# Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation This site has an agentic ask interface you may use to query the documentation dynamically by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://trust.impact.com/index.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. --- # Data Security & Privacy Securing our customers' data is core to impact.com's DNA and has always remained our top priority. Discover our advanced security and privacy measures to safeguard our users and data.
๐Ÿ“œ CertificationsThe international standards our platform is independently audited against.Certifications
โš–๏ธ Compliance ProcessesConsent, your data rights, and our GDPR commitment.Compliance Processes
๐Ÿ” Security FeaturesHow we protect the platform, from encryption to access controls.Security Features
โš ๏ธ Stay Safe from ScamsHow to verify official communications, spot common scams, and report suspicious activity.Stay Safe from Scams
๐Ÿ“‡ Contact & PoliciesReach our security team and find our published policies.Contact & Policies
## AI at impact.com
๐Ÿค– AI Trust CenterHow we build, govern, and protect the AI behind our platform, including per-feature model cards and, our sub-processor list.AI Trust Center
# Certifications Our platform's data security certifications provide peace of mind that your information is protected.
๐Ÿงพ SOC 1 Type IIimpact.com prioritizes data security with SOC 1 type II certification. This independent verification assures clients of the effectiveness of our internal controls over financial reporting.
๐ŸŒ ISO/IEC 27001:2022Your data is secure at impact.com. We maintain ISO/IEC 27001:2022 certification, an internationally recognized standard for information security management. This means we have robust security practices in place to protect your data when you use our SaaS subscriptions.
๐Ÿ’ณ PCI-DSS Level 4impact.com is a PCI-DSS Level 4 Merchant and maintains its certifications through annual SAQ completion. This standard is designed to protect payment card information from unauthorized access, use, or disclosure.
# Compliance Processes We understand the importance of earning and maintaining user trust. We are committed to upholding the highest standards of data security and privacy. This section outlines our comprehensive compliance processes designed to safeguard your information. ## Consent and opt-out Recruit participants ethically with impact.com's informed consent management. Our platform empowers researchers to obtain clear consent through customizable forms, while giving participants full control over their data with easy unsubscribe and opt-out options. ## Right to be forgotten At impact.com, we prioritize user privacy and empower you to control your data. We adhere to the "Right to Be Forgotten" principle, allowing you to request the complete removal of your personal information from our systems and those of our subprocessors. To request that your data be deleted, or modified, please log a ticket on our support portal. ## Data portability impact.com offers complete data transparency. Our platform empowers you to easily access and view all information associated with your user profile. This ensures you stay informed and in control of your data. {% hint style="success" %} ### Privacy commitment and GDPR compliance At impact.com, we process your personal data in strict compliance with (General Data Protection Regulation) GDPR standards. We collect only what is necessary for our services based on legal basis and never sell your information; data is shared only with essential sub-processors or as required by law under rigorous safeguards. You retain full rights to access, rectify, erase, or object to the processing of your data at any time by contacting . {% endhint %} # Security Features Every layer of the platform is protected by a multi-layered security program. ## Application security
๐Ÿงช Recurring penetration testingWe prioritize user data security. We leverage independent, third-party experts to conduct comprehensive penetration testing of our web applications, mobile apps (Android/iOS), and underlying APIs. This rigorous testing process identifies and addresses potential vulnerabilities before they can be exploited.
๐Ÿ”’ Data encryption at restWe safeguard your information with industry-leading encryption. All databases and backups are encrypted at rest using AES-256, the strongest block-level storage encryption standard available. This advanced technology ensures your data remains protected even in the event of a security breach.
๐Ÿงฑ Secure development processAdhering to a secure development process is crucial for safeguarding digital assets. Our commitment to robust security includes a meticulous focus on addressing the OWASP Top 10 security risks. This ensures the highest standards of security in our software.
๐Ÿ“‹ Audit trail and loggingFor enhanced security, impact.com maintains a central logging platform that meticulously tracks all user access and actions within the system. These detailed logs are securely stored for a minimum of one year, allowing us to thoroughly investigate any potential security incidents and ensure ongoing accountability.
## Data networking & security
๐Ÿ—๏ธ Secure infrastructureAt impact.com, your data benefits from the utmost protection. We leverage top-tier cloud service providers known for their rigorous security practices. All data centers storing impact.com's data hold certifications like SOC 1, SOC 2, SOC 3, and ISO 27001. These certifications demonstrate their commitment to comprehensive security controls, data confidentiality, and ongoing system integrity.
๐Ÿ“ก Monitoring & alertingAt impact.com, we take a proactive approach to security. Our sophisticated monitoring and alerting systems are constantly on guard, scanning our network for anomalies and suspicious activity. This vigilance allows us to identify and address potential threats before they can escalate, ensuring the continued protection of your data.
๐Ÿ’พ Continuous backupsimpact.com prioritizes data redundancy for complete peace of mind. We employ a comprehensive backup strategy, including continuous backups for ongoing data capture and weekly full backups. This robust system allows us to restore your data to any point within the past year, minimizing downtime and ensuring business continuity in the event of any unforeseen circumstances.
๐Ÿ” Data encrypted in transitWe prioritize the security of your information during transit. We leverage industry-standard HTTPS with TLS 1.2 or higher encryption to safeguard all data transmissions between your device and our web application. This robust encryption technology ensures that your sensitive data remains protected from unauthorized access.
