This article is for admins, procurement, InfoSec, Legal, Privacy and works council stakeholders, and can be shared with them directly. It covers Precursive AI. For the Precursive PSA platform, see the Precursive Security, Privacy and Architecture Overview.

Platform Architecture and Data Flow

Precursive AI is a separate Precursive managed package, installed in your Salesforce org alongside an LLM Gateway connector package. Its agents, called Zen Agents, are configured in your org. Their configuration, the context they gather and the insights they produce are all stored as records in your org.

Unlike the PSA platform, Precursive AI processes data outside Salesforce. To generate an insight, the prompt (agent instructions plus the context you have configured) is sent to two services that Precursive operates through sub-processors: an AI gateway provided by Portkey, and large language models hosted on Microsoft Azure OpenAI. Portkey does not keep request or response content. Microsoft stores prompts and responses only when its abuse monitoring flags them for human review. Microsoft does not publish a fixed retention period; see Microsoft's documentation.

The numbered steps below match the diagram:

1. Zen Agents. An admin defines each Zen Agent: its data scope and filters, prompt instructions, actions, schedule and recipients, insight distribution, and permissions and sharing. A user, schedule, Flow or list view then starts a run.
2. Agent execution. The run starts inside your org. Everything up to step 4 happens inside Salesforce.
3. Context retrieval. Context Sources retrieve the configured Salesforce data and, if configured, data from your business applications over MCP or APIs. Retrieval runs in user mode by default. Back in agent execution, field metadata (such as labels and types) is added, fields tagged with compliance categories are removed, and the remaining context is combined with the agent's instructions.
4. LLM Gateway. The prompt leaves Salesforce over TLS to the Portkey gateway. Portkey checks entitlements and routes the prompt to the Azure OpenAI deployment in your primary region (or the other region, if you permit fallback and the primary is unavailable). It doesn't store the content.
5. LLM Models. An OpenAI model hosted on Microsoft Azure OpenAI generates the insight and any recommended actions, in the EU or US data zone.
6. Response safeguards. The response returns to your org and is stored there with its context, as an audit trail. Each point cites the records it came from, and recommended actions carry their rationale. Insights are shown only to users who can access the underlying records. Actions wait for a user's approval unless an admin has made them Autonomous, and users can give feedback on every insight.

Shared Responsibility Model

Responsibility for Precursive AI is shared between you, Precursive and Precursive's sub-processors.

• Customer: You decide whether Precursive AI is used and what it can see. You configure agents, choose which objects, fields, Files and external applications provide context, decide which compliance categories (if any) may be sent, choose a primary region and whether fallback is permitted, and control who can run agents and view insights through Salesforce permissions and sharing. Connecting an external application is your decision, and so is its configuration. You are also responsible for having a lawful basis for the data you submit, and for reviewing AI outputs before acting on them.
• Precursive: Precursive designs, develops and supports the Precursive AI packages. It operates the AI gateway and the Azure OpenAI resources that process requests, and it selects and versions the models. It maintains the data access, compliance filtering and insight access controls described in this article, and manages its sub-processors under written data processing agreements.
• Sub-processors: Portkey runs the AI gateway infrastructure. Microsoft runs the Azure OpenAI service and the data centres where models run. Salesforce continues to host your org and all stored data.

Deployment Model

Precursive AI is a hosted service operated by Precursive. The application runs in your Salesforce org; the gateway and models are run by Precursive on Portkey and Microsoft Azure. Running the models in your own Azure tenant or private cloud is not offered.

Precursive AI is off until it has been provisioned for your org and an admin has installed the packages, assigned permission sets, and configured at least one agent with its context. Your InfoSec, Legal and Privacy reviews can be completed before any data leaves Salesforce.

Data Access and Least Privilege

You choose what Precursive AI can see. Nothing is sent automatically: each agent uses only the objects, fields, related records, Files and external sources its admin has configured.

Context is retrieved in user mode by default, so the running user's object, field and record-level permissions apply. An agent can't see anything the person running it can't see. An admin can switch a Context Source on Opportunity or Opportunity Product to System Mode, for example so Platform-licence users can get insights on opportunities they can't open. Every change to this setting is recorded in an audit log in your org (who changed it and when), and a protected setting can block System Mode entirely.

Insights inherit the same principle. Under a private sharing model, a user sees an insight only if they can access the records it was built from. See Insight Sharing and Access Control.

Precursive AI is read-only by default. Agents read data and write only their own results. Actions can update Salesforce records, but they run in Supervised mode by default: the AI recommends, and a user decides whether to apply. An admin can make an individual action Autonomous, so it applies automatically when the model's confidence is 90% or higher. These appear as "Auto-applied" in results, and every change runs under the user's Salesforce permissions.

External business applications are reached only through admin-configured Named Credentials, using MCP servers or API actions. Data retrieved from them is outside Salesforce's sharing model, so connect only trusted systems and scope the connection's credentials to what the agent needs.

