ADR-0007: Claude Copilot with tenant-scoped tools and no training on merchant data

• Date: 2026-09-18
• Status: Withdrawn — the Copilot surface was removed with the vertical (see ADR-0010). The record is kept for history.
• Deciders: the owner, Claude (seed)
• Tags: ai compliance

Context

The product relies on AI for content generation, review replies, summaries, and ad budgets. Arabic quality, data safety, and token cost are all constraints.

Decision

Claude through packages/ai (Vercel AI SDK with @ai-sdk/anthropic), fronted by Cloudflare AI Gateway (semantic cache, limits, log) when the Cloudflare target is chosen. Every call passes through packages/ai with a mandatory tenant context and tools provided by modules through copilotTools in the manifest.

• No training or fine-tuning on merchant data; stated in the contract and the privacy notice.
• Token quotas per plan; the default model is still open (Claude Sonnet 5 is wired today).
• Every call is recorded in ai_calls with its cost in SAR.

Consequences

• Positive — high Arabic quality, controlled cost, auditability.
• Negative — dependence on an external provider; variable cost that needs monitoring.
• Revenue impact (SAR / month, confidence) — cost ≈ 5–20 SAR / merchant / month (medium confidence); AI is a retention and upgrade lever, not a standalone revenue channel for now.

Rejected alternatives

• Self-hosted open models: lower Arabic quality and heavier operations.
• AI without tenant boundaries: risk of data leakage between merchants.

References

Withdrawn 2026-09-20. This record describes a surface that is no longer part of the product: the Copilot surface was removed with the vertical. ADR-0010 records the decision.