Confidence and Data Security

AI Studio decides with four independent controls which provider may see which data, and what a chat may still do once it has seen internal content:

Control	Question it answers	Applies to
Confidence	How much do you trust a provider?	Every kind of provider, per provider type
Data security	May this provider see the content of a confidential data source?	Single provider entries
Outbound data restriction	Where may a chat still send data after the AI found internal content?	Tools in a chat
Prohibition	May AI Studio contact this provider at all?	Provider types, see Providers and API Keys

Keep them apart when you plan: each one has its own settings, and one doesn't replace another.

Confidence

Levels

Each provider has a confidence level. From lowest to highest: "Untrusted", "Unknown", "Very Low", "Low", "Moderate", "Medium", "High".

The level belongs to the type of a provider, not to a single entry: all providers of the type OPEN_AI share one level, and so do all self-hosted providers, whichever server software they use. AI gateways such as LiteLLM and Requesty are types of their own, not self-hosted providers.

Schemes

A confidence scheme assigns the levels. Choose one with DataConfidence.ConfidenceScheme:

Scheme	Self-hosted	Other providers
TRUST_ALL (default)	High	Medium
TRUST_USA_EUROPE	High	Medium for providers based in the USA or Europe, Low for the others
TRUST_USA	High	Medium for providers based in the USA, Low for the others
TRUST_EUROPE	High	Medium for providers based in Europe, Low for the others
TRUST_ASIA	High	Medium for providers based in Asia, Low for the others
LOCAL_TRUST_ONLY	High	Very Low for every other type, AI gateways included
CUSTOM	Your table	Your table

The settings page of AI Studio shows which level each provider gets under each scheme.

With CUSTOM, you set the level of each provider type in DataConfidence.CustomConfidenceScheme. A type you leave out gets "Unknown". The example plugin lists all provider keys:

CONFIG["SETTINGS"]["DataConfidence.ConfidenceScheme"] = "CUSTOM"
CONFIG["SETTINGS"]["DataConfidence.CustomConfidenceScheme"] = {
    ["SELF_HOSTED"] = "HIGH",
    ["LITE_LLM"] = "HIGH",
    ["<PROVIDER_KEY>"] = "<LEVEL>",
    -- … one line for every other provider type you want to allow
}

DataConfidence.ShowProviderConfidence decides whether users see the levels in the app.

Minimum confidence

A minimum keeps providers below a level away from a task. AI Studio then offers only providers that meet it.

• For the whole app: DataConfidence.EnforceGlobalMinimumConfidence = true with DataConfidence.GlobalMinimumConfidence, one of VERY_LOW, LOW, MODERATE, MEDIUM, or HIGH. It applies everywhere, in the chat as well as in every assistant.
• For single places, a higher one:
  • Assistants have a minimum in their settings. You can manage it centrally for the Batch Processing Assistant, the Visual Briefing Assistant, the Assistant Builder, and for each document analysis policy, see Assistants and Templates. For the other assistants, only users set it.
  • Tools have a minimum each, see Tools and Web Access.
  • Each local data source and each mailbox has a required level, which users set. You can't set it centrally.
• The highest minimum wins wherever several apply.
• A chat remembers. Once content that requires a certain level reached a chat, for example, passages from a local data source, the chat keeps requiring that level.

CONFIG["SETTINGS"]["DataConfidence.EnforceGlobalMinimumConfidence"] = true
CONFIG["SETTINGS"]["DataConfidence.GlobalMinimumConfidence"] = "MEDIUM"

Data security of data sources

Confidence is a level; data security is a yes or no. It answers one question: may this provider see the content of a data source that must stay inside your organization?

• An external data source on an ERI server has a security policy: ALLOW_ANY or SELF_HOSTED. The ERI server can also demand SELF_HOSTED itself.

• With SELF_HOSTED, only trusted providers see its content: every self-hosted provider, and every provider entry that your configuration lists in DataSourceSecuritySettings.TrustedProviderIds, by its Id:

  CONFIG["SETTINGS"]["DataSourceSecuritySettings.TrustedProviderIds"] = {
      "4f6b3a8e-2d4c-4b1a-9e5f-7a8b9c0d1e2f",
  }

• Once such content reached a chat, the chat stays limited to trusted providers.

• A provider needs both: it must be trusted, and it must meet the confidence that applies.

Trusting a provider doesn't raise its confidence. That's on purpose: the list says "this cloud service counts as internal for our data", the confidence says "this is how much we trust its models in general". When you want a contracted cloud service to handle everything your own servers handle, you need both: list its entries in TrustedProviderIds, and give its type the level of your own servers in a CUSTOM scheme.

