Data security
& AI FAQ
How we connect your systems, handle your data and use AI in supported workflows.
References reviewed
Connecting your tools.
Keeping you in control.
How do we connect to your systems?
We use approved APIs to connect your supported communication channels and business applications, process information in our AWS environment, and send results to the destination we agree with you. We use TLS to encrypt API connections in transit.
For example, we can extract WhatsApp data and deliver it to your SharePoint site through Microsoft Graph, or to Autodesk Forma through the applicable Autodesk Platform Services APIs. We agree the connected systems, permissions and output formats with you for each integration.
References: Example integration architecture · Microsoft Graph · Autodesk Data Management API
How do we separate your access and configuration?
We scope your access, configuration and output routing to your customer tenancy. Our integrations use the permissions you approve for your systems.
Our dedicated tenancy model provides your own service context. Any requirement for a separate physical server, AWS account or VPC must be expressly agreed with us as part of your deployment.
Reference: Example integration architecture
Where do we store your data, and how long do we keep it?
Our storage and retention arrangements depend on your workflow. In an API-only configuration, we can process your business data in memory and deliver results to your systems without keeping a permanent business-data copy. We handle service configuration and operational metadata separately.
We agree retention requirements with you for business content, logs, temporary processing and backups. You manage retention in your destination systems.
When we use an external provider, its retention rules also apply. For example, OpenAI’s default API abuse-monitoring logs may retain prompts and responses for up to 30 days, with legal and safety exceptions. Some features also store application state. Zero Data Retention requires OpenAI’s approval and has limitations.
References: Our Privacy Policy · OpenAI API data controls
Using AI
responsibly.
The AI features and providers we use depend on your workflow. The examples below cover our use of OpenAI’s API business service. Other services have their own policies and settings.
Can you restrict AI usage and access?
We configure your deployment around the access permissions and AI features we agree with you. If you need data extraction only, we can scope the workflow to deliver data for use in your own systems.
We confirm requirements such as disabling external AI calls or limiting configuration changes to administrators with you during deployment planning. The available controls depend on your workflow.
References: Our enterprise features · Our Terms of Use
Do we use your data to train AI models?
We do not use customer data to train any AI models. When we use the OpenAI API, the inputs and outputs we send and receive are not used for model training.
Model training and data retention are separate. Our no-training commitment does not mean that every service has zero retention; the retention arrangements for your deployment still apply.
References: Our enterprise features · OpenAI API data controls
Who owns your data and AI-generated outputs?
Your data remains yours under our terms. Our agreement with you defines permitted processing, content licences and rights to outputs. Our platform software and configurations are governed separately.
For OpenAI’s business service, input rights remain with its contracting customer and output rights are assigned to that customer where legally permitted. Your agreement with us should specify the output rights that apply when we use our provider account for your integration.
References: Our General Conditions, sections 4–6 · Our Terms of Use, sections 7–8 · OpenAI Services Agreement, sections 4 and 9
What should you check before using AI-generated content?
We recommend reviewing AI-generated material for accuracy, suitability and third-party rights before publication or commercial use. AI outputs may not be unique, and we cannot guarantee that generated material is free of copyright, design, trademark or likeness restrictions.
Use inputs you are entitled to provide and obtain any necessary permissions for identifiable people, designs or brands.
References: OpenAI Services Agreement, sections 4.3–4.4 · OpenAI Service Terms
How do our AI providers address safety and harmful content?
The AI providers we use publish information about their model development and safety measures. OpenAI, for example, describes filters intended to remove unwanted training material, including hate speech and adult content.
These measures do not guarantee that every training item or generated output is free of harmful content. We recommend reviewing the selected model’s safety documentation and checking outputs for your intended use, particularly before sharing them externally.
Reference: How OpenAI’s foundation models are developed
How do we define responsibilities and liability?
Our agreement with you and the applicable provider terms define responsibilities, liability limits and any indemnities. When we use OpenAI’s business and API services, its terms provide protection for certain third-party IP claims, subject to conditions and exclusions. This protection does not cover every AI-related risk.
Provider protections depend on the account holder’s agreement and the service used. Relevant exclusions can include missing input rights, modified outputs, trademark claims and beta services. Our Terms of Use separately address third-party integrations and liability.
References: Our Terms of Use, sections 10, 12 and 14 · OpenAI Services Agreement, sections 12–14 · OpenAI Service Terms, sections 1–2
Need more detail
for your team?
We can help you understand the permissions, data handling and AI services we use in your deployment. Your agreement with us and the applicable provider terms set out the specific commitments.
For more information, contact us or review our policies below.
Talk to us