//////////// May 2024

Keeping Your Data Secure in
the Age of Artificial Intelligence:
Qualtrics’ Commitment to Privacy,Compliance, and Security

//////////// MayMay2024
2024

INTRODUCTION
At the core of our focus on delivering
world-class experience management
capabilities lies a persistent emphasis on
security and privacy. We ensure thatthese vital elements are woven into ourframework at every stage, starting fromthe exploration of ideas in research anddevelopment to the final implementationof our code.
While these standards have long been
integral to our practices, we areintensifying our investment in them. With
the introduction of new generative AI
technologies, our goal is to infuse every
aspect of our products, processes, andpolicies with robust privacy and security
protocols.
To ensure a seamless adoption, we are
retraining many of our teams to align withthese expanded standards andexpectations. Concurrently, we areclosely monitoring the evolving landscapeof government, regional, and industry
regulations. This preparedness allows us
to swiftly adapt and comply as necessary.
Rest assured, our unwavering dedication
to safeguarding your data andmaintaining the highest level of privacy
and security remains steadfast as wecontinue to advance with new, innovative
solutions.

02Ensuring Data Privacy and Diversity
in Qualtrics Artificial Intelligence/
Machine Learning (AI/ML) Models
At Qualtrics, our portfolio of AI/ML models is both diverse and comprehensive,
encompassing various models, including Large Language Models (LLMs). To maintain thehighest standards across all first-party models, we adhere to a set of stringent guidelines:
1. Data Integrity and Security: All of our products follow Qualtrics security
standards and Qualtrics maintains relevant certificates related to data protection
and security.
2. Anonymized and Aggregated Datasets: During model training, we utilize
anonymized and aggregated datasets, ensuring that individual or brand datacannot be traced back to its source. This approach safeguards privacy while
enabling us to derive meaningful insights.
3. Stringent Data Access Committee Approval: All data anonymization andaggregation processes and tools undergo internal Data Access Committee
approval. This committee takes into consideration privacy, security, and legal
requirements, ensuring compliance with relevant regulations.
4. Thorough Anonymization Process: To safeguard sensitive information, we useautomated tooling to remove personally identifiable information (PII) andbrand-specific references across various modalities, including brand, product, andlocation references.
5. Promoting Diversity in Training Data: Our aggregation techniques ensure that
our models are trained on a diverse range of data. We avoid over-representing
specific brands or industries, not only as a privacy best practice but also toenhance model generalization.
6. Periodic Fairness and Bias Reviews: After training, our models undergo
additional fairness and bias reviews at regular intervals by internal product teams
in conjunction with legal and security personnel. This step allows us to address any
potential biases and ensure equitable outcomes.
By adhering to these standards, we maintain a strong commitment to data privacy, security,and diversity, empowering our AI/ML models to deliver reliable and unbiased results.

//////////// May 202403

Working with
Other Vendors(sub-processors)
At Qualtrics, our focus is to remainadaptable in the ever-evolving AI landscape
to be able to deliver the optionality forour customers. However, we prioritize
maintaining strict privacy and security
standards when partnering with externalvendors. Safeguarding customer data
is our top priority, especially whencollaborating with 3rd-party LLM vendors.
To ensure a secure and confidential
collaboration, Qualtrics has established
enterprise licensing agreements with LLM
providers, covering the following
key aspects:
1. Data Usage: Customer* data
shared with 3rd-party LLM
providers, also known as subprocessors, will not be utilized for
AI/LLM training purposes by thevendor or retained by them.
2. Data Retention: Sub-processors
are only permitted to retain andprocess data to deliver the services
requested.
3. Opt-In Mechanism: The sharing ofcustomer data with 3rd-party LLMs
is initiated by customers throughan opt-in mechanism related tospecific features and brands.

//////////// May 2024

By strictly following detailed protocols, wemaintain the utmost level of data privacy
and security when working with externalvendors. This assurance enables us tocreate strong relationships while protecting
our customers’ confidential data.
* The term “customer” refers to Qualtrics’ customers

04Ensuring Responsible
Machine Learning throughModel Risk Management
At Qualtrics, responsible machine learning is at the core of our model development,
supported by a robust model risk management process. Recognizing that machine learningmodels can be intricate and prone to bias and errors, we take proactive steps to mitigate
risks. To address these challenges, we have implemented a range of best practices andprocesses throughout our end-to-end model development lifecycle://////////// May 2024

1. Data Governance: We uphold strict data
governance practices to ensure the accuracy,integrity, and security of the data used to train ourmodels. This helps in maintaining the reliability andfairness of our models.
2. Model Monitoring: We continuously monitor theperformance of our machine learning models in
real-world applications. This ongoing evaluation
allows us to identify and rectify any potential issues
promptly.
3. Model Auditing: Regular model auditing isconducted to assess the effectiveness andconsistency of our models. This audit process
helps us understand the model’s behavior andperformance over time.
4. Bias Evaluation: We are committed to addressing
bias in our models and strive for fairness in theiroutcomes. Rigorous bias evaluation is conducted todetect and rectify any unintended biases.
5. Metrics and Evaluation: We use well-defined
metrics to measure the effectiveness and accuracyof our machine learning models. These metrics
provide us with actionable insights to refine andimprove our models continuously.

05

CONCLUSIONWe take pride in our commitment to responsible
machine learning and managing the risks associatedwith our models at Qualtrics. This commitment enables
us to give you, our customer, dependable and reliable
solutions that are both precise and effective, while
enabling you to be compliant with industry regulations
and ethically responsible.

//////////// May 2024