risk Management Policy assigns clear owners: our CEO (accountable), our CTO (technical controls) and our Chief Privacy Officer / Data Protection Officer (privacy). Staff who work on AI features review the policy every year.
  • Map.
    • We keep an inventory of every AI service we use and the data it receives.
    • We review each provider before use and every year after that, including whether it keeps or trains on submitted content.
  • Measure.
    • We check output quality during development and after provider changes.
    • We monitor errors.
    • We track customer reports about AI output.
  • Manage.
    • AI output is labelled as machine-generated, and the institution's staff can review and edit it.
    • Redaction is an aid, not a guarantee.
    • We don't use AI to make decisions about individuals.
    • Language-model output is a suggestion that a person reviews before it is used or sent.
    • We design AI features to treat text from stories and documents as data, not as instructions. AI output can't change your data without a person's action.
    • If a problem arises, we can switch an AI feature off quickly, handle it under our incident response plan, and switch it back on only after review.

Your data

  • We send only what a feature needs, encrypted in transit.
  • Results stay in your project.
  • We don't use institutional data to train AI models.
  • Some providers keep API data for a limited period for abuse monitoring, as set out in their terms, and then delete it.
  • Redaction and the other AI features are separate settings. If you use sentiment or classification, keep redaction on as well.
  • Institutions can ask us to switch any AI capability off for their organization.

Connecting an external assistant (Analysis MCP)

On eligible annual plans, organizations can enable Analysis MCP so members connect an MCP-compatible assistant to studies they may already analyse. The connection is read-only. Authorization, redaction, and small-group privacy floors stay in Spryng. The open-source relay runs on the member's computer and forwards requests to Spryng; it does not train Spryng models on your content. If the assistant runs in the cloud, prompts and returned study data may go to that provider under that provider's terms — follow your institution's policy before connecting. Administrators can revoke tokens and control whether setup is available. Details: /spryng-analysis-mcp.

Local assistants and Analysis MCP

On eligible annual plans, when Analysis MCP is enabled for your organization, a member can connect an MCP-compatible assistant that runs a language model on their own computer. In that setup, study data returned by Spryng's read-only Analysis tools travels from Spryng to that computer, still subject to Spryng authorization and small-group privacy floors; inference stays on the machine or institution-approved runtime the member configured. This is separate from Spryng's optional built-in language-model features (such as summaries and other analysis aids), which use commercial AI services under the terms described above when they are turned on for your organization on request.

Questions or concerns

Email privacy@spryng.io.

Last updated: 31 October 2026