Handling of Personal Data (PII)

Salesforce lets admins tag fields with compliance categories: PII, GDPR, HIPAA, PCI, CCPA and COPPA. By default, Precursive AI removes every tagged field from the context before anything is sent outside Salesforce. This filtering runs server-side when context is built and can't be bypassed from the browser. If your policy allows a category to be used, an admin can allow it in Precursive AI Settings → Data Privacy. See Configuring Compliance Category Filtering.

Fields that hold personal data but aren't tagged are sent if they're included in a Context Source. Review your compliance-category tagging, and each agent's field selection, before enabling Precursive AI.

Under the Precursive AI Terms of Service, sensitive personal data such as health or payment card information may not be processed through Precursive AI without Precursive's prior written consent.

The Salesforce user ID of the person running an agent is sent with each request. It's used for entitlement metering and as an abuse-monitoring identifier for Microsoft, and never for profiling.

Data Residency and Model Routing

All models run on Microsoft Azure OpenAI Data Zone Standard deployments, in an EU data zone (resource in Sweden Central) and a US data zone (resource in East US 2). A Data Zone Standard deployment keeps model processing inside its data zone. Any prompts and responses Microsoft stores for abuse monitoring stay in the geography where the Azure resource is deployed.

You choose two things:

• Primary region: EU or US. Model processing takes place in that data zone.
• Fallback: whether requests may fall back to the other data zone if the primary deployment is unavailable.

Primary region	Fallback permitted	Fallback not permitted
EU	EU data zone, falling back to the US data zone only if the EU deployment is unavailable	EU data zone only. Requests are never processed in the US.
US	US data zone, falling back to the EU data zone only if the US deployment is unavailable	US data zone only

Choosing EU with no fallback is the only way to guarantee model processing in the EU.

Whatever you choose, every request passes through the Portkey gateway, which runs in US regions (see AI Gateway). Your stored Salesforce data stays in your Salesforce org's region.

AI Gateway

Precursive routes every AI request through a gateway provided by Portkey. The gateway does two jobs:

• Entitlement enforcement: each org can use only the agents, models and volume it's licensed for, and usage is metered per org.
• Model routing: each request goes to the Azure OpenAI deployment in your primary region, and fails over to the other region only if you have permitted fallback.

Portkey's gateway is hosted in US regions and delivered through Cloudflare's network. The gateway reads each request in memory so it can route it, then forwards it unchanged. Precursive's Portkey workspace uses "Metrics only" logging, so no request or response content is stored. Portkey records only operational metrics (timestamp, token counts, cost, latency, model and status) and the request metadata described in the next section, and keeps them for 12 months for usage analytics.

Portkey is a Precursive sub-processor under a signed data processing agreement.

International Data Transfers

Transfers between the UK and the EEA need no additional safeguards, because each recognises the other as providing adequate data protection. Where personal data is transferred to a country without an adequacy finding, including the US hop through the AI gateway, transfers are made under the EU Standard Contractual Clauses (Decision (EU) 2021/914, Module Two: Controller to Processor), supplemented for UK transfers by the ICO's UK Addendum. Unless your Order Form says otherwise, the clauses are governed by Irish law. The full terms are in clause 5 of the Data Processing Addendum.

Data Sent Outside Salesforce

Each request contains content and metadata.

The content is the agent's instructions (Precursive's system prompt plus your configured instructions) and the filtered context. It passes through Portkey without being stored, and is processed by Azure OpenAI.

The metadata identifies the request so it can be checked against entitlements, routed and metered. It uses Salesforce record IDs rather than names, and contains no record names, field values or other business content apart from the org name.

Metadata	Contents
Org	Salesforce org ID, org name and org type (for example production or sandbox)
User	Salesforce user ID of the running user
Entitlement	Entitlement key and agent tier the request counts against
Records	Salesforce IDs of the agent, the insight result and, for actions, the agent action
Request	Request type (insight or action), what triggered it (for example UI, schedule or Flow), and the installed package version

Data Retention and Deletion

Outside your org, retention is limited to the minimum each service needs:

Location	What is kept	How long
Your Salesforce org	Insight results, recommended actions, the context snapshot (as Files), user feedback and interactions	Until you delete them
Microsoft Azure OpenAI	Only prompts and responses flagged by abuse monitoring for human review, stored in the geography where the Azure resource is deployed	No fixed period published by Microsoft; see Microsoft's documentation
Portkey	Operational metrics and request metadata. No request or response content.	Content: not retained. Metrics and metadata: 12 months
Precursive	No prompts or responses. Internal diagnostic logs hold only run status, timing and error details.	—

Microsoft's automated abuse monitoring checks every request for harmful content and patterns of misuse, such as repeated attempts to get round content filters. Nothing is stored at this stage. A prompt and response are stored only if they are flagged and Microsoft's automated review can't resolve them, so that authorised Microsoft staff can review them. For deployments in the European Economic Area, those reviewers are located in the EEA. Microsoft doesn't report when an individual request is stored or reviewed. If it confirms abuse, it notifies the Azure account owner, which is Precursive. The detail is set out in Microsoft's Data, privacy, and security for Foundry Models sold by Azure and Abuse monitoring documentation. Microsoft's data processing is governed by the Microsoft Products and Services Data Protection Addendum.

