How Veracly uses AI

What the AI does — and what it doesn’t

Once the deterministic engine has produced its findings, Veracly uses a large language model (Mistral AI, based in France) for four wording tasks only:

• plain-English explanations of each finding;
• the report’s executive summary;
• suggested remediation snippets (how to fix a finding); and
• translating that copy into your report language.

The AI has no role in any of the following:

• Detection. Accessibility checks (axe-core), the cookie / tracker and pre-consent analysis, policy-page presence, and the jurisdiction rule packs are all deterministic code. The AI never decides that something is a violation.
• Scoring. Every per-jurisdiction score and severity comes from the rules engine, not the model. Turn the AI off entirely and the findings and scores are identical.
• Decisions about people. No automated individual decision-making within the meaning of Article 22 GDPR is performed on any person.

If the AI is ever unavailable — a provider outage, or a per-scan/per-day cost cap is reached — the report still generates using Veracly’s own hand-written fallback copy. The scan result never depends on the AI.

Does Veracly send your website or your visitors’ data to AI?

A limited, finding-scoped slice — never your whole site, and never anything your visitors do. Here is precisely what is and isn’t sent to the model when a report is written.

What is sent, and only to phrase the report:

• the markup of the specific element that triggered a finding — for example the <img> tag missing its alt attribute — truncated to roughly one kilobyte, never the surrounding page;
• the finding type (e.g. “image-alt”, “pre-consent-tracker”);
• the URLs of the affected pages;
• aggregate verdict data — the counts per jurisdiction — plus your site’s country and (if you set one) industry, so the summary is written in context.

What is never sent to the AI:

• your pages’ content at large, or your site as a whole;
• anything your visitors enter, view, or generate — form submissions, account data, session content;
• the cookies, trackers, and storage the scan observes. Those are the evidence for the findings, and they are analysed entirely on Veracly’s own servers — they are not forwarded to the model.

Two further points that reduce what leaves our systems at all: explanations and fixes are cached by finding type, so once the text for “image-alt in German” exists, every later report reuses it and sends nothing new; and the AI calls run at report-writing time, after the scan — the crawl itself never talks to any AI provider.

Who processes it, and under what terms

The model is operated by Mistral AI, a provider based in France (EU), which acts as a contractual sub-processor for Veracly under a data-processing agreement. Mistral processes the finding-scoped data solely to return the requested text and, under its commercial terms, does not use it to train its models. Mistral AI is listed on our sub-processors page, and the full AI-processing disclosure — including retention and your rights — is in our privacy notice.

The same disclosure appears on every signed report Veracly issues, so a recipient holding a PDF can see the AI’s role without visiting this page.

Why we built it this way

A compliance report is only useful if you can trust the verdict. Keeping detection and scoring deterministic means a Veracly finding is reproducible — you, or a regulator, or your own developer can confirm it from the page itself, with no “because the AI said so.” The AI earns its place only where a black box is harmless: turning a terse rule ID into a sentence a non-specialist can act on. That division — deterministic where it counts, AI only for words — is deliberate.

Questions about our AI use or data handling: privacy@veracly.app.