Overview

Firstup AI Search is an enterprise-grade agentic search capability built on a secure integration between Firstup and OpenAI's Enterprise API. It is not a consumer AI product.

Firstup AI is built around five core tenets: Human Oversight and Control, Privacy and Data Protection, Governance and Accountability, Transparency and Explainability, and Continuous Improvement and Reliability. These are not marketing principles -- they are design requirements embedded into how the product works. The sections below explain how each tenet applies specifically to AI Search.

AI Search works in conjunction with Firstup AI Content Creator—Search enables discovery and synthesis of information, while Content Creator transforms those insights into communications and campaigns.

AI Search improves employee productivity by reducing time spent searching for information, enabling faster decision-making, and improving communication effectiveness. 

Unlike general-purpose AI tools (e.g., Microsoft Copilot or Google Gemini), Firstup AI Search is grounded exclusively in enterprise content, respects existing permissions, and does not use customer data for model training.

Before getting into the details, two things every IT team should know upfront:

• Opt-in only: AI Search must be explicitly enabled by Firstup first, then by your organization's admin in Creator Studio. No AI processing occurs until both steps are completed.
• No model training: Your organization's data is never used to train AI models -- not by Firstup, not by OpenAI, and not by any subprocessors.

Looking for training on Firstup AI Search? Enroll in our eLearning course in the Training Center!

Tenet 1: Human Oversight and Control

Firstup AI is built to augment and amplify human potential, not to replace human judgment. AI Search surfaces and summarizes information and is designed for extensibility into more advanced workflows while maintaining human oversight and accountability.

What this means in practice:

• AI Search returns results and generates summaries for the employee to read, evaluate, and act on. The human remains in the loop at every step.
• AI output is reviewable and subject to human judgment before any action is taken.
• Admins retain full authority over which AI features are enabled, which users can access them, and which content sources are included.
• Accountability for outcomes always resides with your organization, not the algorithm.

Tenet 2: Privacy and Data Protection

AI Search operates strictly within your enterprise security and data boundaries. The introduction of AI Search does not change Firstup's existing data storage or handling practices.

Encryption: All data is encrypted in transit and at rest. This includes data exchanged between Firstup and OpenAI via the enterprise API, tokens, and any content retrieved from connected integrations.

No model training: Customer data is never used to train AI models. This applies to Firstup, OpenAI, and all subprocessors -- without exception. Data is retained only as necessary to deliver contracted services.

Cross-tenant isolation: Firstup is a multi-tenant platform. Each customer's data is isolated by design. One organization's content, search activity, or results cannot surface in another organization's environment.

Least-privilege access: Access to AI Search and its data sources is governed by purpose limitation and least-privilege principles. Users only access what they are already authorized to see. AI Search does not elevate permissions or create new access paths.

OpenAI data retention: OpenAI may retain API inputs and outputs for up to 30 days solely for service provision and abuse detection. This data is not used for model training.

Search history: Firstup AI Search does not maintain persistent search history across sessions. Context is retained within a single session only and is cleared when that session ends.

For more information on OpenAI's enterprise data commitments, see:

• trust.openai.com
• openai.com/enterprise-privacy

Tenet 3: Governance and Accountability

Trustworthy AI requires disciplined oversight and measurable safeguards. Firstup embeds enforceable policies, continuous monitoring, auditability, and rigorous accuracy controls into AI Search by design.

Hallucination mitigation and RAG grounding: This is one of the most common questions IT and security teams ask: how do you prevent the AI from making things up?

Firstup AI Search uses Retrieval-Augmented Generation (RAG). This means responses are grounded exclusively in content retrieved from your organization's configured data sources -- Firstup platform content and enabled integrations. The model does not generate responses from general internet knowledge or invent information beyond what the source documents contain. Every AI-generated summary is anchored to retrievable, citable source material.

In plain terms: if the answer isn't in your content, AI Search will tell the user it doesn't have an answer rather than fabricating one.

