Security & privacy

Every document and chat attachment is classified Public, Internal, Confidential or Restricted. Restricted data is locked to approved, on-prem-capable models only — it never reaches an external provider.

Logging policy defaults to metadata only: who ran what workflow, on which model, at what cost — never the prompt or response content. Admins can opt into logging redacted content, or full content with justification (employees are notified when this is on), from Policies.

Automatic redaction can strip CCCD numbers, phone numbers, bank accounts and personal email addresses from requests before they're sent. The Audit log's AI usage tab shows every request's outcome — Allowed, Blocked, Redacted or Approval required — without ever showing the underlying prompt.