Data protection¶
The Data protection page ("Control who can manage data connections, what the assistant can read, and how long conversations are kept.") holds the organization's policies for data, once people are signed in. How people sign in is set on the organization's Security page.
Availability
- Who can do this: members with the Manage organization capability (for the organization). The Administrator preset includes it.
- Deployment: Actian SaaS and self-managed deployments.
To open it, go to Settings → Administration → Data protection.
The page has two parts:
| Part | What it contains |
|---|---|
| Access switches | Restrict connection management, Guardrail blocking and PII masking |
| Conversations | When someone deletes a conversation, Keep conversations for and Workspace exceptions |
Save your changes¶
Changes on this page are a draft until you save them. When you change a setting, a bar appears at the bottom of the page:
- Click Save to apply every change on the page at once.
- Click Discard to undo them.
If a change would erase conversations, AI Analyst asks you to confirm before it saves. See Confirm changes that erase conversations.
Each change is recorded in the organization's audit log.
Restrict connection management¶
By default, any member with the Edit capability in a Workspace that a data connection is attached to can add, edit or delete that connection. When Restrict connection management is on, only members with the Manage organization capability (Administrators) can add, edit or delete data connections. Other members keep read access to connections.
Guardrail blocking¶
Guardrail blocking stops a message that looks like an attempt to change the assistant's instructions, before the AI Analyst or Steward runs it. The switch is off until you turn it on.
With the switch off, AI Analyst still checks those messages and records the result. The message runs either way.
Each change is recorded as org.guardrail_blocking.set in the audit log.
What the check covers, and what it leaves alone, is described in Input guardrails.
People can send a stopped message anyway
Anyone who can reply in that conversation can choose Send anyway, and the message then runs. Slack and Teams use --send-anyway on the same message. The choice is recorded. Guardrail blocking is a pause and an audit trail. Separation between organizations, the semantic layer, Steward's approval step and read-only warehouse access are what keep data in bounds.
On a self-managed deployment the operator can switch the checks off for the whole deployment. The switch is then disabled and its description reads "Guardrails are switched off for this deployment, so blocking has no effect." See Guardrails.
When a message is stopped¶
The message stays in the conversation and does not count against the organization's message allowance. Explorer and Steward show: "This message looks like it tries to change my instructions, so it wasn't sent. If that's wrong, send it anyway."
Send anyway appears in conversations you can reply to. It sends the same message again, and that message runs. The audit log records it as turn.guardrail_overridden.
In Slack or Teams, send the same message again with --send-anyway on the end. The flag is removed before the assistant sees the text. A message that is only --send-anyway does not resend the previous message.
How confident the check must be before it stops a message is set for the deployment. The default is 0.9. On Actian SaaS, Actian sets it. See Guardrails.
PII masking¶
PII masking replaces personal identifiers in query results with stable placeholders before the AI Analyst or Steward's model reads them. Tables, charts and reports keep the real values, and so does the stored conversation.
The switch is off until you turn it on. There is no deployment-wide switch: this organization setting is the only control. Each change is recorded as org.pii_masking.set.
A change applies to the next message. An answer already running keeps the setting it started with. If AI Analyst cannot read the setting when a message starts, it masks for that message.
What is replaced, how to mark a dimension Sensitive or Cleared, and what still reaches the model are described in PII masking and Sensitivity.
Conversations¶
The Conversations section decides how long conversation content is kept. It covers questions, answers, query results and uploaded files. Saved charts and reports aren't affected: they're kept until someone deletes them.
The settings apply to every conversation in the organization: in Explorer, in Steward, in Slack and Teams, in Scheduled Insights, and in Studio test runs.
When a conversation is erased, its content is gone for good: its title, messages, query results, unsaved charts, uploaded files and feedback, including AI Analyst's traces of it. AI Analyst keeps only the fact that the conversation ran (when, how long, its outcome and who started it), so the counts in Monitoring stay correct. An erased conversation can't be opened anywhere, including Monitoring. Steward changes made in it can still be rolled back.
When someone deletes a conversation¶
When someone deletes a conversation decides what the Delete button does, everywhere in the organization:
| Option | What happens |
|---|---|
| Permanently delete (default, recommended) | The conversation is erased within a day and can't be recovered, even in Monitoring. |
| Hide | The conversation is hidden from people, but members with the Edit capability can still read it in Studio Monitoring until the retention period ends. |
Switching from Hide to Permanently delete also erases every conversation that was already deleted and hidden, at that night's cleanup. Switching back to Hide can't bring back conversations that were already erased.
Keep conversations for¶
Keep conversations for is the organization's default retention period: Keep forever, 30 days, 90 days (default), 180 days or 1 year.
The period is counted from a conversation's last message. Conversations older than that are erased every night. This applies under both delete options: Hide keeps deleted conversations visible in Monitoring, but not past the retention period.
Workspace exceptions¶
A Workspace can have its own retention period, shorter or longer than the default. All other Workspaces use the default.
- Under Workspace exceptions, click Add exception.
- In the Add workspace exception dialog, choose the Workspace and its retention period.
- Click Add exception, then click Save in the bar at the bottom of the page.
Each exception is listed under the setting with its Workspace's name and whether it's Shorter than default, Longer than default or Same as default. To change an exception, choose another period next to it. To remove one, click the X next to it. The Workspace then uses the default again.
Add exception is unavailable when every Workspace already has one.
Confirm changes that erase conversations¶
When you click Save, AI Analyst checks whether your changes would erase conversations. These changes can:
- switching to Permanently delete while there are hidden conversations
- shortening the default retention period
- shortening a Workspace exception
- removing an exception whose period is longer than the default
If they would, a dialog says how many conversations each change erases, for example "Erase 12 conversations tonight?". When several changes erase conversations, one dialog ("Save changes that erase conversations?") lists each change with its own count. The counts can overlap, so they aren't added up.
Click Erase and save to save, or Cancel to go back to your draft. Erasing happens at that night's cleanup and can't be undone.
Warning
Erased conversations can't be restored by you or by Actian. Before you shorten a retention period, make sure nobody still needs those conversations.