Admin controls: Brand Super Admins manage AI Search settings in Creator Studio by navigating to Configure → AI Settings. Controls include:

• Enable or disable AI Search entirely
• Restrict access by audience (specific audiences, excluded audiences, or all users)
• Control which content sources and integrations are included in search scope
• Enable or disable AI-generated overview summaries

Monitoring and logging: Firstup maintains the following for all AI-powered features:

• Production event logging
• Abnormal behavior monitoring
• Consolidated alerts and reporting
• Annual continuity testing
• 2-hour RTO/RPO target

Once requests leave Firstup's infrastructure, monitoring is handled by OpenAI under their enterprise service terms.

Search analytics: Engagement data is logged in the backend, including search terms, click activity, zero-result queries, and interaction events. Customer-facing reporting for AI Search is planned for a future phase. Platform status is available at status.firstup.io.

Regulatory alignment: Firstup's systems are designed to align with organizational policies and regulatory requirements. See the Compliance section below for GDPR and privacy law specifics.

Tenet 4: Transparency and Explainability

AI should never operate as a black box. Firstup makes clear when and how AI is used, what data it relies on, and what influence it has on outcomes.

Labeling of AI-generated content: When AI Search generates a summary or overview, it is clearly presented as an AI-generated response -- not as source content. Employees are not left guessing whether what they are reading came from a human-authored document or an AI synthesis.

Source attribution: AI Search includes source links alongside generated summaries so employees can verify the underlying content directly. Responses are grounded in retrieved documents, not generated from general knowledge.

Explainable outputs: AI Search is designed to be traceable. When results are returned, the sources informing those results are visible and accessible to the user.

Admin visibility: Admins have insight into AI Search configuration and activity through Creator Studio. Continuous monitoring and governance policies are in place and aligned to regulatory requirements.

Tenet 5: Continuous Improvement and Reliability

Firstup's commitment to AI does not end at launch. AI Search is designed for long-term reliability and continuous improvement as the product evolves.

Model updates: Firstup works with OpenAI's enterprise models. The specific model version in use is not publicly disclosed, as it may be updated over time to reflect improvements in accuracy, safety, and performance. Model changes are managed by Firstup and do not require customer action.

Reliability targets: Firstup targets a 2-hour RTO/RPO for AI-powered features. Annual continuity testing is performed across the platform.

Zero-result handling: If AI Search cannot find relevant results for a query, it tells the user clearly and offers alternative suggestions. It does not guess or fabricate an answer.

Roadmap transparency: Firstup communicates openly about what AI Search can and cannot do today, and what is planned for future phases. See the Known Limitations and Roadmap section below for current scope.

Architecture & AI Infrastructure

Firstup AI Search integrates with OpenAI's standalone Enterprise API -- not public consumer tools such as ChatGPT, and not the Azure OpenAI service. All AI requests are processed through controlled enterprise APIs.

How indexing works: Firstup indexes all platform-native content (topics, posts, people, files) prior to onboarding and re-indexes continuously as content changes. For external data sources such as Google Drive and Microsoft SharePoint, Firstup does not independently re-index that data -- it queries those systems via their native APIs at the time of search, using the authenticated user's existing credentials and permissions.

Is this agentic search or federated search? This is agentic search. Firstup AI Search uses a unified index model to connect data sources and deliver accurate, synthesized responses. It is not simply federated search that returns a list of links from different systems.

On the LLM model version: The specific model version is not publicly disclosed, as it may be updated over time. Firstup uses OpenAI large language models via enterprise API.

Permissions and Access Controls

Permissions inheritance: Firstup AI Search fully respects your existing Firstup permissions and external integration permissions. Users can only access information they are already authorized to view. AI Search does not create new access paths or surface content outside a user's existing permissions.

Admin access controls: Access is managed in Creator Studio by navigating to Configure → AI Settings:

• Available to all users (default)
• Available to specific audiences
• Available to everyone except specific audiences

Admins also control which content sources and integrations are included in the AI Search scope. Sources not enabled in AI Settings will not be searched.

Granular content restrictions: Currently, admins can enable or disable entire content types (all topics, all posts, etc.) but cannot restrict individual topics or pieces of content. Granular content-level controls are planned for a future release.

PII handling: If a user's authorized search results contain personally identifiable information already visible to them within Firstup, that PII may be included in prompts sent to OpenAI. User queries may also include PII. All PII involved is already within the customer's Firstup environment and accessible to the requesting user -- AI Search does not expose data beyond what the user can already see.