## Restricted access & authorization
๐Ÿ—‚๏ธ Data segregation & securityWe prioritize the strongest data security practices. We implement strict coding standards and rigorous code reviews to ensure customer data is logically separated within our system. Additionally, each customer record has a unique identifier, further enhancing data security and preventing any potential mix-ups.
๐Ÿ”‘ Access management & controlsAt impact.com, we take your data privacy seriously. We adhere to the "principle of least privilege," ensuring that access to customer data is limited to authorized employees who require it for their specific job duties. Additionally, all system access is meticulously logged, providing an extra layer of accountability and security.
โš™๏ธ Thorough system managementAt impact.com, we prioritize a smooth user experience. We have comprehensive change management controls in place, ensuring all system changes that directly impact our customers undergo rigorous planning and clear communication. This proactive approach keeps you informed and minimizes disruption to your workflow.
## Company security
๐ŸŽ“ Mandatory trainingAt impact.com, we prioritize data security. All new employees undergo comprehensive security awareness training within their first month, equipping them with the knowledge to protect user data.
๐Ÿชช Employee background checksAt impact.com, we prioritize user trust and security. All new employees undergo a thorough background check before their first day, ensuring a reliable and trustworthy team environment for protecting your data.
๐Ÿ“ฃ Responsible disclosureAt impact.com, we take security very seriously. We believe in working together to maintain a secure environment for everyone. If you believe you've identified a potential vulnerability in our systems, we encourage you to disclose it responsibly through our dedicated program. By visiting our responsible disclosure page, you can report the issue directly to our security team.
# Stay Safe from Scams To protect our community, we've compiled a comprehensive guide to identifying legitimate communications from our companies and avoiding online scams. Use these answers to verify all official channels, understand common fraud tactics, and learn how to report suspicious activity.
What are the official communication channels for impact.com and its related companies? Our employees will only contact you through official company channels. We do not use platforms like WhatsApp or Telegram for official communications. Please use the information below to verify websites, platform URLs, support centers, and social media accounts. **impact.com** * Website: * Platform URLs: [app.impact.com](https://app.impact.com), [api.impact.com](https://api.impact.com), [go.impact.com](https://go.impact.com), [pc.impact.com](https://pc.impact.com), [pxa.impact.com](https://pxa.impact.com), [talent.impact.com](https://talent.impact.com/) * Support: [help.impact.com](https://help.impact.com), [tshelp.impact.com](https://tshelp.impact.com) * Social media: [LinkedIn](https://www.linkedin.com/company/impactdotcom), [Instagram](https://www.instagram.com/impactdotcom), [Facebook](https://www.facebook.com/impactdotcom1), [YouTube](https://www.youtube.com/c/impactdotcom), [TikTok](https://www.tiktok.com/@impactdotcom) **Trackonomics** * Website: * Platform URLs: [app.trackonomics.net](https://app.trackonomics.net/) * Support: via main website * Social media: [LinkedIn](https://www.linkedin.com/company/trackonomics), [X (Twitter)](https://x.com/TrackonomicsLtd), [Facebook](https://www.facebook.com/Trackonomics-Ltd-189823258626928) **SaaSquatch** * Website: * Platform URLs: [app.saasquatch.com](https://app.saasquatch.com/) * Support: [docs.saasquatch.com](https://docs.saasquatch.com/) * Social media: [LinkedIn](https://www.linkedin.com/company/saasquatch) **Pressboard** * Website: * Platform URLs: [manage.studiostack.com](https://manage.studiostack.com/) * Support: [help.pressboardmedia.com](https://help.pressboardmedia.com/) * Social media: LinkedIn (via main website) **Affluent** * Website: * Platform URLs: [learn.affluent.io](https://learn.affluent.io/) * Support: via main website * Social media: LinkedIn, X (Twitter), and Facebook accounts are open but not active. **Activate by impact.com** * Website: not applicable * Platform URLs: not applicable * Support: not applicable * Social media: [X (Twitter)](https://x.com/activatesocial_) (account is open with no activity). Facebook, Instagram, and LinkedIn accounts are closed. **Bloglovin** * Website: * Platform URLs: not applicable * Support: [bloglovin.freshdesk.com](https://bloglovin.freshdesk.com/) * Social media: [Instagram](https://www.instagram.com/bloglovin/), [Pinterest](https://www.pinterest.com/bloglovin/) (accounts are open but not run by the impact.com social team).
Can you explain the common "Prepaid Task" scam? This scam involves fraudsters impersonating impact.com or affiliate marketing companies to offer enticing part-time "jobs." **How the scam unfolds** 1. **Initial contact.** Scammers contact you on WhatsApp, Telegram, or social media with an offer for simple online tasks (for example, liking content or writing reviews). 2. **Building trust.** They give you small tasks and make small payments ($5 to $50) to appear legitimate, often collecting personal information under the guise of payment formalities. 3. **Escalation.** They introduce higher-paying tasks that require you to "invest" your own money upfront, promising high returns (for example, 20% or more). 4. **The investment.** You are directed to a fake platform where you make investments. Fake profits are shown to encourage you to invest more. 5. **The loss.** Your funds are suddenly frozen for fake reasons (for example, "taxes" or "penalties"), and the scammers demand more money. Eventually, they cut off all communication, and your funds are lost. **Red flags to watch for** * Unsolicited job offers via messaging apps from unknown contacts. * Promises of unusually high returns with little to no risk. * Any requirement to pay upfront for an earning opportunity. * Pressure to act urgently on an investment. * Directions to use unknown platforms for tasks. * Any communication outside of official company channels. * Requests for cryptocurrency payments.
