AI Security & Privacy
This page details how Vantage protects your data when using Intuidy AI features, including credential management, data transmission, and organizational security controls.
Security Architecture
┌──────────────────────────────────────────────────────────┐
│ Vantage Platform │
│ │
│ ┌───────────┐ ┌──────────────┐ ┌───────────────┐ │
│ │ Browser │───▶│ Vantage API │───▶│ LLM Provider │ │
│ │ (Client) │ │ (Server) │ │ API │ │
│ └───────────┘ └──────────────┘ └───────────────┘ │
│ │ │
│ ┌──────▼──────┐ │
│ │ Encrypted │ │
│ │ Credential │ │
│ │ Storage │ │
│ └─────────────┘ │
└──────────────────────────────────────────────────────────┘
Key Security Properties
-
Server-Side Only — All AI API calls are made from Vantage's server, never from the browser. API keys and data payloads never touch the client.
-
Encrypted Credentials — API keys are encrypted at rest in the database. They are decrypted only at the moment of an API call and never logged or exposed in responses.
-
Scoped Data Transmission — Only the minimum data necessary for the specific AI request is sent to the provider. Full databases, account credentials, and unrelated data are never transmitted.
-
No Persistent Storage by Providers — API-based usage of LLM providers generally does not result in data retention by the provider. Refer to each provider's API terms for specifics.
Credential Management
How API Keys Are Stored
- API keys are stored in Vantage's database using encryption
- Keys are associated with the organization, not individual users
- Only users with Admin or Owner roles can view, add, or delete API keys
Adding Credentials
- Go to Settings → AI Features → Intuidy AI
- Expand the desired provider
- Enter your API key in the secure input field
- Click Save Credentials
- The key is immediately encrypted and stored
Deleting Credentials
- Go to Settings → AI Features → Intuidy AI
- Expand the connected provider
- Click Delete Credentials
- The encrypted key is permanently removed from the database
Key Rotation
To rotate an API key:
- Generate a new key from your provider's dashboard
- In Vantage, delete the existing credentials
- Enter the new key and save
- AI features resume immediately with the new key
Data Privacy
What Data is Sent to AI Providers
| Feature | Data Sent |
|---|---|
| AI Assistant | User's question, system prompt, context snippets, conversation history |
| Tile Summary | Tile data (or sample), tile title, chart type, visualization config, context snippets |
| Popup AI Chat | Tile data, user question, conversation history, context snippets |
| Workflow AI Nodes | Row data from the workflow step, node prompt/instructions |
What Data is NOT Sent
- Database connection strings or credentials
- User passwords or authentication tokens
- Data from other users' dashboards or tiles
- Full database contents (only relevant tile/workflow data)
- Vantage account or billing information
Data Sampling
For large datasets, Vantage can sample data before sending it to the AI provider. This:
- Reduces the amount of data transmitted
- Lowers token costs
- Speeds up response times
Configure this in Settings → AI Features → Query Settings with the Process Large Datasets toggle.
Organizational Controls
Domain Restrictions
Restrict which email domains can connect integrations to your Vantage instance. This limits the blast radius of any integration compromise.
Configure: Settings → AI Features → Domain Restrictions
Example: Allowing only @yourcompany.com ensures that only corporate accounts can connect external services.
Role-Based Access to AI Settings
| Role | Can Use AI | Can Configure Provider | Can Manage Credentials | Can View Org Usage |
|---|---|---|---|---|
| Owner | ✅ | ✅ | ✅ | ✅ |
| Admin | ✅ | ✅ | ✅ | ✅ |
| User | ✅ | ❌ | ❌ | Own usage only |
| Restricted | Configurable | ❌ | ❌ | ❌ |
Audit & Usage Tracking
All AI operations are logged in the token usage system:
- Who made the request (user ID)
- When the request was made (timestamp)
- What type of operation (assistant, summary, workflow, etc.)
- How many tokens were consumed
- Which provider and model were used
Access usage data at Settings → Account → Usage & Tokens.
Provider Security Comparison
| Provider | Data Retention | SOC 2 | GDPR | EU Hosting |
|---|---|---|---|---|
| Intuidy AI | None beyond request | — | ✅ | — |
| OpenAI | No retention via API (as of Mar 2023) | ✅ | ✅ | ❌ |
| Claude | No retention via API | ✅ | ✅ | ❌ |
| Gemini | Varies by plan | ✅ | ✅ | Optional |
| DeepSeek | Check provider terms | — | — | ❌ |
| Grok | Check provider terms | — | — | ❌ |
| Mistral | No retention via API | ✅ | ✅ | ✅ |
Note: Provider policies change. Always verify the latest terms directly with your chosen provider.
Recommendations
- Use Mistral if you have strict EU data residency requirements
- Rotate API keys periodically (every 90 days is a good cadence)
- Enable domain restrictions if you use integrations
- Configure data sampling for dashboards with sensitive large datasets
- Review usage logs monthly for anomalies
- Limit admin access — only those who need to manage AI settings should have Admin or Owner roles