Responsible AI at Pappus
Last updated 2026-08-11.
Pappus practices human-controlled AI marketing: the AI plans, drafts, and schedules; a human approves every single publish. That split is enforced in the software — an approval gate the publisher itself refuses to bypass — not promised in a policy document. This page states the whole posture in one place.
Does a human approve everything Pappus publishes?
Yes — structurally, not as a setting. Every draft ends in an approval queue, the publisher refuses to run without an explicit human approval, each approval is HMAC-signed and audit-logged, and concurrent publish attempts serialize against the approval record. There is no autopilot mode to switch on.
How does Pappus keep AI marketing claims honest?
Substantiation Mode runs on every tier: claims in a draft are extracted and checked against your own approved-claims library. Unsupported claims are automatically hedged to language you can stand behind, or surfaced in the approval-only evidence panel so a human decides with the flag in view.
Can anyone verify an image came from AI?
Yes. Every AI-generated image and video carries a C2PA content credential signed with a real certificate — the manifest records how the asset was made, and anyone (a customer, a regulator, an auditor) can verify it with c2patool or contentcredentials.org.
Is customer data used to train AI models?
No. Your brand, your approved claims, and your content stay isolated to your private workspace, enforced by per-tenant row-level security in the database, and are never used to train models.
What does Pappus refuse to build?
No auto-DM, no auto-reply, no auto-connect, no scraping — on any plan, ever. These are not roadmap items we haven't gotten to; they are lines we've written into the product's engineering rules because growth tactics that impersonate human attention burn the trust a small business runs on.
What happens to your data when you leave?
Publishing pauses immediately on cancellation and you receive a complete export of upcoming drafts. A verified GDPR Article 17 deletion request is honored within 30 days, including deletion from external providers we use to operate the service.
Hold us to it
These behaviors are load-bearing product engineering, and several are contractual: the billing commitments are listed on pricing, the data terms in the privacy policy and terms, and security disclosures go through security.txt. If you believe any statement on this page is inaccurate, email support@pappus.tech — we treat that as a bug report against the page or the product, whichever is wrong.