What should I do if I suspect a scam and how do I report it? If you suspect someone is impersonating impact.com or our related companies, please email us immediately at so we can investigate. You should also report the crime to the appropriate authorities in your country: * **United States:** report cyber crime to the [Internet Crime Complaint Center (IC3)](https://www.ic3.gov/). * **United Kingdom:** report scams to the [National Cyber Security Centre](https://www.ncsc.gov.uk/) or to [Action Fraud](https://www.actionfraud.police.uk/). * **European Union:** find methods to report for your country on the [Europol website](https://www.europol.europa.eu/). * **Australia:** report cyber crimes to the [Australian Cyber Security Centre](https://www.cyber.gov.au/). * **Canada:** report cyber crimes to the [Canadian Anti-Fraud Centre](https://antifraudcentre-centreantifraude.ca/).
How does impact.com handle governance and oversight for scam prevention? Our commitment to transparency, ethical communication, and user protection forms part of our broader corporate governance and compliance strategy. Our approach includes: * **Continuous monitoring.** We actively monitor fraud reports and digital impersonation trends. * **Policy and reporting.** We maintain fraud prevention policies aligned with ISO/IEC 27001:2022 standards and report activity through our governance committees. * **Internal protocols.** All employees undergo ongoing security and compliance training, including but not limited to identifying and reporting impersonation attempts, secure handling of external communications, and participation in regular phishing and awareness exercises. * **External collaboration.** impact.com actively collaborates with regulatory authorities and social media platforms to investigate and remove fraudulent accounts that misuse our brand identity.
What are the key policies I should know to identify a legitimate interaction? To protect you, we adhere to the following rules without exception: * Our employees will only contact you through the official channels listed above. * We do not use WhatsApp, Telegram, or any other unofficial messaging platforms for official communications. * We will never request confidential information or bank details outside of our secure signup process on our official platform URLs. * We do not accept cryptocurrency payments in any of our companies.
What are the major red flags of a scam? Be on high alert if you see any of these warning signs: * Unsolicited job offers received via messaging apps (WhatsApp, Telegram) from unknown contacts. * Requests for personal information early in the communication. * Any requirement for you to pay upfront for an earning opportunity. * Promises of unusually high returns with little to no risk. * Pressure or a sense of urgency to act quickly on an investment. * Directions to use specific, unknown platforms for tasks or investments. * Any communication happening outside of our official channels. * Requests for payment in cryptocurrency or other unusual methods.
How do I report scam accounts directly to Telegram or WhatsApp? **To report scams on Telegram** * Send screenshots and information to the channel @notoscam. * Send email abuse reports to . * Use the **Report spam** button within group chats. **To report scams on WhatsApp** 1. Open the chat with the user or group you want to report. 2. Select **More** (or the three dots), then **Report**. 3. Optionally, check the box to block the user and delete the chat history. 4. Select **Report** to confirm.
What are some additional security resources and best practices? * Verify the source before engaging with any job offers or requests for personal information. * Be wary of offers that seem too good to be true, especially those received via social media platforms. * Never share personal or financial information with unverified parties. * Stay informed about the latest scam tactics and educate those around you. * Use strong, unique passwords for all your accounts. * Enable two-factor authentication wherever possible. * Keep your software updated to protect against known vulnerabilities.
# Contact & Policies Our security team is always happy to answer any questions you may have about impact.com's security measures. Whether you have a general inquiry or a specific concern, we're here to help. * Security inquiries: * Data access, modification or deletion requests: [log a ticket on our support portal](https://app.impact.com/support/portal.ihtml) * Compliance and GDPR requests: * [Responsible disclosure program](https://impact.responsibledisclosure.com/hc/en-us) ## Policies * [Privacy policy](https://impact.com/privacy-policy/) * [Terms of use](https://impact.com/terms-of-use/) * [Accessibility policy](https://impact.com/accessibility-policy/) * [Modern slavery statement](https://impact.com/legal/IRL_Modern_Slavery_Statement.pdf) (PDF) * [PAIA manual](https://impact.com/legal/PAIA_manual_impact_radius_SA.pdf) (PDF) # AI Trust Center Welcome to the impact.com AI Trust Center, the single source of truth for how we build, govern, and protect the AI behind our platform. This Trust Center covers in-platform AI (features inside impact.com) and external AI integrations via Impact MCP (connecting your own AI client to your account), and where those paths differ. {% hint style="success" %} **Your data is yours, always.** You stay in control of your information, and our AI only ever works on the data you're already entitled to see. impact ai recommends. You decide. {% endhint %} ## Our vision: human-led, AI-powered We believe artificial intelligence is a tool to augment human expertise, not replace it. Our job is to handle the busywork, surfacing the signal in billions of data points, so the brands, agencies, and partners who power the partnership economy can focus on what they do best: building strategic, creative, and profitable relationships. This is Partnership Intelligence: a data-first approach to AI built on a unique dataset of billions of commerce transactions and media insights. It moves you beyond simply viewing dashboards to uncovering opportunities, proving incremental growth, and making decisions that are accurate, accountable, and tied directly to measurable revenue. ask impact, our intelligent assistant, is the front door to that capability, a collaborative teammate designed to help you work smarter, not harder. ## The pillars of trust Building and keeping your trust is our most important job. Everything we do rests on four pillars.
