Body
This is a draft document subject to approval of proposed LETU AI Policy by the President's Cabinet. Until that review is complete and approval given, the below should be considered draft guidance and not in force. Please contact Information Technology in the meantime if you have any questions about use of AI Tools at LETU.
Approved AI Tools (for data compliance)
The following independent AI Tools are approved as data compliant tools for appropriate use subject to Draft LETU Policy 6.X Acceptable and Responsible Use of AI and 6.2 Data Classification. Click each tool name for more details and to confirm you are logged into the LETU version of each tool to ensure data safety.
-
Microsoft M365 CoPilot
(when logged in as @letu.edu account)
(M365 Copilot uses an Orchestrator design which calls custom versions of a variety of models including GPT-5, Claude, MS specialized models including Phi, Vision, Speech, and Toolformer/function-calling models)
Typical Orchestrator pathway: Your prompt → Copilot Orchestrator → Graph Retrieval + Embeddings → Specialized Models (optional) → GPT‑5 or Claude-based Reasoning → Safety + Compliance Filters → M365 Copilot response.
-
Google Gemini
(when logged in as @letu.edu account)
-
Boodlebox
(Orchestrator solution which provides access to OpenAI GPT4/GPT5/o3/o4, Anthropic Claude, Google Gemini, Meta LLaMa, Perplexity)
(when licensed and logged in as @letu.edu account)
-
Embedded AI Functionality in Existing Vendor Solutions
AI features embedded within solutions provided by vendors with whom LETU already has an established business relationship generally follow a streamlined review process. In most cases, this AI functionality is expected to be approved under existing agreements, provided it is fully isolated within LETU’s SaaS environment with the vendor and does not introduce new data‑sharing or risk considerations. However, LETU does need to receive and document compliance documents for these solutions as with standalone AI tools.
As individual embedded tools with existing solutions partners are reviewed and confirmed, they will be listed here. If you are considering AI functionality within an existing LETU solution and do not see approval information documented, please contact ServiceDesk@letu.edu to request confirmation or review.
The following Vendor AI Solutions are Approved for use within each solution:
Use of these tools should follow vendor guidelines and best practices as well as best practices for LETU data management and classification.
- Salesforce Education Cloud (Provisional pending documentation)
- Salesforce Account Engagement (Provisional pending documentation)
- Blackbaud Raiser's Edge (Provisional pending documentation)
Caution: Approved tools do not include consumer versions of copilot which omit the M365 moniker (see below)
Licensing:
365 Copilot is licensed for all LETU students and employees
Two Versions of CoPilot:
There are two versions of Copilot, and only one is FERPA‑compliant. LETu-managed devices should only have the compliant M365 version below. If you see a version without the M365 branding on a LETU device please do not use it and report it to the Service Desk.
Windows 11 Desktop Apps:
- FERPA‑compliant: Microsoft 365 Copilot (When signed in to @letu.edu account, look for “M365” on the icon; launch by searching “Microsoft 365 Copilot” in the Start menu, you should see your account info in the bottom left if it’s the correct version).
- Not FERPA‑compliant: the standard Copilot App that appears in Windows 11. There is no “M365” on this icon. LETU removes this version on managed devices. Do not use this version of CoPilot for LETU work.
The same applies on the web:
1. Sign In with Your LETU Account at gemini.google.com
Compliance protections only apply when you are logged into your official LETU account.
2. Verify the "Enterprise Shield" Icon
Google provides a visual indicator to confirm your data is being handled under the Core Service agreement (where data is not used for model training).
-
Go to gemini.google.com.
-
Look at the input bar at the bottom of the screen.
- Verification: You should see a Shield Icon next to your school's name or a message stating "Your chats are processed with enterprise-grade data protection."
-
If you see a warning that "Your conversations are reviewed by humans," you are either on a personal account or your admin has not enabled the Core Service version.
3. Check Your Feature Level
Depending on your school’s license, you may see different badges at the top of the interface:
-
No Badge: Standard Education version (Fully compliant).
-
Gemini Education / Business: Enhanced version (Fully compliant).
-
Gemini Pro / Ultra: Advanced version (Fully compliant).
4. Summary of Data Protections
When the steps above are followed, the following audit-ready protections are active:
- No Human Review: Your prompts and responses are never seen by Google employees.
- No Model Training: Your data is not used to train Google’s global AI models.
- Data Ownership: Your institution retains ownership of all data submitted to the service.
What it provides:
Boodlebox provides access under a FERPA/GLBA-compliant LETU business agreement to top-tier models which may vary over time but currently include OpenAI's GPT-4, Anthropic's Claude 3.5 Sonnet/Opus, Google Gemini, and Meta Llama, along with search tools like Perplexity.
Licensing:
Boodlebox is currently in pilot stage with the Office of the Provost and requires a monthly per-user subscription. Faculty who are interested in Boodlebox should contact the Office of the Provost for more information. Staff who are interested should contact Information Technology.
Tools which Require Specific Approval
Autonomous AI Tools
- To ensure compliance with regulatory requirements, and manage institutional risks, autonomous AI tools require specific approval for use on LETU managed systems if they are capable of acting directly on data, data stores or LETU systems (including University document storage locations, desktops and similar locations).
- This includes tools from otherwise approved AI providers which are capable of launching applications, manipulating files, executing commands, performing system changes, unattended automation, or otherwise acting independently without direct human control.
- This includes some agentic tools but does not automatically include all agentic tools if they operate exclusively in a sandboxed or otherwise isolated environment and require that documents, data or processes they manipulate and interact with be uploaded or hosted in secure locations within the tool itself where the tool does not have direct access to manipulate the original LETU data, documents, or other technology elements.