Privacy & trust

How Vega handles your data, the boundaries that keep patron records out of it, and the one choice those boundaries leave to you. For what Vega can and can’t answer, see the Vega overview.

Privacy and trust

A short section on the boundaries.

Who can see your Vega conversations. Only you. Your conversations are scoped to your staff user account. An Admin in your school cannot read your chats, and no Lyra staff member can either.

What we send to the model. Aggregated, de-identified query results, plus your question, with each @-mention in it replaced by a stand-in. Nothing Lyra reads out of your patron records — no names, emails, barcodes, or identifiers — reaches the model. When Vega counts patrons or loans, it gets the count and the filters it asked with, and nothing from the rows behind it; you see the patrons by opening the card. Never any field that could identify a student. Homeroom names count as identifying too, which is why no Vega answer buckets by homeroom.

Your question is checked before it is sent. Typing @ picks a patron or homeroom as a chip; Vega sees a stand-in such as patron:a1, never the name, and the stand-in is stored with the conversation and deleted with it. If you type a patron’s first, last, or preferred name, or a homeroom’s name, Lyra finds it before anything is sent and holds the question: pick button: Mention Jonah with @ to turn it into a chip, or button: Send as typed when the word only looks like a name (a surname that is also a word in your question, say). Only a name you chose to send as typed reaches Anthropic. Names that are also common words, such as May or Hope, are left out of the check, and a patron added in the last few minutes may not be caught yet.

Small cohorts are suppressed before anything is sent. Aggregation alone isn’t enough to de-identify a group of one. A count of patrons, loans, or holds from 1 to 4 reaches Vega as “fewer than 5”, never the number, and the card in your conversation says the same; opening it shows you the rows. The exception is a count over patrons you @-mentioned, which is exact: you picked them, and Vega sees only their stand-in. That is still a fact about one student reaching Anthropic, unlinked to their name, so don’t pair a mention with a description that would identify them, and don’t send their name as typed in the same conversation. A by-grade breakdown drops any grade with fewer than five distinct borrowers in the window, and if no grade clears that bar the breakdown is suppressed entirely. A single grade’s totals or most-borrowed titles are withheld the same way, and all Vega learns is that there were fewer than five borrowers, never how many — so a result can never be narrowed to an individual student.

Who the model provider is. Vega runs on Claude, by Anthropic. Conversations are sent to Anthropic for inference and returned.

Zero Data Retention. Lyra is working with Anthropic on Zero Data Retention for its API usage. We’ll update this page once that’s in place.

The OpenAI subprocessor. Lyra also uses OpenAI’s embeddings model for the OPAC catalog search index. That subprocessor handles only book and item text (descriptions, summaries, MARC fields), never patron data, and is separate from the Anthropic relationship that powers Vega.

Turning it all off. An account owner can turn Vega off, which stops every call to Anthropic, and semantic search off, which stops every call to OpenAI, the OPAC’s search index included. With both off, nothing from the account reaches an AI service. See Turning AI capabilities off.

Your data stays your data. Nothing you ask Vega is used to train any model. The privacy policy and DPA documents the contractual side.

See also

• Vega overview covers what to ask Vega and what it will refuse.
• OPAC is the patron-facing browse surface that uses the same embedding subprocessor.