AI cost and privacy
The score is arithmetic, so the AI is only ever used to parse, explain, summarise and converse. That keeps inference cheap and makes it easy to say exactly what leaves your network.
Where the AI is not
- The efficiency score, its pillars, strikes, bonuses, caps and bands are deterministic code with no model call.
- Progress quality is a deterministic score of task specificity, breakdown and stalls; an AI refinement may blend on top but the deterministic figure is the backbone.
- People signals (retention risk, loyalty, drifts) are weighted sums of evidenced factors, not a trained probability.
- Leave auto-approval rules, the blocker SLA, the communication policy and the presence integrity verdict are pure rules.
Where it is
| Essential | weekly and period summaries, the assistant, persona replies, voice; never budget-gated |
|---|---|
| Judgment | late-reason validity and blocker-reply intent, on the strongest configured model |
| Non-essential | the free-text fallback parser, machine-written standup detection, intent routing between bots; budget-gated and memoised |
Budgets and thrift
Every outbound provider call is counted per UTC day and persisted so restarts do not reset it; the dashboard shows the figure. Non-essential calls are refused once the daily budget is reached and their callers degrade to keyword and heuristic paths until midnight. Summaries and the assistant are never refused.
- Default budget: 300 calls per day (ai.daily_call_budget); 0 means unlimited.
- Deterministic classification results are memoised for six hours, so repeated questions, edited messages and retries do not burn calls.
- Provider calls time out at 20 seconds by default, and each response is capped in tokens by purpose: 600 for summaries and answers, 120 for routing, 200 for leave extraction.
- Spoken replies are capped at 1500 seconds of synthesised audio per day.
ai.daily_call_budget AI_HTTP_TIMEOUT_SECONDS
What reaches a provider
- For summaries: one person’s standups for the period and their totals.
- For the assistant: your question, the recent turns of your thread and a JSON snapshot of the data your role may see, unredacted.
- For agents: the single message being classified, with today’s date.
- For voice: the audio clip for transcription, and the reply text for synthesis.
- Never: HR document contents, source code, screens, email or anything outside the InRoots database.
Keeping it inside
Set the provider to Ollama and no standup text touches a public API. Outbound HTTP from the product is limited to your chat server, the AI provider host you configured and the integrations you enabled; no user-supplied URL is ever fetched. GeoIP lookups are local file reads against a local IP database on the host.
Accountability
- Every assistant question is audited as ai_query with who asked, not the response body.
- Every provider failover is audited as ai_provider_fallback.
- Every neural decision is stored with its features, probability, mode and outcome, and can be replayed.
- API keys for providers, chat workspaces, Jira, source-control and cloud accounts are encrypted at rest with a key you hold; the dashboard returns only whether a key is set.