Data Protection settings

Status: Current | Last reviewed: 2026-09-10

Data Protection sets a tenant-wide policy for sensitive data (PII/PHI): which data types are detected, how they are detected, and what happens at each boundary where conversation content leaves the platform. While the policy is off, only the per-agent compliance flags apply — enabling it only ever tightens protection.

You need the tenant Admin role. Settings → Tenant Settings is visible only to tenant admins and platform admins — the Manage Configuration permission on its own is not enough, so operators won't see it.

Configure the policy

  1. Open Settings → Tenant Settings → Data Protection.
  2. Turn on Enable data protection.
  3. Choose a Compliance profile (None, HIPAA, PCI, or GDPR). The profile constrains provider, model, and region choices when agents are published.
  4. Choose a Detector tier:
    • Rules (built-in) — checksum and pattern detectors that run inside the platform. No extra setup.
    • Self-hosted model — a locally hosted detection model for broader coverage.
    • Cloud service — a cloud detection service (for example AWS Comprehend, GCP DLP, or Azure AI Language). Pick the Detector integration that connects to your own account; the cloud tier can't be enabled without one.
  5. Set an action for each Boundary — Provider, Tool calls, Conversation store, Telemetry, Recordings, and Notifications can each be Off, Flag, Redact, or Block.
  6. Under Entity types, check the data types in scope (names, emails, card numbers, and so on). Leaving all unchecked includes every type the selected detector tier supports.
  7. Select Save settings.

Changes take effect within about a minute — no restart required.