Inside your org, deleting an insight result also deletes its context Files and the user interaction records linked to it. Uninstalling the Precursive AI package removes all of its data, and Salesforce generates a data export file for the user performing the uninstall.

On termination, under clause 3.7 of the Data Processing Addendum, Precursive will delete or return all customer personal data it holds, at your option, within 30 days, and will certify deletion on written request.

Encryption

All traffic between Salesforce, the Portkey gateway and Microsoft Azure OpenAI is encrypted in transit with TLS 1.2 or higher. Data stored in your org is encrypted at rest by Salesforce, and Salesforce Shield Platform Encryption can be applied where your edition supports it.

Use of Sub-processors

Precursive AI uses the following sub-processors in addition to Salesforce:

Sub-processor	Purpose	Location	Certifications	Content retention
Microsoft (Azure OpenAI)	Model inference	Your primary region, plus the other data zone if you permit fallback	ISO 27001/27017/27018, SOC 2 Type II, GDPR	Only content flagged for human review; no fixed period published (Microsoft documentation)
Portkey	AI gateway: entitlement enforcement, model routing, usage metering	US regions, delivered through Cloudflare	ISO 27001, SOC 2 Type II, GDPR, HIPAA	None (metrics only)

The current sub-processor list is maintained in the Precursive Privacy Policy.

AI Model Use and Training

Precursive AI uses OpenAI models hosted on Microsoft Azure OpenAI. Customer data is never used to train, retrain, fine-tune or improve any model, by Precursive, Microsoft, Portkey or any other third party.

Microsoft's commitment is set out in its Data, privacy, and security documentation: prompts and completions are not available to OpenAI and are not used to train, retrain or improve the models.

AI Risk Controls

• Prompt injection: Precursive's system prompt separates instructions from data. Salesforce records and content from external applications are passed to the model as a structured data block, labelled as context data, while instructions come only from Precursive's system prompt and your admin-configured agent instructions. The model must return a fixed response format and cite the context data behind every point it makes. Agents can only use the fixed set of actions an admin has configured, so the model can't invent new operations. Supervised actions also need a person to approve them.
• Content safety: Azure OpenAI's content filtering is applied to every request and response.
• Accuracy and human oversight: Insights are generated by AI and can be wrong. Each insight links to the records it was built from, so users can check it. Users can give feedback on insights, and Supervised actions keep a person in control of every change.
• EU AI Act: Precursive AI is designed for project, account and delivery insight. Under clause 2.4 of the Precursive AI Terms of Service, it must not be the sole basis for decisions with legal or similarly significant effects on individuals without meaningful human review. That includes uses treated as high-risk under the EU AI Act, such as employment and worker management. Precursive doesn't provide Precursive AI for high-risk uses, and doesn't act as a provider or deployer of a high-risk AI system in respect of your use.

Logging and Audit

Precursive AI keeps its audit trail in your org. Agent runs, insight results, the context used, recommended and auto-applied actions, and user feedback are all stored as records you can report on. Configuration changes appear in the Salesforce Setup Audit Trail, and changes to System Mode access are recorded in the Precursive AI audit log.

Outside your org, Portkey holds the operational metrics described above, and Precursive keeps internal diagnostic logs of run status, timing and errors. Neither contains prompt or response content, so Precursive personnel have no access to customer data sent to AI sub-processors.

Secure Development

Precursive AI is built under the same secure development lifecycle as the Precursive platform. This includes static code analysis on every build, peer code review with version control, open-source dependency scanning, and hardened CI/CD pipelines.

Compliance and Certifications

Precursive operates an information security management system certified to ISO/IEC 27001:2022 and audited annually; Precursive AI is in its scope. Precursive supports customer compliance with GDPR, the UK Data Protection Act and CCPA. Personal data processing is governed by the Privacy Policy, the Data Processing Addendum and the Precursive AI Terms of Service.

On request, Precursive can provide the ISO 27001 certificate and Statement of Applicability, the Data Processing Addendum and the Precursive AI Terms of Service.

Incident Response

Precursive maintains a formal incident response process covering classification, escalation, customer notification, root cause analysis and corrective action. Under clause 3.5 of the Data Processing Addendum, Precursive notifies you without undue delay on becoming aware of a personal data breach, with the nature of the breach, its likely consequences and the measures taken. Where the CCPA Addendum applies, notification is within 72 hours.

Reporting a Security Concern

If you identify or suspect a security issue related to Precursive AI, contact us immediately: support@precursive.com