๐Ÿ”’ Privacy & Your DataYour data is your data. We deliver powerful insights while protecting your privacy.Privacy & Your Data
๐Ÿ›ก๏ธ Security & ComplianceOur AI is built on the same enterprise-grade security that protects the entire platform.Security
๐Ÿ” Transparency HubWe show our work: clear AI labeling, model cards, and auditability.Transparency
๐Ÿงญ Accountability & Human OversightHumans stay in control. Our AI recommends; you decide.Accountability & Human Oversight
## Responsible by design Trust isn't a feature we add at the end. It's engineered in from the first line of code. Every AI capability at impact.com moves through a Responsible-by-Design lifecycle: {% stepper %} {% step %} #### Governance review Before a project starts. {% endstep %} {% step %} #### Privacy and accessibility Built into the architecture. {% endstep %} {% step %} #### Adversarial security testing Before launch. {% endstep %} {% step %} #### Human-in-the-loop monitoring Continuous, afterward. {% endstep %} {% endstepper %} See how we build AI responsibly in [Responsible by Design](/ai-trust-center/responsible-by-design-our-methodology). *** *Have a question we don't answer here?* [*Reach our team*](/ai-trust-center/resources-and-faq#have-more-questions)*.* # Privacy & Your Data This Trust Center covers in-platform AI (features inside impact.com) and external AI integrations via Impact MCP (connecting your own AI client to your account), and where those paths differ. {% hint style="success" %} ### Our data commitments * **Used only to serve your request.** When you use an AI feature, your data is used only to generate a response for you or return tool results, never repurposed for unrelated ends. * **Your data is never mixed.** Both in-platform AI and MCP respect the same strict, user-based authorization that governs the entire platform. You can only query the data you're already entitled to see, and your data is never commingled with, or accessible to, other customers. * **You're in control.** In-platform AI features are opt-out. MCP stays off until your account enables it, and each user explicitly approves every AI client. In both cases, you only access data your role already allows, and you can decline use of your data to train our models. {% endhint %} ## Provider handling **In-platform AI:** Our AI provider processes your data only to deliver the feature, under [**strict security and privacy requirements**](/data-security-and-privacy/security-features), and is contractually prohibited from using it to train their models. **Impact MCP:** impact.com does not forward MCP tool data to LLM providers. If your AI client or model provider retains or processes prompts and tool results, that is governed by your agreement with them. ## Data flow ### Platform AI features Here's what happens when you use an AI feature: {% stepper %} {% step %} **You make a request** Your request travels over an encrypted connection (TLS 1.2+). {% endstep %} {% step %} **We gather context** We securely retrieve only the data needed to answer, from your account (for analytics) or our knowledge base. {% endstep %} {% step %} **Secure AI processing** The request and context are sent to our AI provider on secure cloud infrastructure and used only for this request. Your data stays within impact.com's cloud environment. {% endstep %} {% step %} **You get a response** A response is generated and returned to you. {% endstep %} {% step %} **Nothing lingers with the provider** The provider does not retain your request data for its own purposes and does not use it to train its models. {% endstep %} {% endstepper %} ### Impact MCP Here's what happens when you connect an AI client to mcp.impact.com: {% stepper %} {% step %} **You authorize your AI client** You sign in with your existing impact.com credentials and approve the client over an encrypted connection (TLS 1.2+). The client receives a scoped token limited to MCP access. {% endstep %} {% step %} **Your client calls a tool** Your AI client (for example, Claude, Cursor, or VS Code) sends an authenticated tool request to the mcp.impact.com gateway. The trust boundary sits at this gateway: everything on your side is your environment, and everything on ours is impact.com production infrastructure. {% endstep %} {% step %} **We validate and return results** The gateway checks your authorization, enforces your existing impact.com permissions, and runs the requested capability against our backend services. Tool results are returned to your AI client, not to a model provider. {% endstep %} {% step %} **Generative processing stays on your side** Your AI client may send prompts and tool results to your chosen model provider. That processing is governed by your relationship with that client and model provider. impact.com does not forward MCP tool data to LLM providers on your behalf. {% endstep %} {% step %} **We log for security** We log MCP call metadata needed for security and operations, such as who called, which capability was used, when, and the outcome, and retain those logs for at least 90 days. We do not log full tool request or response payloads in production. {% endstep %} {% endstepper %} *** For how we secure this data, see [Security](/ai-trust-center/security). For how we explain what the AI is doing, see [Transparency](/ai-trust-center/transparency). # Security Our AI is built on the same enterprise-grade security foundation that protects the entire impact.com platform. We believe innovation and security move together, never one at the expense of the other. {% hint style="success" %} **Proactive AI governance:** Our legal and compliance teams actively track emerging global AI regulation, so our practices stay ahead of requirements rather than racing to catch up. {% endhint %} ## Key security measures In-platform AI and MCP are subject to our rigorous, multi-layered security program. Our platform, including its AI features, is regularly audited by independent third parties. For an in-depth view of our certifications, see [Certifications](/data-security-and-privacy/certifications).
๐Ÿ”’ EncryptionYour data is protected in transit (TLS 1.2+) and at rest (AES-256).
๐Ÿ”‘ Access controlsOur AI is not a backdoor. It fully respects the Role-Based Access Controls (RBAC) in your account: if a user can't see certain data, neither can the AI acting for them.
๐Ÿ›ก๏ธ Content filtering & misuse preventionFor in-platform AI features, we apply advanced safety filtering to Gen AI inputs and outputs (including Google's Model Armor) to guard against harmful, misleading, or abusive content.