While AI Search may process PII already accessible to the user, organizations should avoid using the system for highly sensitive personal data. Such use is outside intended use cases.

What Firstup AI Search is not intended for: The platform is not designed for sensitive personal data, including:

• Social Security numbers
• Government-issued IDs or passport numbers
• Driver's license numbers
• Full birthdates
• Protected health information
• Protected financial information

Compliance, Privacy & Legal Requirements

GDPR and privacy law compliance: Firstup has a Data Processing Agreement (DPA) with OpenAI aligned with GDPR and other applicable privacy regulations. Firstup's Generative AI Integration Product Attachment is available on the Firstup website.

Customer agreement requirement: Before AI Search is activated, customers must accept a Generative AI Product Attachment -- including OpenAI's Terms of Use -- via DocuSign. This attachment covers:

• The relationship between Firstup and OpenAI
• Integration-based delivery of AI functionality
• Terms governing usage

UK and EU customers: International privacy regulations may affect your deployment timeline or configuration. Legal and security review is recommended prior to enablement. Key areas to review include:

• Data residency requirements
• Cross-border transfer mechanisms
• Data processing agreements
• Integration-specific data handling

Integration Compatibility

Firstup AI Search works with Firstup-supported integrations only. Supported integrations include UKG, ServiceNow, Workday, Google Drive, and Microsoft SharePoint, among others. Unsupported integrations such as Snowflake will not be searchable via AI Search.

The agent uses the authenticated user's existing credentials to retrieve data from integrations -- no separate authentication is required and no new access is granted beyond what the user already has.

Microsoft Copilot: Firstup AI Search does not currently integrate directly with Copilot. Firstup is evaluating a future path that would support Firstup as a Model Context Protocol (MCP) provider, allowing results to surface inside external agents. Scope and timing are under evaluation.

Known Limitations and Roadmap

Being transparent about current limitations is part of how Firstup builds trust. The following are known scope boundaries as of GA:

• Granular content controls (restricting specific topics or posts, rather than all-or-nothing): planned for a future release
• Customer-facing search analytics: captured in the backend now, customer-facing reporting coming in Phase 2
• Persistent cross-session memory: context is session-only today; cross-session memory is under consideration
• Copilot integration: not available today; roadmap under evaluation
• Predictive or auto-complete search: not currently supported
• ML-driven recommendations based on search behavior: not yet available; planned as adoption grows
• Translation of original source content: AI Search understands multi-language queries and can summarize in other languages, but does not translate the underlying source documents

Frequently Asked Questions

Do we need to sign anything before enabling AI Search? Yes. Customers must accept the Generative AI Product Attachment via DocuSign before activation. Your Firstup Customer Success Manager can facilitate this.

Can we turn it off if needed? Yes. Brand Super Admins can disable AI Search at any time in Creator Studio by navigating to Configure → AI Settings.

Can one customer's data affect another customer's search results? No. Firstup's multi-tenant architecture ensures complete cross-tenant data isolation. Your data is yours only.

How does AI Search prevent the AI from making things up? AI Search uses Retrieval-Augmented Generation (RAG), meaning every response is grounded in content retrieved from your organization's configured sources. The model does not draw on general internet knowledge or generate information beyond what your source documents contain.

Is AI Search available on mobile? Yes. Available on web and mobile (iOS and Android). Mobile requires app version 26.2.2 or later.

Does it support multiple languages? Yes. AI Search can understand queries in languages other than English and can summarize results in supported languages. It does not currently translate the original source content.

What happens with zero-result searches? If no results are found, the assistant informs the user and offers alternative suggestions. It does not fabricate an answer.

Does it integrate with Copilot today? No. See the Integration Compatibility section above for roadmap context.

What if our organization already has its own AI agent? AI Search operates within Firstup and does not conflict with external agents. Future roadmap work may allow Firstup to surface as a source within external agents like Copilot via MCP.

Additional Resources

• Firstup AI Search (end user guide)
• Managing Firstup AI Search (admin settings)
• Generative AI Product Attachment
• OpenAI Trust Center
• OpenAI Enterprise Privacy
• Platform Status
• Vulnerability Disclosure

For security review requests or questions not addressed here, contact your Firstup Customer Success Manager or submit a request via the Firstup Help Center.