How UseGlic protects data across AI models
How workspace boundaries, model routing, personal-data inspection and connected-service controls work together.
One privacy check is an extra layer; good security maps the whole data path.
A model request is only one part of the data path.
Consider a teammate preparing a customer response. The workflow may use the original message, instructions, conversation history, retrieved business material and results from connected tools. The answer may then be stored or sent to another service. Looking only at the model call misses the rest of the journey.
Security boundaries differ. Workspace settings govern where data is hosted and stored. Model routing governs which model service receives an inference request. A personal-data check can reduce selected identifying values in that request. A connected service has its own boundary when the teammate sends it information.
Workspace hosting is in Europe by default, and an organisation can select its workspace region. That setting does not automatically pin every model or connected service to the same location; processing depends on the route and services selected, and some model routes can cross regions. A privacy control at one point does not relocate stored data or govern every downstream service.
Take this with youMap the full workflow before deciding what data is protected, where it goes and which controls apply.
Follow the data beyond the privacy check
A person makes a request
A user shares a task with an AI teammate. The workspace may also hold conversation history and other enabled records.
Under the hood
Check workspace region, storage and access settings separately from the outbound inference path.
The teammate gathers context
The workflow may add instructions, approved retrieved information or tool results to the request.
Under the hood
The content sent onward may include more than the latest user message. Inventory each feature that contributes data.
Add the personal-data check
In a selected pilot workflow, the check replaces personal details it detects with temporary references before the request continues.
Under the hood
This check is not on every route and can miss information. A failed inspection stops the selected request; verify coverage for each supported input type.
Route, respond and hand off
The request follows its configured model route. The response returns to the teammate and user; any information sent to a connected service crosses a separate boundary.
Under the hood
Review model destination, region, non-chat model calls, fallbacks, persistence and connected-service actions independently. Original values are not automatically restored into model history.
Use separate controls for separate boundaries.
First, workspace controls and service settings govern the platform boundary: where workspace data is hosted, which people and teammates can access it, and what information the workflow retains. Conversation history and other enabled records may remain in the workspace even when an outbound request is masked.
Second, model routing governs where inference is processed. When an external model service handles a request, the content included in that request crosses the UseGlic boundary. That content can include more than the user’s latest message. Review model inputs, embeddings or other model tasks, selected region, configured fallbacks and applicable provider terms for the actual workflow.
Third, personal-data inspection is an extra layer before model processing in a selected pilot workflow. It replaces detected values with temporary references while aiming to preserve useful context. It is not universal, cannot guarantee detection of every sensitive detail and does not replace the routing or workspace controls.
Finally, connected services are a separate handoff. If a teammate sends information to a service the workspace has connected, that information leaves UseGlic and is handled under that service’s own terms. Send only what the action requires and review the destination’s permissions.
Under the hood +
Self-managed models are not currently a supported production route. They may be considered as a separate deployment architecture only after product, security and operational review. Do not infer that masking covers every payload type or pathway: qualify chat, retrieved context, tool arguments and results, embeddings, files, memory, non-chat model tasks, retries and fallbacks independently.
Verify each handoff, not just the diagram.
For each real workflow, write down what enters, what is stored, what is added to the model request, which model service and region process it, what can trigger a fallback, and which connected service may receive the result. Confirm which controls are active at every step.
Use synthetic examples to test ordinary requests, personal details, attachments, tool results, denied destinations and inspection failures. Check that failures stop safely, that logs do not expose the content, and that the returned answer remains useful after masking.
The personal-data check is an additional privacy layer, not a blanket guarantee that information never leaves UseGlic. A precise data map, appropriate routing and careful control of connected-service sharing complete the picture.
Take this with youSecurity is the combination of controls at every boundary a workflow crosses.
Is the personal-data check an extra layer on every AI request?
No. It is an additional inspection step for a selected pilot workflow. It does not replace workspace access controls, model routing or provider review, and it is not universal coverage.
What information can be sent to an AI model service?
The request may include the user’s message, instructions, relevant retrieved context and, depending on the workflow, tool results or other content. Review the full path—including non-chat model tasks and fallbacks—because the exact payload and destination depend on configuration.
Can UseGlic run a model in a customer-managed environment?
Self-managed models are not currently a supported production route. A customer-managed deployment would require explicit product, security and operational review; do not assume it is available for a workspace.
What happens when an AI teammate uses a connected service?
Information that the teammate sends to a connected service leaves the UseGlic boundary. That service processes it under its own terms and privacy practices, so send only what the workflow needs.