๐Ÿ“ก Monitoring & alertingIn-platform AI features are covered by continuous monitoring, with automated abuse protection and alerting feeding our security and reliability processes.
๐Ÿงช Rigorous testingBefore release, every in-platform AI feature goes through internal code review, integration testing, independent penetration testing by white-hat experts, and adversarial testing to identify and mitigate misuse.
# Transparency We believe in showing our work. This page explains how we keep our AI understandable and verifiable, so you always know when you're using AI, how it works, and where its answers come from. ## Model cards Think of a model card as a "nutrition label" for an AI feature: a short, readable document covering what it does, how it works, the data it uses, and its limitations. We're committed to publishing a model card for our AI features, following recognized industry standards.
๐Ÿ’ฌ Conversational AI & Content GenerationAnthropic Claude and Google Gemini models, orchestrated through a multi-agent system, powering the ask impact chat interface.Model Card Conversational AI
๐Ÿค Partner Recommendation EngineOur proprietary machine-learning model for discovering new partners.Model Card Partner Recommendation
๐Ÿ“ง Newsletter GenerationDrafts partner-facing marketing newsletters, including subject lines, email body content, and tone variants.Model Card Newsletter Generation
Social Listening Sentiment SummarySummarizes the dominant sentiment around your listener keywords from monitored social posts.Model Card Social Listening Sentiment Summary
## Our AI partners (sub-processors) For our in-platform AI, we partner with leading technology providers that meet our strict security, privacy and accountability standards. Every sub-processor goes through our vendor vetting process before integration. {% hint style="info" %} **Google:** We use Google's infrastructure, including Anthropic's Claude models accessed within Google Cloud Vertex AI. Anthropic is not a separate sub-processor and does not receive your data. Our agreement with Google contractually restricts the use of your data and aligns with Google's AI data governance. Learn more at [Google's AI Principles](https://ai.google/responsibility/principles/). {% endhint %} ## In-product transparency We build transparency directly into the product experience:
๐Ÿท๏ธ Clear AI identificationA unique, consistent icon marks every feature and response generated by AI, so you always know when you're working with AI.
๐Ÿ”— In-product traceabilityWherever possible, AI-generated insights include citations or links back to the source data inside your impact.com account, so you can verify any answer for yourself.
# Model Card Conversational AI This model card describes the conversational AI behind ask impact, our chat interface for understanding your questions and generating text-based responses and content. | **AI technology** | Anthropic Claude (primary): Claude Opus 4.8 via Google Cloud Vertex AI, with automatic fallback to other Claude models when needed. Google Gemini (supplementary): select features, available as an alternate provider. | | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Model type** | Large Language Model (LLM), orchestrated through a multi-agent system | | **Provided by** | Anthropic (via Google Cloud Vertex AI); Google (via Google AI / Vertex AI) | | **Classification** | Generative AI | ## Description This is the core generative AI layer behind ask impact. A routing model interprets your message and directs it to a specialized agent for the task. Each agent uses a large language model to understand natural language, reason over retrieved context and tool results, and generate human-like responses. We combine model output with real-time data from your account, impact.com documentation, and trusted marketing resources to answer questions and generate content such as newsletters and partner-facing copy. ## Intended use **Primary use cases** * Answering natural-language questions about your performance analytics. * Providing industry expertise and best practices from trusted marketing resources. * Generating content for newsletters based on your prompts and account data. * Offering step-by-step guidance on how to use the impact.com platform. * Recommending partners or programs to invite or apply to. * Helping publishers create product reviews, comparisons, roundups, and other promotional content. * Surfacing publisher insights such as social content search and website/social metrics. * Live support escalation: transferring to a live agent or logging a support ticket when appropriate. **Out-of-scope uses** * Making final, binding business decisions without human review. * Providing financial, legal, or other professional advice. * Generating harmful, unethical, or offensive content. This is strictly prohibited and filtered. ## How we use your data * **Training data.** These models were pre-trained by Anthropic and Google on vast, public datasets of text and code. **They are not trained on your impact.com data.** * **Answering your questions.** When you send a message, we provide the model with task-specific, real-time context from your account only, for example your account performance data for analytics queries or relevant help documentation or marketing knowledge. That context is used only to generate a response to your immediate query. * **Data privacy commitment.** In line with our internal governance and Google's Vertex AI data governance, your data is **never** used to train or improve the model, is **not** stored by the model after your query completes, and is **never** shared or mixed with other customers' data. * **Safety screening.** User prompts and model responses are scanned by Google Model Armor to detect and block content that violates our usage guidelines. ## Limitations & ethical considerations * **Potential for inaccuracy.** Like all LLMs, these models can occasionally produce inaccurate information or "hallucinate." Use AI-generated insights as a starting point and verify critical data against your own records. We include in-product disclaimers as a reminder. * **Routing and tool dependencies.** Responses depend on which agent handles your request and what data or tools are available for your account type. Some capabilities are limited to brand or partner users. * **Governance.