Where a chat may send data

Content from your data sources may contain instructions meant for the AI, for example, in a document from outside. Every data source therefore decides where a chat may still send data once the AI found something in it:

Level	What the chat may still do
ONLY_CONFIGURED_SERVICES	Use only services configured in AI Studio, such as your data sources, your Confluence, or the allowed private hosts of the tool Read Web Page. No other web pages, no web search.
ONLY_LINKS_FROM_CHAT	Also read web pages whose addresses stand in the chat, written by the user or returned by a tool. No web search, and no addresses the AI chooses itself. New data sources start here.
UNRESTRICTED	Use every tool the user selected.

• DataSourceSecuritySettings.MinimumOutboundDataRestriction sets the least strict level any data source may have. A data source set to a less strict level gets yours whenever its passages reach a chat, and its dialog no longer offers the less strict levels.
• An external data source with the security policy SELF_HOSTED always gets ONLY_CONFIGURED_SERVICES.
• Only data sources whose passages actually reached the AI count. A search that found nothing leaves the chat as it was.
• A chat keeps the level it got. The levels restrict tools, not providers.

CONFIG["SETTINGS"]["DataSourceSecuritySettings.MinimumOutboundDataRestriction"] = "ONLY_LINKS_FROM_CHAT"

Internal web pages that the tool Read Web Page fetches have a level of their own, see Tools and Web Access.

Rolling out data sources on ERI servers

Data sources are a preview feature. Enable it for your users with PRE_RAG_2024 in DataApp.EnabledPreviewFeatures. You can roll out data sources on ERI servers, the external retrieval interface of AI Studio. Local files and folders exist on one device only and can't be rolled out.

CONFIG["DATA_SOURCES"] = {}

CONFIG["DATA_SOURCES"][#CONFIG["DATA_SOURCES"]+1] = {
    ["Id"] = "6a1d2c3b-4e5f-4a6b-8c7d-9e0f1a2b3c4d",
    ["Name"] = "Project archive",
    ["Type"] = "ERI_V1",
    ["Hostname"] = "https://eri.intra.example.org",
    ["Port"] = 443,
    ["AuthMethod"] = "TOKEN",
    ["Token"] = "ENC:v2:<the encrypted token from your export>",
    ["SecurityPolicy"] = "SELF_HOSTED",
    ["OutboundDataRestriction"] = "ONLY_CONFIGURED_SERVICES",
    ["SelectedRetrievalId"] = "<retrieval process ID from the ERI server>",
    ["MaxMatches"] = 10,
}

• SecurityPolicy is required: ALLOW_ANY or SELF_HOSTED.
• AuthMethod is NONE, TOKEN, or USERNAME_PASSWORD. With USERNAME_PASSWORD, UsernamePasswordMode decides whether everybody uses a shared username (SHARED_USERNAME_AND_PASSWORD) or their own operating system username with a shared password (OS_USERNAME_SHARED_PASSWORD).
• Encrypt tokens and passwords as described on Providers and API Keys.
• DataApp.AllowUserToImportERIDataSource decides whether users may import ERI data sources that others exported.

Attached files that change later

A chat reads a file attached to a message once, when the message is sent first, and keeps its text. Later messages send the AI that same text, even when the file changed or is gone. Users can switch this in the chat options; you can set it with DataChat.ReadChangedAttachmentsAgain: with true, AI Studio reads a changed file again for the next message.

Mailboxes (prototype)

Mailboxes are a prototype: enable PRE_MAILBOXES_2026 together with PRE_RAG_2024 in DataApp.EnabledPreviewFeatures. Users add a mailbox as a data source, with their own username and password for an IMAP server. AI Studio synchronizes it every 16 minutes and keeps a local index, which the tool collection mailboxes searches and reads.

Setting	Effect
DataApp.AllowUserToAddMailbox	false keeps users from adding mailboxes. Mailboxes they added before stay.
DataMailboxes.MinimumOutboundDataRestriction	The least strict outbound level a mailbox may have. New mailboxes start with ONLY_CONFIGURED_SERVICES, because mails come from strangers.
DataMailboxes.AllowOnlyOrganizationMailServers	true allows mailboxes only on the mail servers your configurations offer. A mailbox on another server stops synchronizing at once; its index stays.
CONFIG["MAILBOX_PROVIDERS"]	Your mail servers, offered first in the mailbox dialog: Id, Name, Host, TransportSecurity (SSL_ON_CONNECT or STARTTLS), Port, and optionally UsernameHint and HelpUrl.
DataTools.DisabledToolIds with mailboxes	Keeps the AI from reading any mailbox.

Every mailbox also requires a confidence level of its own, which both the chat provider and the embedding provider must meet.

Where to go next

• Providers and API Keys
• Enterprise IT