Verastance’s Use of AI and Modeling – FAQs
1. Do you use AI or machine learning in your products?
Yes, AI and machine learning are core to how we deliver performance. Our in-house ML models power targeting, audience segmentation, addressability, and optimization across Retargeting, Lookalikes, Optimized CRM, and Performance CTV. We build and own these models ourselves, which means we control how they work and how your data is handled inside them.
2. Do you use our data to train your models?
Only to make your campaigns perform better. We use brand-provided data, event signals, and licensed data to train and calibrate models, always under contractual, privacy, and security controls. Modeling operates on aggregated, pseudonymized, or derived signals. Direct identifiers only come back into play where they’re needed for activation and measurement on your behalf.
3. Do you send our data to public AI tools like ChatGPT or Claude?
No. Your data, and your customers’ data, stay out of public AI tools entirely. We don’t send it to public LLMs for training, general use, or any other purpose. Internal policy prohibits sending confidential customer or non-public information into any unapproved generative AI tool.
4. So where does AI inference actually happen?
Inside our walls. Production inference runs through Verastance-hosted or Databricks-served model boundaries, not through external API calls to Anthropic, OpenAI, or any other public service. We use tools like Claude in controlled development contexts only, and never with raw brand PII.
5. How do you prevent my data from influencing a competitor’s campaigns?
This is something we take seriously by enforcing explicit anti-conquesting guardrails. Brands can’t query each other’s data, and no single brand’s data can materially drive another brand’s modeled audience. The hard cap we apply is 5% and is enforced at the platform level.
6. Do your models use race, gender, or other sensitive characteristics?
No. We don’t use protected characteristics (such as race, religion, or health) as model features, and brands can’t introduce latent sensitive targeting through our models either. If campaign-level parameters like that exist, they’re applied post-model during normal campaign operations and are separated from the modeling logic itself.
7. How do you handle bias and model quality over time?
We validate models against documented criteria, monitor for drift and degradation, and review aggregate outcomes to catch unintended skew before it affects performance. Sensitive characteristics are excluded from model features by design, and brand campaign settings are kept separate from model logic so neither one bleeds into the other. This isn’t a one-time audit. It’s part of how we maintain model quality across the lifecycle.
8. Can engineers access and use raw data in development?
No. Raw PII is prohibited in local development, local notebooks, and local test environments. R&D uses synthetic, hashed, or pseudonymized data.
9. How do you control data leaving your environment?
We restrict external data egress and prohibit ad hoc, SQL-based transmission of brand data to external vendors or LLMs. We’re also rolling out validator-based controls, including PII detection, for data crossing our boundary to non-standard external entities.
10. Do you use third-party AI vendors in production?
Rarely, and never without controls. Our default is to run production inference through Verastance-hosted or Databricks-served model boundaries, not external vendors. When a third-party capability is approved, it has to operate inside that same controlled serving environment and is subject to contractual and technical guardrails that prevent the vendor from training on your brand data.
11. Are your AI workflows safe in a multi-tenant environment?
Yes. We operate a multi-tenant Graph, but brand isolation is built into how it works. Anti-conquesting rules, suppression logic, and output guardrails ensure that one brand’s data doesn’t surface in another brand’s workflows. The only exception is explicitly approved aggregated benchmark views, where no individual brand’s data is identifiable.
12. How do you handle deletion, opt-out, and suppression with AI systems?
We run a unified suppression framework that combines brand-provided suppression and deletion files with direct consumer requests. Suppressed identities are excluded from modeling, targeting, and activation. The suppression carries through the whole workflow. Consumers from California may also opt out of using their data in AI systems here.
13. How do you stay compliant with GDPR and similar international privacy requirements?
Our AI and ML usage is scoped to marketing and measurement, not high-impact eligibility decisions, which is a key GDPR distinction. We use aggregated and pseudonymized signals where possible, support deletion and suppression workflows, and enforce geographic ingestion controls like blocking non-US CRM records and filtering non-US pixel traffic in prohibited contexts.
14. Is your AI used for credit, insurance, employment, or similar high-impact decisions?
No, and it’s contractually prohibited. Our AI and ML is limited to marketing and performance workflows. High-impact eligibility decisions are outside the scope of what we do and what our Terms of Service permit.
15. How do you govern and review new AI features?
Nothing ships without a review process. Before any new AI tool, workflow, or API goes live, we evaluate it for unintended downstream effects, document the architecture, review any external calls it makes, validate guardrails, and require stakeholder sign-off on non-deterministic outputs. We also maintain formal AI governance artifacts aligned to ISO-style risk management standards. This is how we make sure new capabilities don’t introduce risk to your campaigns or your data.