** Use of this AI is governed by our internal AI governance framework and [responsible-by-design practices](/ai-trust-center#responsible-by-design), which mandate Privacy, Fairness, Transparency, Accountability, Explainability, and Safety. *** See also: [Model Card: Partner Recommendation Engine โ†’](/ai-trust-center/transparency/model-card-partner-recommendation) and [Model Card: Newsletter Generation โ†’](/ai-trust-center/transparency/model-card-newsletter-generation) # Model Card Partner Recommendation This model is an automated matchmaking tool that helps you discover new partners most likely to be productive for your program. | **AI technology** | impact.com Partner Recommendation Model | | ------------------ | -------------------------------------------------- | | **Model type** | Machine Learning (ranking & recommendation system) | | **Provided by** | impact.com | | **Classification** | Predictive AI | ## Description This is a proprietary machine-learning model developed by impact.com. It analyzes thousands of data points from across our partnership ecosystem to identify and recommend new partners who are most likely to be relevant and productive for your specific program. ## Intended use **Primary use cases** * Suggesting new traditional and influencer partners who haven't yet joined your program. * Helping you discover opportunities filtered by country, industry, and promotional method. * Accelerating program growth by surfacing high-potential partners. **Out-of-scope uses** * Treating recommendations as guarantees of future performance (they are suggestions). * Using the tool as the sole factor in partnership decisions; human judgment remains essential. ## How we use your data * **Training data.** The model is trained on aggregated, fully anonymized data from thousands of successful partnerships across the entire platform: non-personal signals such as partner attributes, historical performance trends, and program similarities. * **Privacy-preserving design.** The model identifies platform-wide patterns of what makes a partnership succeed. It does not use or expose any other brand's or partner's private performance data to generate your recommendations. Your own data is used only to match you to those anonymized trends. ## Limitations & ethical considerations * **Fairness.** Built on our Responsible-by-Design methodology, the model includes business rules to promote fairness (for example, verifying a partner's willingness to work with brands of different sizes), so partners have equitable opportunity to be discovered on their merits. * **Feedback loop.** When you act on a recommendation (inviting, archiving, or declining a partner), you provide an implicit signal that helps refine future suggestions for your program. * **Governance.** Use of this AI is governed by our internal AI governance framework and [responsible-by-design practices](/ai-trust-center#responsible-by-design), which mandate Privacy, Fairness, Transparency, Accountability, Explainability, and Safety. *** See also: [Model Card: Conversational AI โ†’](/ai-trust-center/transparency/model-card-conversational-ai) and [Model Card: Newsletter Generation โ†’](/ai-trust-center/transparency/model-card-newsletter-generation) # Model Card Newsletter Generation This model powers the newsletter generation feature, which generates partner newsletter content (subject lines, HTML email bodies, and tone variants) from your prompts and program context. The same endpoint and model are also used when you draft newsletters through our conversational AI. | **AI technology** | Google Gemini | | ------------------ | -------------------------- | | **Model type** | Large Language Model (LLM) | | **Provided by** | Google (via Google AI) | | **Classification** | Generative AI | ## Description This is a specialized generative model for drafting partner-facing marketing newsletters. It writes professional email copy (including subject lines, HTML body content, calls to action, and multiple tone variants) as your brand speaking directly to partners. When your brief requires it, the model can use URL context to read specific web pages you provide (for example, a campaign landing page) and ground the newsletter in that content. It does not perform open web search. The feature is available to brand accounts. Requests made via ask impact chat call the same implementation. ## Intended use **Primary use cases** * Drafting partner newsletter emails announcing promotions, program updates, or seasonal campaigns. * Generating subject lines and HTML email body content from your prompts. * Producing multiple tone variants (for example balanced, enthusiastic, or formal) for the same brief. * Grounding copy in specific page content when you provide a URL to reference. **Out-of-scope uses** * Sending emails on your behalf without your review and approval. * Making final marketing or partnership decisions without human review. * Providing financial, legal, or other professional advice. * Generating harmful, unethical, or offensive content. This is strictly prohibited and filtered. ## How we use your data * **Training data.** This model was pre-trained by Google on a vast public dataset of text and code. **It is not trained on your impact.com data.** * **Generating your newsletter.** When you use the newsletter generation feature, we provide the model with your prompt and, where available, your program name and description from your account. If you include additional context, tone guidance, or example copy in the request, that is passed to the model for that generation only. If you direct the model to reference a specific URL, it may retrieve content from that page to inform the draft. ## Limitations & ethical considerations * **Potential for inaccuracy.** Like all LLMs, this model can occasionally produce inaccurate information or "hallucinate." Review all generated copy, including facts, dates, offers, and legal lines, before sending to partners. We include in-product disclaimers as a reminder. * **Human review required.** Generated newsletters are drafts. You are responsible for reviewing, editing, and approving content before it is sent to partners. * **Governance.