How we use AI

How Capstan uses AI, and what it never does

The category slaps "AI-powered" on software that scores, ranks and screens people. We do the opposite, on purpose, and we would rather write down exactly where the line is than leave you to guess.

There are two halves to this, and both matter. Capstan has genuinely useful AI: an assistant your people can ask, and a small set of workspace agents that do routine coordination. It also refuses, by construction, to let any AI pass judgment on a person. A stance that only stated the refusal would sound like a company with nothing to offer; a stance that only sold the assistant would sound like every other vendor. Here is both, and every bit of the useful half is off until a workspace deliberately turns AI on.

What the assistants do

There is an admin assistant that answers plain-language questions from aggregate figures a caller could already see, such as headcount by department. To answer, it sends a small amount of aggregate, non-sensitive context, for example the organisation name and per-department headcounts, to OpenAI, our named sub-processor. OpenAI’s API does not use that data to train its models, and the sub-processors page names exactly who receives what. No personal record is sent to an outside model, and none is ever used to train one.

For everyone else there is Pilot, the in-app assistant. It answers three kinds of question: how to use Capstan, what your workspace’s own published policies say (quoted back with a citation to the policy and version), and your own data, your leave balance, a payslip’s period and date, who your manager is, what is waiting on you. Those personal answers are composed straight from the record with no model call at all, under your own access, so no personal value ever reaches a model. Pilot can file exactly one thing for you, your own leave request, and only after you fill in the details and confirm. It writes nothing else.

The agents, and the lines they cannot cross

A workspace can staff a few named agents that bundle a trigger, an assistant answer and a scheduled job: an onboarding coordinator, a reminders helper, a reporting and attrition helper. The useful part is ordinary. The important part is what they are stopped from being, and the stops are in the database, not in a prompt. No agent can rate, rank, promote or terminate anyone, because the capability registry is physically unable to hold a capability that evaluates a person. No destructive or money-moving capability can be given to an agent at all. Any change to a record needs an explicit human confirmation, so an agent proposes and a person decides.

Every agent is off until an administrator turns it on, carries a named accountable person, has a kill switch that stops it at once, and keeps a read-only activity trail. It acts under that accountable person’s own access and can never exceed it. An agent assists the people function; it does not sit in judgment of anyone in it.

What our AI never does

No AI in Capstan evaluates your people. It never scores, ranks, rates or screens a person. It never makes, or recommends, a decision about a person: not hiring, not performance, not pay, not promotion, not an exit. A human makes every one of those decisions. The product does the work, and the person confirms it.

What the software itself determines, an entitlement, an access decision, a line in a letter, comes from a rule you can read, never from a model’s guess. There is no attrition score, no sentiment analysis, and no algorithmic candidate screening anywhere in the product, because those are exactly the places where software quietly decides a person’s prospects, and we will not build them.

Why you can believe it: it is built this way

This is architecture, not a promise we ask you to take on trust. The agent capability registry is pinned so it cannot hold a capability that judges a person, and an agent can only ever be composed of capabilities from that registry. A record-changing action needs a confirmation to run. Reporting composes so a shared view can only ever narrow who sees what, never widen it, and small groups are suppressed so no individual is re-identified from an aggregate. The whole AI layer is dark until two gates are set, a platform credential and a per-tenant opt-in that is off by default, so a workspace that does nothing has no AI running at all.

If we ever ship an AI feature that would make a line on this page untrue, the line changes first. That is a rule we hold ourselves to (it is Gate 2 in how this site is built). The fuller version of the argument sits in the manifesto, the automation it powers is on the automation page, and the controls behind it are on the security page.

Questions with complete answers

Does any AI screen candidates or score employees?

No. Nothing in Capstan uses AI to evaluate people: no attrition scoring, no sentiment analysis and no algorithmic candidate screening. There is one optional assistant a workspace can turn on, and it answers only from aggregate figures a caller could already see, sent to OpenAI, which does not train on the data. Nothing scores, ranks or screens a person.

What does the optional assistant actually do?

When a workspace turns it on, the assistant answers plain-language questions from aggregate figures a caller could already see, such as headcount by department. It reflects only what that person is allowed to see, it does not act on anyone’s behalf, and it can be wrong, so it tells you to check anything important against the record. It is off until an administrator connects a provider.

Is our data used to train an AI model?

No. No personal record is sent to an outside model or used to train one. The optional assistant sends only aggregate, non-sensitive figures (for example, organisation name and per-department headcounts) to OpenAI to answer a question, and OpenAI’s API does not use that data to train its models. The sub-processors page names who receives what.

What is Pilot, the in-app assistant, allowed to do?

Pilot answers how to use Capstan, what your workspace’s own published policies say (quoted with a citation to the policy and version), and your own data such as your leave balance, a payslip’s period and date, your manager and what is waiting on you. The personal answers are composed straight from the record with no model call, under your own access, so no personal value reaches a model. The one thing Pilot can do for you is file your own leave request, and only after you fill in the details and confirm. It writes nothing else, and it is off unless your workspace has turned AI on.

Can an AI agent change records or make decisions about people?

No agent can rate, rank, promote or terminate anyone: the capability registry is pinned in the database so it cannot hold a capability that evaluates a person. No destructive or money-moving capability can be given to an agent at all, and any change to a record needs an explicit human confirmation, so an agent proposes and a person decides. Every agent is off by default, has a named accountable person and a kill switch, acts only under that person’s own access, and keeps a read-only activity trail.