Privacy, security, and data use
ROSI is designed to provide fast, contextual assistance while respecting your organization’s security, privacy, and compliance requirements.
Data access and permissions
ROSI does not bypass or expand user permissions. All responses are generated using the same role-based access controls enforced in Perform.
- Users only receive information they are authorized to access.
- Admin-level ROSI capabilities are available only to users with the appropriate privileges.
- Employee and manager experiences (such as Review Writer) follow the same permission model.
For information about enabling ROSI or managing access, see Access, roles, and enablement.
Live data usage
ROSI retrieves information directly from your live Perform environment when responding to a request.
- Review, goal, feedback, check-in, and profile information reflects current system data.
- ROSI maintains conversational context within an active session to support follow-up questions.
Protection of sensitive information
ROSI is designed to avoid returning high-risk personal data.
- ROSI will not return Social Security Numbers or other highly sensitive personal identifiers.
- Only the minimum data required to answer a request is retrieved.
- Sensitive fields are excluded from responses even when a user’s role permits access.
Logging and auditability
ROSI interactions are logged to support operational monitoring, auditing, and troubleshooting.
- Requests and responses are logged with timestamps and user identifiers.
- Sensitive fields are masked or excluded from logs.
- Audit records support review of administrative activity without exposing raw data.
Session handling and encryption
ROSI operates within Rival’s secure infrastructure.
- User sessions are authenticated using time-limited, encrypted session tokens.
- All data transmitted between systems is encrypted in transit.
- Cached or stored data is encrypted at rest.
Compliance and data protection
ROSI operates within Rival’s established security and compliance framework.
- Access controls follow least-privilege principles.
- Operational access is restricted to authorized personnel.
- Rival supports data-protection requirements such as GDPR and CCPA.
Troubleshooting and support
If ROSI is unable to complete a request, contact Rival Support. Error details are captured in system logs to support investigation and resolution.