At this point, it’s generally safe to assume that your vendors are using AI. How, and if, they’re telling you about it is a different question.
At Kevel, we don't dance around our AI utilization, in fact we are very open about it. Kevel uses AI, but what we care about most, and what we think should matter to you, is how we handle it.
We’ve been getting more questions from customers and prospects about Kevel’s AI practices, and we think that’s the right instinct. Here’s a straightforward answer, organized around the questions every company should be asking its vendors, including us.
Where exactly are you using AI?
“AI-powered” has become a nearly meaningless phrase. It can be used to describe anything from an autocomplete feature to a model making decisions about your data. Vague answers here are a red flag.
At Kevel, there are three general places where AI is being used to implement features within our services:
- Kevel is using AI to simplify ad operations in the Ad Server Management UI and in Kevel Console. The data accessed by AI includes details of campaigns, flights, ads, creatives, and products.
- Kevel is using AI in decision making to improve relevancy. We provide an internal per-customer model for this, built from historical event data. Alternatively, customers can provide their own AI-derived relevancy adjustments.
- Kevel is using AI to facilitate an expanded Reporting system that will provide more insights into performance data.
Kevel also offers an MCP server, which can be used by your own agents. Use of this feature is entirely under the customer’s control.
Additionally, Kevel’s Customer Success, Technical Support, and Engineering teams use AI tools to address issues faster. The data accessed may include diagnostic logs, event logs, and in some cases campaign, flight, ad and creative data.
At Kevel, we strive to be equally clear about where we’re not using it, because that matters too.
- Your data is NOT commingled across accounts.Each of customer’s data is logically separated and processed solely for the purposes of providing their services.
- Kevel does NOT sell, license, or otherwise monetize customer data.
- Your data will NOT be used to train Anthropic’s models, in connection with your use of the Kevel Services.
Are AI providers listed as Subprocessors?
Why it matters: AI tools are not the same as internal tools, yet many vendors treat them that way. Similarly to how they would approach the integration of Outlook, Jira, Github, etc., some vendors will quietly integrate a new AI provider without notifying their customers. . AI providers like OpenAI, Claude, Gemini, when used to interpret your data, have the ability to inadvertently access your data and leverage it to inform its models.
What to watch out for: Zero AI providers listed in the subprocessor list. Typically this means it's not being disclosed by the vendor, or staff are using AI providers without disclosing this internally.
Kevels approach: Kevel believes the best approach to ensure transparency is to treat AI providers the same as any other provider that touches customer data. When we add an AI Subprocessor, we update our documentation and notify our customers accordingly. This may not be the industry norm, but we believe that it should be.
Is there a clear strategy around which AI models you are integrating?
Why it matters: Most vendors rely on third-party AI providers to leverage the best-in-class, rather than building their own models. However, what is deemed best-in-class is changing. If vendors adopt every new tool that comes along,data flows, risks, and internal understanding become increasingly difficult to manage.
What to watch out for: The vendor’s list of AI providers, if they provide one, is very long and continuously growing. The vendor is unable to provide a clear indication of the strategy around its AI provider selection and integrations.
Kevels approach: Kevel has evaluated and selected Anthropic as its named Subprocessor, which has been documented as part of Kevel’s DPA. The Kevel team has also made the deliberate choice to limit the number of AI providers we use to ensure they are properly managed.
Will my data be used to cross-train AI models for other customers?
Why it matters: All vendors use customer data to train models, but many,especially those who facilitate demand), will leverage your unique data to cross-train models for their other customers.. This can have substantial impacts on your competitive position, privacy and data security.
What to watch out for: Vendors who are ambiguous about how data is used by their AI models, or emphasize the value of cross-customer training.
Kevels approach: Kevel does not ever use your customer data to train another customer's AI models. Each Kevel customer’s data is logically separated and processed solely for providing their unique configuration of Kevel services.
Will we be notified before AI providers are added?
Why it matters: You need to be informed by your vendor when they are integrating new AI providers when they are in the process of integrating them. And proper notification is not a sentence buried in a release note. Finding out your vendor has added a new AI processor after the fact, means your legal team was prevented from t employing its due diligence and raising concerns at the proper time, before the deployment.
What to watch out for: The vendor does not have a clear process for subprocessor changes or updates and there are no contractual obligations for the vendor to give notice.
Kevels approach: Kevel provides a clear process for changes, ensures advance notice of subprocessor changes, and engages in active dialogue with your legal team to explain usage and implemented guardrails.
The bottom line
Vendors should be carefully considering their AI strategy and their communications around it. Integrating AI tools just because everyone else is, without consideration is difficult to manage and increases risk to both the vendor and their customers.
Kevel approach to AI is deliberate: a small number of providers, in-depth understanding of the capabilities, meticulously integrated and communicated thoughtfully to our customers. Kevel’s goal isn’t to use as little AI as possible, it’s utilizing AI we can stand behind and explain clearly to the people trusting us with their data.
Two vendors can use the same underlying technology with extremely different approaches to the way they use that technology and how they relay information around it to their customers. When selecting a vendor, you should trust the one that provides transparency including naming its AI providers, sharing documentation around their approach, providing customers with advance notice of changes, welcoming these types of questions and actually providing you with appropriate answers. That’s the standard the Kevel team holds ourselves to and we hope becomes the norm across the industry.
Checklist of questions every company should be asking its vendors about AI utilization:
- Where exactly are you using AI?
- Which AI tools are you using, even if only used internally?
- Are your AI providers listed as Subprocessors?
- Is there a clear strategy around which AI models you are integrating?
- Will my data be utilized to cross-train AI models for other customers?
- Will we be notified before AI providers are added or changes are made?
- How do you think about AI risk, what safeguards do you have in place?
Disclaimer: The information provided on this blog is for general informational and educational purposes only and does not constitute legal advice.
Leslie Pierce-Connor
