Privacy Policy

OutfIT is a business tool used by IT, HR, and administrators within an organization that licenses it. The people whose data appears in OutfIT are primarily employees, new hires, and administrators of that organization. It is not a consumer product and has no public sign-up: access requires signing in with a Microsoft work account.

Where OutfIT processes personal data on your organization’s behalf, your organization is the data controller and Convergent acts as a processor under its agreement with you.

We collect and process the following categories of personal data:

• Account & identity data — name, work email/UPN, department, manager, role, and group memberships, sourced from Microsoft Entra ID via single sign-on.
• New-hire & onboarding data — personal and job details entered during intake, including personal email and phone, mailing address, start date, role type, hardware and software selections, and background-check status.
• Uploaded documents — files you attach to requests, tasks, or onboarding records (for example invoices, contracts, or supporting PDFs and images).
• Content you submit to AI features — meeting notes, questions to the Task Center copilot, and document text you choose to have summarized or extracted (see Use of AI).
• Operational & audit data — request and task history, approvals, provisioning results, and security/audit logs, along with technical metadata such as correlation IDs used for troubleshooting.

OutfIT does not sell personal data and does not use it for advertising.

We use personal data only to operate the service, specifically to:

• Route app requests and new-hire onboarding through their approval and provisioning steps.
• Create and manage Microsoft accounts, licenses, and group memberships in your tenant.
• Maintain the app inventory and governance records.
• Provide optional AI-assisted summaries, extraction, and copilot answers where enabled by your administrator.
• Secure the service, prevent abuse, keep audit trails, and meet legal and compliance obligations.

OutfIT includes optional features that use artificial intelligence, powered by Anthropic’s Claude models accessed through the Anthropic API. These features are enabled by your administrator and include:

• Summarizing manager meeting notes.
• The Task Center copilot (“Ask Convergent”), which answers questions from the tasks you can already see and proposes actions for you to confirm.
• Extracting structured facts from spend and contract documents you provide.
• Generating renewal-negotiation briefs from structured contract facts only (no free-text personal content).

When you use these features, the relevant text you submit is sent to Anthropic to generate the result. AI output is treated as a draft or proposal for human review — it does not make final decisions on its own, and proposed actions run through the normal, audited paths only after a person confirms them. We do not use your data to train third-party AI models.

These AI features are a general productivity aid, not a crisis, medical, legal, or emergency service, and should not be relied on as one.

We share personal data with the service providers below strictly to operate OutfIT. Each processes data on our or your organization’s behalf under its own contractual and security obligations. We do not share personal data with third parties for their own marketing.

We may also disclose data where required by law or to protect the rights, safety, and security of our users and the service.

We retain personal data for as long as needed to provide the service and to meet your organization’s legal, audit, and record-keeping requirements, then delete or anonymize it.

Uploaded files are deletable. When you delete a document or attachment, or delete the request, task, or onboarding record it belongs to, the underlying file is removed from storage. Document uploads are held in a private storage container with no public access; files are served only through short-lived, access-controlled links.

• Access requires Microsoft single sign-on; there are no anonymous accounts.
• Role-based access controls limit who can see sensitive fields and take administrative actions.
• Document storage is private by default and encrypted in transit and at rest by our hosting provider.
• A strict Content Security Policy, per-request nonces, rate limiting, and audit logging protect the application surface.

No system is perfectly secure, but we design OutfIT to minimize the risk and to keep it under your organization’s control.

Depending on your location and your organization’s policies, you may have the right to access, correct, delete, or restrict the processing of your personal data, or to object to certain processing. Because your organization controls the data in its OutfIT tenant, please direct such requests to your organization’s IT or HR administrator, who can action them or forward them to us.

You can reach us directly at the address below with any privacy question or request.

We may update this policy as the service changes. When we do, we will revise the effective date above and, where changes are material, provide notice through the product or to your administrator.

For questions about this policy or your personal data, contact us at privacy@convergentep.com.