Legal

AI Ethics Policy

The principles and practices that govern how Germinate.ai builds and runs AI.

Version 1.0 · Effective January 12, 2026

1. Purpose

This policy states how Germinate.ai builds and runs AI responsibly. It sets the principles we hold ourselves to and the practices that make those principles real. It is written for the customers evaluating us and for our own team.

Our position is simple: AI should do useful work on a customer's business without creating new harm to that business, its people, or the people it serves. This policy is how we keep that commitment concrete instead of decorative.

2. Scope

This policy applies to everyone who builds, deploys, operates, or sells Germinate AI agents — employees, contractors, and partners — and to every agent and feature on the Germinate platform. It works alongside our AI Accuracy & Bias Disclosure, our security commitments, and any signed customer agreement, which governs in the event of conflict.

3. Our Principles

Human accountability. AI assists people; it does not replace their judgment on decisions that matter. For consequential outcomes, a qualified person stays responsible and in the loop. We do not deploy agents to make autonomous decisions about individuals.

Honesty about capability. We describe what our agents can and cannot do in plain terms. We do not oversell accuracy, hide limitations, or let a demo imply a guarantee. If we are unsure an agent is fit for a use, we say so.

Privacy and data stewardship. Customer data is the customer's, and it is always kept private. We connect to it to do the agreed work, isolate it from every other customer, and use it only for the purposes the customer authorized. We never use one customer's data to benefit another, and we never train shared models on customer data — your data stays yours, full stop.

Fairness. We treat bias as a real risk, especially where agents touch people. We test for disparate outcomes where feasible, apply extra scrutiny to people-affecting uses, and decline work we cannot do fairly.

Security and safety. Agents run on systems that hold data customers cannot afford to leak. We build for tenant isolation, least-privilege access, and safe failure — an uncertain agent should escalate, not improvise.

Transparency and explainability. Customers should understand what an agent does, what data it uses, and how to check its work. We favor agents that show their sources over agents that ask to be trusted.

Accountability for outcomes. Because we build and run the agents, we own the results with the customer. When something goes wrong, customers get a person who is responsible — not a support queue and a shrug.

4. What We Will Not Do

Some uses are out of bounds regardless of commercial appeal. Germinate will not knowingly build or operate agents that:

Make autonomous, unreviewed decisions that materially affect a person's employment, finances, health, legal standing, or access to a service.
Deceive people into believing they are interacting with a human when a clear disclosure is warranted.
Conduct unlawful surveillance, scrape data in violation of rights or terms, or process personal data without a lawful basis.
Generate deliberately deceptive, defamatory, or manipulative content, or content that harasses or endangers people.
Discriminate against people on protected characteristics, or evade laws designed to prevent such discrimination.
Operate in safety-critical settings without controls and human oversight appropriate to the risk.

Where a request is ambiguous, we escalate it rather than guess.

5. How We Put This Into Practice

Through the build lifecycle

Intake. Every proposed agent is screened for ethical risk — does it touch people, sensitive data, or consequential decisions? Higher-risk agents get a fuller review before work begins.
Design and build. Intended use, data sources, limitations, and required human checkpoints are documented. People-affecting agents require a fairness review and a named human reviewer in the workflow.
Testing. Agents are tested against representative cases for accuracy, and for disparate outcomes where feasible. Failures block deployment until resolved or explicitly accepted with mitigations.
Deployment. Agents launch with monitoring, defined escalation paths, and the human checkpoints designed in. Customers are told the agent's intended use and limits.
Operation and review. Deployed agents are monitored; issues are logged and triaged; and each agent is re-reviewed on the cadence in Section 8 or sooner when the business or the model changes.

6. Alignment with the NIST AI Risk Management Framework

This policy is organized around the four functions of the NIST AI Risk Management Framework (AI RMF 1.0), informed by the NIST Generative AI Profile (NIST-AI-600-1, July 2024). We use the framework as our governance discipline. We do not claim certification, which NIST does not offer.

NIST AI RMF function	How Germinate addresses it
Govern	This policy, the named policy owner, the prohibited-use list, and the review cadence establish the culture, accountability, and rules that run across everything else.
Map	Intake and design document each agent's purpose, data, affected people, and risk level, flagging people-affecting and high-risk uses before any build.
Measure	Testing for accuracy and — where feasible — fairness, with results recorded and unresolved problems blocking deployment.
Manage	Monitoring, escalation paths, human checkpoints, incident handling, and scheduled re-review keep risk managed throughout each agent's life.

7. Reporting a Concern

Customers, partners, or team members who have a concern about how a Germinate agent is built or behaving can raise it at ethics@germinate.ai. We take concerns seriously, look into them, and follow up. Good-faith reports are welcomed, not penalized.

8. Review and Updates

We review this policy at least annually and whenever our technology, practices, or legal obligations change materially. The version and effective date at the top reflect the current edition.

This policy describes our principles and practices. It is not a warranty, and nothing here overrides the terms of a signed agreement between Germinate and a customer.