DataPrivacy

Define How Data Will Be Used

Before connecting data, we document what the workflow needs, where the data comes from, who can access it, and how long it should be kept.

We also document how each model provider handles prompts and outputs, including retention and model-improvement settings. Your team approves the storage, access, and service configuration for the project. If customer-specific training would help, your team selects the dataset and approves the setup.

Data Protection Measures

We use controls such as encryption, least-privilege access, network boundaries, logging, data minimization, and retention settings based on the workflow and the services it uses.

Regulatory Privacy Alignment

We work with your privacy, legal, and security teams to connect the design to your contracts, data categories, locations, and regulatory requirements.

What We Document Before Connecting Data

• The data the workflow needs to complete its task
• Where each source comes from and who can access it
• How long prompts, outputs, logs, and other records are kept
• How each model provider handles prompts and outputs, including retention and model-improvement settings
• Where each service and integration processes data

Your team approves the storage, access, and service configuration before the system goes live.

Customer Data and Model Training

Customer data is not used to train shared or general-purpose models.

Customer-specific training or fine-tuning needs written customer instructions, confirmation of the necessary data rights, and governing contract terms. When it is contracted, approved datasets go through quality, provenance, relevance, privacy, and bias review suited to the scope before use.

Access to training data and model artifacts is restricted by role-based access controls.

Minimizing Personal Data

Personal data is minimized and, where it suits the use case, redacted, tokenized, anonymized, or pseudonymized in AI pipelines.

Logging is designed to keep useful evidence for review without exposing more sensitive data than your team needs. Inference logs that contain sensitive data are subject to retention limits and access controls.

Protection Inside the AI Pipeline

• Encryption in transit and at rest is configured for the customer data stores, services, and network paths in the approved architecture
• Customer-data isolation follows the selected product, cloud account, tenant, and service architecture
• Data and workload boundaries are set by data classification and architecture
• Data processing agreements and service-specific terms govern AI-related data handling where they apply

Retention You Can Explain

Training, inference, prompt, output, review, and operational-log records are kept only as described by the applicable product configuration, customer agreement, data processing terms, retention policy, and legal requirements.

We define who can see these records, how long they are kept, and who reviews them.

Choosing Model Providers

Model selection weighs the security posture and data handling practices of each provider alongside task performance, latency, cost, licensing terms, and your contractual obligations.

The full commitments are in our AI Usage Policy.