** Use of this AI is governed by our internal AI governance framework and [responsible-by-design practices](/ai-trust-center#responsible-by-design), which mandate Privacy, Fairness, Transparency, Accountability, Explainability, and Safety. *** See also: [Model Card: Conversational AI โ†’](/ai-trust-center/transparency/model-card-conversational-ai) and [Model Card: Partner Recommendation Engine โ†’](/ai-trust-center/transparency/model-card-partner-recommendation). # Model Card Social Listening Sentiment Summary This model powers the Social Listening AI Summary feature, which generates a short executive summary of the dominant sentiment around your listener keywords from monitored social posts and their engagement metrics. The summary appears on the Social Listening insights dashboard alongside chart-based sentiment visualizations. | **AI technology** | Google Gemini (via Vertex AI) | | ------------------ | ----------------------------------- | | **Model type** | Large Language Model (LLM) | | **Provided by** | Google (via Google Cloud Vertex AI) | | **Classification** | Generative AI | ## Description This is a specialized generative model that drafts concise, dashboard-ready sentiment summaries for Social Listening. Given a listener's configured keywords and a set of relevant social posts (post text plus engagement metrics such as likes, comments, shares, saves, reach, impressions, and views), it identifies the dominant sentiment related to those keywords (positive, negative, or neutral) and briefly explains the primary drivers behind it. Social Listening insights gather the keyword-matching posts for the selected listener and time range, request a summary, and show the returned text as the "AI Summary" on the dashboard. The model does not perform open web search; it summarizes only the posts and keywords supplied in the request. The per-post sentiment charts on the same dashboard are produced separately and are not generated by this summary model. ## Intended use **Primary use cases** * Generating a short executive summary of sentiment around Social Listening keywords for a selected time range. * Highlighting the dominant sentiment (positive, negative, or neutral) and the main engagement-weighted drivers for a dashboard tile. * Helping brand users quickly interpret keyword-related conversation themes without reading every post. * Complementing non-AI chart metrics such as overall sentiment distribution, sentiment by channel, and sentiment over time. **Out-of-scope uses** * Making final brand, partnership, crisis, legal, or enforcement decisions without human review. * Automatically taking actions against partners or creators (for example outreach, suspension, or contractual remedies) based solely on the summary. * Providing legal, regulatory, financial, or reputational counsel. * Serving as the system of record for individual post sentiment (post-level sentiment is handled separately; this model produces an aggregate narrative summary only). * Analyzing content outside the posts and keywords supplied, or performing open web search. * Identifying private individuals or exposing personal data in the summary. The prompt instructs the model not to include personal information. * Generating harmful, unethical, or offensive content. This is strictly prohibited and filtered. ## How we use your data * **Training data.** The underlying Gemini models were pre-trained by Google on large public datasets of text and code. Impact does not fine-tune these models on your impact.com data for this feature. * **Generating your summary.** When Social Listening requests an AI Summary, we provide the model with the listener's keywords and a sample of relevant social posts (text and engagement metrics) for the selected time range. Only the keywords and posts are included in the prompt. The generated summary may be stored with Social Listening insights so it can be shown again without regenerating until a refresh is required. * **Human feedback.** Users can override individual post sentiment labels in Social Listening, separately from this summary. Regenerating the summary after listener or data changes may produce a new narrative based on the posts supplied at that time. ## Limitations & ethical considerations * **Potential for inaccuracy.** Like all LLMs, this model can occasionally misread tone (including sarcasm or emoji-heavy posts), over-weight high-engagement outliers, or give an incomplete picture when keyword matches are thin or ambiguous. Summaries are qualitative, decision-ready drafts, not definitive measurements. Review the underlying posts and chart metrics before acting on a summary. * **Human review required.** The AI Summary does not replace human judgment about brand reputation or partner behavior. You remain responsible for interpreting Social Listening insights and deciding any follow-up. * **Scope and sampling.** The summary is limited to the posts and keywords supplied for the listener and time range. Evidence may be incomplete if few posts mention the keywords, if matches are generic, or if engagement metrics are missing. When evidence is insufficient, the model is instructed to stay neutral or inconclusive. * **Governance.** Use of this AI is governed by our internal AI governance framework and [responsible-by-design practices](/ai-trust-center#responsible-by-design), which mandate Privacy, Fairness, Transparency, Accountability, Explainability, and Safety. # Accountability & Human Oversight This page relates to our in-platform AI features. AI is a powerful tool, but people are ultimately accountable for how it's used. We build meaningful human oversight into every AI feature and take responsibility for our systems and their impact across the entire AI supply chain. {% hint style="success" %} ### Humans stay in control * **You decide.** Our AI recommends, surfaces insights, and drafts content, but meaningful decisions stay with people. There are clear pathways to escalate to a human for review. * **Human-in-the-loop.** We keep humans in-, on-, and off-the-loop as appropriate, including people manually auditing AI interactions. {% endhint %} ## How we evaluate quality, reliability, and fairness
๐Ÿค– Automated testing & auditsWe run automated tests that compare AI answers against expected results to catch drift and quality regressions, and automated systems continuously review AI interactions to improve the product experience.
๐Ÿ‘ User feedbackIn-product feedback mechanisms (such as thumbs up/down) let you flag issues, which feed directly into our improvement process.
๐Ÿ” Manual auditsOur teams routinely review AI interactions and user feedback to monitor performance and catch problems automated checks might miss.
