Skip to main content

AutogenAI data security overview

Updated

Learn how AutogenAI protects customer data, including authentication, encryption, cloud storage, third-party providers, and compliance standards.

Overview

AutogenAI is a hosted service that uses selected AI technologies to help teams approach RFPs and proposals. To produce relevant responses, AutogenAI uses customer content as part of library AI. This content typically includes:

  • Sales and marketing material
  • Product and service documentation, such as white papers, user guides, and manuals
  • Previous RFP responses
  • Other supporting information

This article is a high-level introduction to the data security risks of using AutogenAI and how AutogenAI mitigates them. For detailed information on certifications and policies, visit the AutogenAI trust center.

Security at a glance

  • Encryption: AES-256 at rest and TLS 1.2+ in transit
  • Access: Multi-factor authentication (MFA) or single sign-on (SSO)
  • Hosting: AWS, in any AWS region by agreement, including GovCloud
  • Internet AI: Can be disabled for any organization on request

User access

AutogenAI is a SaaS application, so all access methods originate in a browser. Depending on the options selected, users sign in with one of two methods:

  • MFA: Users enter a username, a NIST-level password, and a one-time password (OTP) code. The OTP is emailed to a defined address at sign-in.
  • SSO: AutogenAI can incorporate your existing single sign-on functions, so user access is part of your company security systems.

Library AI

The library is a structured content store that AutogenAI accesses to generate responses that include company details. An organization can populate the library in two ways:

  • User upload: Selected authorized users can upload content to the library. These users are responsible for keeping content up to date and for creating and maintaining folder structures and permissions.
  • SharePoint integration: An optional integration that lets AutogenAI libraries interact with selected SharePoint sites, folders, and files. It synchronizes whatever content is managed in the central store.

All content is encrypted with TLS 1.2+ in transit. With either method, content is stored in the hosted data storage environment described below.

Data storage

AutogenAI's cloud infrastructure provider is AWS. AWS services are provided under a standard agreement. AWS holds numerous security accreditations, including ISO 27001, SOC 2, and (for most services) FedRAMP authorization through JAB.

After an embedding process, the vectorized content is stored in a secure S3 database within the AWS Virtual Private Cloud (VPC). Embedding and vectorization break documents into sections to allow rapid, semantic searching.

All content is encrypted using AES-256 at rest and TLS 1.2+ in transit.

Internet AI

Internet AI sources information from the web to generate ideas, enrich responses, and support research. Built-in source linking lets users review and validate where information came from.

When internet AI is enabled:

  1. Selected text is securely sent to Exa AI, which identifies relevant websites.
  2. ScrapingBee scrapes those pages.
  3. The extracted content is used as source material for responses.

ScrapingBee never has access to customer data. It only retrieves the specified web page, which is always cited in the generated output.

Privacy and compliance

  • Exa AI is SOC 2 certified.
  • Exa AI acts as a processor and has committed to zero data retention.
  • Exa AI may retain only anonymized operational metrics for up to 90 days, never customer content.
  • Internet AI can be disabled for any organization on request.

AI model providers

AutogenAI may use the following providers for large language models (LLMs).

Amazon Bedrock

  • Models are pre-trained by multiple LLM developers, including Anthropic, Meta, Cohere, and Mistral.
  • AWS hosts the models in its cloud infrastructure, with a choice of geographical regions.
  • The original model developers have no access to client data.
  • Governed by the standard AWS Service Terms.

Microsoft Azure OpenAI

  • Servers are available in multiple regions, including the USA, EU, UK, and Australia. LLMs are hosted in the customer's local geography unless otherwise specified.
  • Azure OpenAI services are FedRAMP authorized. Microsoft and Microsoft Azure hold numerous security accreditations, including SOC 2 and ISO 27001.
  • Models are pre-trained and do not retain, train on, or learn from customer data.
  • Governed by:
    • The standard Microsoft Products and Services Data Protection Addendum, applicable to each country in which Microsoft operates
    • The Azure OpenAI service-specific terms
    • A modified abuse monitoring agreement, which confirms that Azure will not retain user inputs or generated text associated with AutogenAI's use of the service. This makes the standard service-specific terms on abuse monitoring inapplicable.

Mistral

  • Servers are located in Sweden.
  • Mistral is SOC 2 and ISO 27001 compliant, undergoes annual penetration testing, and complies with GDPR.
  • Governed by:
    • The standard Mistral Terms of Service, which affirm that Mistral will not use received or generated content to train its models
    • A Zero Data Retention Amendment, which ensures that Mistral does not retain user inputs or generated text associated with AutogenAI's use of the service

Google Gemini

  • Servers are available in multiple regions, including the USA, EU, UK, and Australia. LLMs are hosted in the customer's local geography unless otherwise specified.
  • Gemini services are FedRAMP authorized. Google Cloud Platform holds numerous security accreditations, including SOC 2 and ISO 27001.
  • Models are pre-trained and do not retain, train on, or learn from customer data.
  • Governed by the Google Cloud Terms of Service.

OpenAI

  • Servers are located in the USA.
  • OpenAI is SOC 2 compliant, undergoes annual penetration testing, and complies with GDPR and CCPA.
  • Models are pre-trained and do not retain, train on, or learn from customer data.
  • Governed by:
    • The standard business terms for API use, which affirm that OpenAI will not use received or generated content to train its models
    • A Data Processing Agreement, which defines the data processing roles and responsibilities of both parties
    • A Zero Data Retention Amendment, which ensures that OpenAI does not retain user inputs or generated text associated with AutogenAI's use of the service

Certifications and standards

  • ISO 27017: Identifies security controls applicable to the use of cloud services. The ISO 27017 Statement of Applicability (SoA) is available.
  • ISO 27018: Focuses on protecting personal data in cloud computing environments.
  • SOC 2: An independent audit report on controls relevant to security, availability, and confidentiality.
  • Cyber Essentials: Demonstrates a commitment to safeguarding digital assets and protecting against common online threats.
  • Cyber Essentials Plus: Adds assurance on top of Cyber Essentials by using an external certifying body to assess the practices in place.
  • Cloud Security Guidance: Provided by the National Cyber Security Centre to ensure AutogenAI has selected, configured, and used cloud services securely.
  • CSA STAR: A framework that helps organizations manage and communicate security practices for cloud services.
  • CSA Trusted Provider: Recognition for cloud service providers that meet high standards of security, reliability, and transparency.
  • GDPR: AutogenAI complies with GDPR so that personal data is handled with care and respect for privacy.

For further details, request access to the AutogenAI trust center.

Glossary

  • Hosted service: AutogenAI uses hosting partners to provide continuous monitoring, infrastructure security, and timely maintenance updates.
  • Data storage: AutogenAI uses Amazon Web Services to store the customer content used to generate RFP responses.
  • Encryption: Transforming information so that only authorized parties can decode it.
  • Embedding: The process of using AI to create vectors. An embedding is the output of this process.
  • Vectors: Numerical representations of words, entities, documents, images, or videos. Vectors capture semantic relationships between elements, so searches are faster and return more relevant results. Matches are based on the vectors most similar to the query vector, which works across:
    • Conceptual likeness ("dog" and "canine")
    • Multilingual content ("dog" in English and "hund" in German)
  • LLM (large language model): An AI algorithm that processes and understands human language or text. All LLMs used by AutogenAI are pre-trained with validated content. LLMs can be used for tasks such as text generation, machine translation, and summary writing.

Related to