Privacy and Security

Deutsch: Datenschutz und Sicherheit

This page explains what AI Studio keeps on your device, what it sends where, and how it protects your data.

What stays on your device

Your chats, settings, the indexes of your data sources, the transcripts of your recordings, and your visual briefings stay on your device, in the folders of AI Studio; see Backup and Restore. They aren't encrypted, so they are as safe as your user account.

What leaves your device

• Your requests go to the provider you choose: your messages, your attachments, and whatever tools and data sources found for them. An embedding provider receives the text of your documents to index them, and a transcription provider receives your recordings.
• The update check asks GitHub for new versions, every hour by default. You can change or switch it off under "Check for updates" in the Settings.
• Pandoc: the Pandoc dialog asks GitHub for the latest version. AI Studio downloads Pandoc only when you install it.
• Web pages and web search: only when you use them, AI Studio loads the address you entered or asks the search service you set up.
• Your organization's configuration server, if your IT department set one up.
• OpenRouter and Requesty learn with each request that it comes from AI Studio.

AI Studio sends nothing to its developers. There is no telemetry.

Your API keys

AI Studio keeps API keys, passwords, and tokens in the secure storage of your system: the Keychain on macOS, the Credential Manager on Windows, and a password manager with the Secret Service on Linux. They are never in a file of AI Studio and never in a backup. If the secure storage isn't available, AI Studio doesn't fall back to a file; it tells you what's wrong; see Troubleshooting.

Which provider sees what

• Provider confidence: you rate how far you trust each provider, and you can set a minimum for the app, for assistants, and for tools; see Provider Confidence.
• Data that must stay on your own servers: a data source on an ERI server can allow only self-hosted providers. Once a chat used such content, only matching providers may continue it; otherwise a red icon shows "The selected provider is not allowed in this chat due to data security or confidence-level requirements." The rule travels with the text: when you send it to an assistant, a less trusted provider "may not see the text sent to this assistant".
• Where a chat may send data: a data source decides whether tools may send data elsewhere after the chat read it; see Data Sources.

Protection against prompt injection

Documents, web pages, and data sources can hide instructions meant for the AI, for example, "ignore all previous instructions". AI Studio looks for such passages on your device and removes them before the content reaches the model: in attachments, in the files of data sources and of the Batch Processing assistant, in web pages, in found passages, and in answers you pass on to another assistant. The protection is always on.

When AI Studio removed something, a message says so. With "Show details when suspicious content was removed?" switched on, which is the default, the "Security notice" lists the removed passages and explains the pattern.

Labeling AI-generated content

With "Add a notice to AI-generated content?" in the Settings, answers you copy or export end with "This content was generated using artificial intelligence (AI)." The same holds for the files of the Batch Processing assistant. Code blocks, single tables, visual briefings, and the results of the Prompt Optimizer and the Assistant Builder stay unchanged. Rules such as the EU AI Act may require such a notice, for example, when you publish a text. The option is off by default.

Feature usage for operators of self-hosted servers

With "Share feature usage with operators of self-hosted servers?", requests to self-hosted providers and to LiteLLM name the feature that sent them, such as the chat or an assistant, along with the version of AI Studio and your operating system. This helps the operators, usually your organization, see which features are used. Cloud providers never receive these details. The option is off by default.

Log files

The log files contain no passwords. They may contain file paths, web search queries, addresses of pages read, and error messages of providers. Look through them before you share them; see Log Viewer.

Assistant plugins

Assistant plugins bring their own instructions for the AI. AI Studio checks them before you enable them; see Plugins.

Where to go next

• Provider Confidence
• Backup and Restore