ēkotrace™

AI Use Statement

How artificial intelligence is used within the ēkotrace platform, what data flows through AI systems, and how human review is intended to work. This statement describes design and data-flow information; it is not a legal compliance assessment, framework conformity statement, or certification.

Last reviewed: May 2026 · v1.0

On this page

AI Models in Use
What Data Flows Through AI
What Data Does NOT Flow Through AI
Human-in-the-Loop Design
Data Sovereignty & International Data Flows
What We Will Never Do
Contact & Review

Section 1

AI Models in Use

ēkotrace currently uses one AI model in production:

Model	Purpose	Provider	Data sent
OpenAI gpt-5-mini	OCR extraction of structured fields from weighbridge tickets and gate documents uploaded by operators	OpenAI (via Replit-managed integration)	Document image only — see Section 2

No AI model is used in the SHA-256 hash chain, the cascade routing engine, the emission calculation engine, or the artefact issuance service. Those components are deterministic — they produce the same output from the same input every time. The chain of custody is not AI-generated.

This page describes the AI footprint as designed. Specific contractual and regulatory claims about third-party AI providers are subject to the underlying provider's published terms and to ongoing legal review.

Section 2

What Data Flows Through AI

When an operator uploads a weighbridge ticket or gate document, the image is sent to OpenAI's gpt-5-mini model to extract the following fields:

Mass / net weight
Date and time of transaction
Supplier or carrier name (as printed on the document)
Material type or waste code (as printed on the document)
Site or facility identifier

Data sovereignty note: document images are processed on OpenAI servers located in the United States. See Section 5 for full data sovereignty disclosure and mitigations.

Each extracted field is returned with a confidence score between 0.000 and 1.000. Fields scoring below 0.85 are flagged for mandatory human review before any data is accepted into the chain.

Section 3

What Data Does NOT Flow Through AI

The following data categories are never sent to any AI model:

Operator authentication credentials (NFC identifiers, PIN hashes)
SHA-256 chain event records or hash values
Report and material-record artefacts, including chain-event records or carbon estimates
Client commercial data — pricing, contract terms, procurement volumes
Personal data identifying individual consumers or end-users
Carbon calculation inputs or emission factor methodology data

What this means in practice: the chain-hash and carbon-calculation components do not use AI. OCR-extracted fields may enter a record after operator review. A hash chain can show whether linked record data changed; it does not independently verify the physical event, the accuracy of an entry, or its suitability for a regulatory submission.

Section 4

Human-in-the-Loop Design

The OCR pipeline is designed so that no AI output enters the chain of custody without a human checkpoint. The process is:

1
Document upload
Operator uploads the weighbridge ticket or gate document.
Operator action
2
AI extraction
gpt-5-mini extracts structured fields from the document image.
Automated
3
Confidence scoring
Each field receives a confidence score of 0.000–1.000.
Automated
4
Review modal
Any field with a confidence below 0.85 is displayed for operator correction; all fields are visible to the operator.
Human reviews and confirms or corrects
5
Chain insertion
Confirmed fields are SHA-256 hashed with the preceding event and appended to the chain.
Automated — only proceeds after human confirmation

Human review and confidence scoring are design features, not evidence of conformity with any framework. No AI Act classification, legal review, or formal conformity assessment is provided by this statement; requirements depend on the specific use and jurisdiction.

Section 5

Data Sovereignty & International Data Flows

ēkotrace operates in a cross-border data environment. This section discloses all international data flows and the mitigations in place.

5.1 Current data flows

Data type	Where processed	Jurisdiction	Mitigation
Weighbridge ticket images (OCR)	OpenAI API servers	United States	No training on inputs (Replit-managed integration). No personal data sent where avoidable. See 5.2.
Platform event records and chain data	Replit Autoscale infrastructure	United States (default)	NZ/AU hosting on roadmap — see 5.3.
Client portal data (retail and council demos)	Replit Autoscale infrastructure	United States (default)	NZ/AU residency option for enterprise/government clients — see 5.3.

5.2 OpenAI and the NZ Privacy Act 2020

Under the NZ Privacy Act 2020, Information Privacy Principle 12 requires that, before disclosing personal information to an overseas recipient, ēkotrace take reasonable steps to ensure the recipient provides comparable privacy protections. The Replit-managed OpenAI integration is governed by OpenAI's published API data-usage and enterprise terms (no training on API inputs by default; SOC 2 Type II certification). The specific data-handling guarantees that apply at any point in time are those published by OpenAI and Replit — ēkotrace recommends operators review them directly before submitting documents that may contain personal information. Where weighbridge tickets include any personal identifier (operator name, vehicle registration), operators are instructed to either redact the document before upload or rely on the data-minimisation policy applied in the OCR pipeline.

5.3 Data Residency Roadmap

These are aspirational planning topics, not current residency services or commitments. Availability, timing, and legal requirements have not been independently assessed.

NZ/AU cloud residency — proposed for future consideration; no delivery date or government-client arrangement is confirmed.
EU data residency — proposed for future consideration; no delivery date or GDPR compliance claim is made.
Pacific Island data sovereignty — potential future topic for assessment; no regional data-governance assessment or partnership is represented here.

5.4 Framework context — not an assessment

Framework	Relevance to ēkotrace	Assessment status
NZ Privacy Act 2020	Relevant to personal information and transboundary data flows	No independent privacy compliance assessment is represented here.
NZ AI Forum Trustworthy AI Principles (2020)	Voluntary AI governance principles	No framework conformity assessment is represented here.
Algorithm Charter for Aotearoa NZ	Relevant where government-agency use brings the Charter into scope	Applicability and conformity have not been assessed here.
MBIE Responsible AI Guidance for Business	NZ government guidance for businesses using AI	No formal assessment against this guidance is represented here.
ISO/IEC 42001 (AI Management Systems)	International AI management-system standard	ēkotrace certification or conformity is not claimed.
EU AI Act	May be relevant depending on intended use, role, and jurisdiction	No classification or conformity assessment is represented here.
GDPR	May be relevant to processing of personal data within its scope	No GDPR compliance assessment is represented here.
APEC Cross-Border Privacy Rules	Potentially relevant to cross-border data flows	No certification or assessment is represented here.
OpenAI Usage Policies + Data Processing Terms	Third-party terms may apply to the OCR integration	Review the applicable terms with the provider; this statement makes no independent compliance or certification claim.

Section 6

What We Will Never Do

✕
Use AI to make automated decisions about material routing, recorded grade, or cascade tier without human confirmation.
✕
Send report artefacts, chain event records, or commercial pricing data to any AI model.
✕
Use AI-generated outputs as the sole basis for any regulatory submission or ESG disclosure.
✕
Train AI models on client data without explicit written consent.
✕
Use AI in any way that would constitute high-risk AI use under the EU AI Act without completing the required conformity assessment.

Section 7

Contact & Review

This statement is reviewed annually and updated whenever the AI footprint changes.

Last reviewed: May 2026
Contact: connect@ekot.nz
Published at: /ai-use (this page)