A decision model is easier to defend than a generative one on data-protection grounds, but the advantage is narrower than it sounds. Jev does not stream prose, so there is no free-form output channel to leak into. It still reads a state, and a state can contain personal data. The architecture removes one exfiltration path; it does not remove the need for a data map.
What the architecture changes
A generative model produces text from your context. A Jev answer is a probability per option you defined. There is no generated sentence to smuggle a secret into, no second channel through which a record can be reconstituted, and no embedding of your content in prose.
That is a real reduction in attack surface. It is not a privacy guarantee. The model still sees the fields you send, and the answer can reveal something about them. The Hidden Risks of Jev study adapted membership, private-attribute, and internal-knowledge inference attacks and recovered sensitive information despite constrained typed outputs. The same study demonstrated backdoors by poisoning the training data of NanoJev, a local model with controllable training data. The hosted service was not the poisoning target, but the supply-chain lesson applies to open distributions and updates.
The contract stack
TypeSafe publishes the expected set of documents, and each answers a different question. The legal hub is a thin index; the actual terms live off-site.
| Document | Last updated | What it establishes |
|---|---|---|
| Terms of Use | 19 September 2026 | Site access only; a separate agreement governs the services |
| Master Customer Agreement | 23 September 2026 | The contract for services named in an order; license limits |
| Data Processing Addendum | 24 April 2026 | Customer is controller, TypeSafe is processor; breach and subprocessor terms |
| Privacy Policy | 19 November 2025 | No training on prompts; no sale or sharing of personal data |
| Acceptable Use Policy | 23 September 2026 | Prohibited content and conduct; not an exhaustive list |
Two details matter in procurement. The site terms are not the API contract; the MCA covers the services named in an order, and a separate written agreement overrides it. The DPA controls to the extent of any conflict with the other terms. Its Schedule I sets out the subject matter, nature, and purpose of processing, the types of personal data, and the categories of data subjects.
The DPA also commits to breach notification without undue delay and within 72 hours of becoming aware, and to reasonable advance notice before a new subprocessor gets access, with a 15-day objection window. Those are the clauses your counsel will ask about first.
Zero data retention is per-surface and enterprise-gated
The legal hub offers zero data retention for enterprise customers through sales. The enterprise page repeats the offer and adds SOC 2 Type II, requestable through the Trust Center. Neither page makes ZDR the default for every account.
Treat zero data retention as a fact to verify per surface, not a property of the model. If you call Jev through a gateway, the gateway's retention terms apply in addition to TypeSafe's. The data-retention article walks through the same check for hosted and local deployments.
The privacy policy supplies the training commitment: TypeSafe says it will not train or fine-tune AI or machine learning models on your prompts or other input, and will not disclose that input to third parties other than its service providers. It also says TypeSafe does not sell personal data or share it as those terms are used in the disclosure section. Those are vendor statements, not audit results. Put them in the contract file with the date you verified them.
Minimize before inference
The strongest control is not sending the data. Send the fields a question judges, not the whole record.
jev-pii-checker is a useful example of the tension. It scans text and files in three layers: thirteen typed category questions plus a three-level sensitivity score, regex extraction, and Intl.Segmenter name candidates judged by Jev. It masks values by default and can turn high-sensitivity findings into exit code 2. But its own README warns that scanned text is sent to TypeSafe's API and detection happens on their servers, so everything you scan leaves your machine. It recommends using it only on data you are allowed to hand to a third party, such as text you were going to send to a model anyway.
The accuracy is narrow: 100% gate accuracy on person-name, email-or-phone, and phone presence over an IBM corpus, and 22 of 24 sensitivity levels right. Borderline HR and disciplinary records flip between low and high when probabilities sit near 0.5. Organization names are out of scope, and there is no Luhn or passport format check.
Jev Bookmark Triage shows a cleaner data posture. It caps requests at 50 bookmarks, validates with zod, persists nothing, and defaults to a deterministic mock mode that sends nothing externally. In real mode, bookmark text goes to the API. The confidence gate routes items averaging below 0.6 to human review regardless of rank, which is the right use of confidence: a routing signal, not a privacy control.
Retention design
Store the decision, not the corpus. A workable record is the state hash, the question text and option order, the answers and probabilities, the model version, the confidence, and a timestamp. Keep raw content in a separate store with a short time-to-live, and restrict access to the audit path.
That separation lets you reconstruct a decision without keeping personal data indefinitely. It also makes the DPA's processing description concrete: the audit log is a different processing purpose from the raw content, and it should have its own retention period.
Do not put personal data in instructions. Instructions are configuration; state is the material being judged. The guardrails article explains why that boundary is also a security boundary. If a ticket body ends up in the instruction field, every request carries it, and every log of the instruction carries it too.
Jev Mail Triage is a good model for a local-first workflow. It sends the sender, subject, a shortened body, and link addresses to TypeSafe only for messages it assesses, keeps secrets in the macOS Keychain, and defaults to dry-run. Messages decided by its optional local gate are not sent at all.
A procurement checklist
- Sign the DPA, and attach Schedule I with your actual data categories.
- Get the subprocessor list and the notice mechanism in writing.
- Confirm the breach notification window and the security contact.
- Get ZDR in writing for the specific surface you will call, including any gateway.
- Request the SOC 2 Type II report through the Trust Center.
- Ask about residency, VPC, and on-prem options; the enterprise page routes these to sales rather than stating an answer.
- Pin the model version. A floating alias is not a reproducible processing record.
- Document the no-training commitment and the date you checked it.
The reproducibility article covers version pinning in more detail. The AUP is worth reading even when you are the customer: it bans reverse engineering, unauthorized scraping, circumventing security measures, and accessing other customers' data, and it applies to anyone you allow to use the service.
The decision-only shape is a genuine data-protection advantage. It is not a substitute for a DPA, a retention policy, or a data map. Verify the per-surface facts, minimize the state, and keep the audit record separate from the content.
