Birdie’s GenAI security

GenAI Models Used

Birdie employs a combination of Generative AI models to ensure optimal performance and security in its solution. The currently integrated models include:

Via API:

• OpenAI GPT

• Anthropic Claude

• Google Gemini

Self-hosted (on Birdie's infrastructure):

• Google Gemma

• Cohere (one model for embeddings and another for audio transcriptions)

• Whisper (audio transcriptions)

• DeBERTa (documentation)

• RoBERTa (documentation)

• multilingual-e5-large-instruct (embeddings, OpenVINO-quantized)

Base Models and Customization per Customer

Birdie does not develop proprietary foundation models. The self-hosted models listed above are open-source, pre-trained models that Birdie deploys and optimizes in its own infrastructure and adapts through theme descriptions and calibrated confidence thresholds, rather than retraining them on customer data.

All clients share the same pool of base models, but the experience and the outputs are tailored to each customer through:

• Custom parameterization for specific tasks, such as feedback classification per theme.

• Dedicated binary classifiers for each theme created in the customer's workspace.

• Dynamic adaptation through RAG, which ensures that LLM responses are always based on that customer's own data.

Model selection is also configurable per organization, so different customers can be served by different models for the same task.

GenAI Integration in the Solution

Generative AI technology is integrated into Birdie in various ways, including:

• Data processing via data pipelines

• Integration with RAG (Retrieval-Augmented Generation) in the application interface

GenAI Use Cases in Birdie

Birdie's Generative AI is mainly used for:

• Data enrichment: Automatic classification and extraction of relevant information. Tasks run in sequence (anonymization at ingestion, language detection, translation, sentence extraction, theme classification), and the original data is never overwritten.

• In-app assistant (RAG): Generating contextualized responses based on proprietary data, grounded in the customer's own feedback, metadata, and AI-generated enrichments such as themes, sentiment, date, channel, and product information.

For theme classification, Birdie uses a multi-stage cascade techniques, such as: rule-based query filters, semantic-similarity matching with a self-hosted multilingual embedding model, a DeBERTa-based Small Language Model (SLM), and finally a Large Language Model when the earlier stages are not confident. Each theme is evaluated independently as a binary decision.

Data Usage Policy and Model Training

Birdie ensures that data used in tests will not be used for refining or training AI models. Client data is never used for training, neither by Birdie nor by its model providers, which are contractually prohibited from using shared data for training or commercial purposes. The training process follows best practices, including:

• Base model updates only occur with an evidence-based trigger and human supervision.

• Internal models are trained only on public and synthetic data, with synthetic data generated from curated seeds that represent the kinds of feedback being simulated.

• Implementation of cross-validation techniques (10-fold cross-validation, train-validation-test).

• Per-theme parameter calibration instead of full fine-tuning on client data.

• Continuous LLM adaptation via RAG, allowing customization based on client feedback without affecting the global model.

• Models are evaluated using labeled samples from real customer domains, compared against reference labels produced manually by internal annotators or automatically by stronger models acting as "professors".

Security Measures and Guardrails

To ensure the safe use of Generative AI, Birdie implements several guardrails in its solution, including:

Prevention of Prompt Injection Attacks

• Using prompt engineering techniques to mitigate Prompt Injection.

• Implementing data cleaning, input sanitization, and filtering to reduce Indirect Prompt Injection, including hidden instructions embedded in user-generated content.

Access Control and Privacy

• Limited data access by design: The LLM has no autonomy to apply arbitrary filters to data.

• Sensitive data removal during ingestion: Anonymization is the first step of processing, applied before any form of storage, so the LLM does not have access to confidential customer information. Birdie combines regex substitution, rule-based heuristics, and self-hosted models, replacing matched content with a fixed [REDACTED] tag, which makes the transformation irreversible.

• AI vendor review: Providers go through an additional review step covering AI governance and compliance certifications (such as ISO 42001 and NIST AI Risk Management), model training and data usage policies, responsible development practices, and model system cards.

Hallucination Reduction

• Guiding responses based on real data through RAG, which grounds outputs in structured company data to minimize hallucinations and increase interpretability.

• AI-generated content is clearly labeled and kept separate from individual feedback in the interface.

• Models are not used for automated decision-making. They provide enrichment and contextual insights, keeping a human in the loop as the final authority.

• Every output records which model version was applied, when, and under which conditions, and all classifications can be inspected and corrected by users in the platform.

Conclusion

Birdie adopts a robust set of measures to ensure that Generative AI is used securely, effectively, and in alignment with industry best practices. For more information on our security and privacy policies, please contact our support team.