## Fairness & equity We're dedicated to building AI that treats people fairly. We design for inclusion and accessibility, curate representative data, and test features for equitable performance across different user groups. Detailed fairness and bias audits are part of our testing process. See [Responsible by Design](/ai-trust-center/responsible-by-design-our-methodology). {% hint style="info" %} **How MCP differs.** In-platform AI is built around recommendations you review. MCP is built around authorized access: impact.com returns tool results to your AI client; it does not generate responses or decisions for you. You approve each client connection, and we enforce your existing permissions and audit every call. {% endhint %} ## Regulatory adherence & end-to-end accountability We hold our AI to global legal and regulatory standards, and we hold our third-party providers to the same governance principles we hold ourselves. Accountability doesn't stop at our platform boundary; it extends across every vendor in the AI supply chain. # Responsible by Design: Our Methodology ## Responsible by Design Methodology We embed our principles into every stage of the development lifecycle, not just at the end. This is what "Responsible-by-Design" means in practice. Every in-platform AI capability at impact.com moves through these six phases. {% stepper %} {% step %} ### Requirements * **Governance & risk review:** a pre-spec review with senior stakeholders before resources are committed. * **Technological intentionality:** we ask, "Is AI the right tool for this problem?" and only commit to AI when its benefits demonstrably outweigh the risks. * **Centralized oversight:** all AI projects are tracked in a single space for full visibility across the company. {% endstep %} {% step %} ### Design * **AI identification:** clearly label every AI interaction for the user. * **User control & feedback:** opt-outs, settings, and feedback channels built in. * **Inclusive & accessible design:** features usable by everyone, including people who rely on assistive technologies. * **Privacy-by-design architecture:** data minimization and robust authorization built into the foundation. {% endstep %} {% step %} ### Implementation * **Robust audit trails:** log significant AI actions on a per-user basis for accountability. * **Secure coding:** protect the system and its data from vulnerabilities. {% endstep %} {% step %} ### Testing * **Intensive security testing:** vetted internally and by external white-hat experts. * **Fairness & bias audits:** check for performance disparities and apply safety tooling (such as Google's Model Armor). {% endstep %} {% step %} ### Deployment * **Transparent documentation:** model cards, help articles, and specs for different audiences. * **Continuous monitoring:** track performance and drift, with humans in the loop. {% endstep %} {% step %} ### Maintenance & continuous improvement * **Iterative feedback loops:** feedback from monitoring, real user interactions, and testing flows back into the lifecycle. * **A learning culture:** an active internal AI community shares knowledge and challenges our assumptions, so we keep improving and stay ahead of emerging risks. {% endstep %} {% endstepper %} # Resources & FAQ Have questions? We have answers. Below are the questions we hear most often about AI at impact.com. For details on specific AI features, head to the Help Center. ## Frequently asked questions
What AI features does impact.com offer? AI powers a growing set of capabilities across our platform, from the ask impact assistant to content generation and partner recommendations. For the full, current list, see [AI Features Explained](https://help.impact.com/other/reference-documentation/impact.com-ai-features-explained).
Which AI models and providers power your AI features? **In-platform AI:** We combine third-party LLMs from Anthropic and Google (via Google Cloud Vertex AI) with impact.com's own machine-learning models. **Impact MCP:** impact.com does not choose or host your model provider. Generative processing happens between your AI client and your chosen vendor, under your agreement with them.
Do you use my data to train AI models? Today, your data is not used to train foundation models. Our providers are contractually prohibited from training their models on it, and where model improvement applies, you stay in control and can opt out. For MCP, we do not use your traffic to train models.
Where does my data go, and does the provider keep it? Your data is processed within impact.com's secure cloud environment. Our AI providers process it only to deliver the feature, do not retain it for their own purposes, and do not use it to train their models. For MCP, tool results are returned to your client, and we do not send MCP data to LLM providers.
Is my data mixed with other customers' data? No. AI features respect the same strict, user-based authorization as the rest of the platform. Your data is never commingled with, or accessible to, other customers.
Is personal information sent to the AI, and can it be anonymized? We minimize personal information in AI processing and only include what's necessary.
Does the AI make automated decisions? Our Recruitment Agent automates matchmaking to help you discover new partners most likely to be productive for your program using anonymized platform patterns. You can customize or disable this agent at any time. See [Recruitment Agent](https://help.impact.com/brand/what-would-you-like-to-learn-about/platform-features/review-partner-applications/recruitment-agent). ask impact, our chatbot, is a separate feature. It provides information, recommendations, and generated content that a person reviews and acts on.
How much human oversight is there? We keep humans in-, on-, and off-the-loop, including manual audits of AI interactions and clear pathways to escalate to a person.
How do you make sure answers are accurate, reliable, and fair? Through automated testing, user feedback, manual audits, and fairness testing. See [Accountability & Human Oversight](/ai-trust-center/accountability-and-human-oversight).
Can I tell when content was generated by AI? Yes. AI interactions are clearly and persistently labeled, and AI-generated insights include citations back to source data where possible.
What protects against harmful or abusive AI content? We apply advanced safety filtering to inputs and outputs from within our platform (including Google's Model Armor), backed by continuous monitoring and automated abuse protection.
What monitoring and alerting is in place? In-platform AI features are covered by continuous monitoring, automated abuse protection, and alerting that feeds our security and reliability processes.
Can we turn AI capabilities off, or opt out? Yes. AI features are always opt-out. MCP is opt-in, and your account remains in control.
What legal terms govern your use of third-party AI providers? Our providers operate under enterprise agreements with contractual security, privacy, and data-use restrictions, aligned to their platform data governance (for example, Anthropic and Google on Google Cloud Vertex AI).
Are AI features covered by your certifications? Yes. In-platform AI features are covered by the same platform certifications, including SOC 1 Type II and ISO 27001, and by our GDPR and CCPA compliance programs.
What is Impact MCP? Impact MCP is a secure connector between your AI client (such as Claude, Cursor, or VS Code) and selected capabilities in your impact.com account. It returns tool results to your client. It is not an in-platform AI feature. Learn more at [Impact MCP](https://mcp.impact.com).
Where does my data go when I use MCP? Tool results are returned to your AI client only. impact.com does not forward MCP data to LLM providers. If your client or model provider processes that data further, that is governed by your agreement with them.
## Have more questions? If you cannot find an answer, contact [support](https://impact.com/contact/support/). *** *This Trust Center is reviewed and updated as our AI capabilities and the regulatory landscape evolve.*