This article is intended for admins, procurement teams, and Information Security stakeholders. It is suitable for sharing with your InfoSec team. For the broader Precursive platform security practices, refer to the Precursive Security, Privacy and Architecture Overview.

Data Privacy and Security Summary

• Data Ownership - Customers own their data. Precursive and its sub-processors do not claim any ownership of data submitted to or generated by the service.
• Use for Training - Customer data is not used to train AI models.
• Data Retention - Sub-processors may retain AI inputs and outputs for up to 30 days for abuse monitoring purposes, after which the data is deleted.
• Data Encryption - All data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 encryption.
• Data Residency - By default, AI requests are processed in the United States. For customers in the UK and EU, Precursive supports data residency within the UK or EU region via Microsoft Azure's OpenAI service.
• Security Standards - Precursive is audited to ISO 27001 and compliant with GDPR and CCPA. Sub-processors hold SOC 2 Type II, GDPR, and CCPA certifications.
• Access and Control - Precursive personnel do not have access to customer data sent to AI sub-processors. Sub-processors retain AI inputs and outputs for up to 30 days for abuse monitoring, after which the data is deleted.

Platform Architecture and Data Flow

Precursive AI runs within the customer's Salesforce instance as part of the Precursive managed package. The data used as context for AI analysis comes from within the customer's Salesforce org and remains under customer control at all times.

When an insight is generated, the flow is:

1. Context data is gathered from the customer's Salesforce org via Context Sources and Flows
2. The data is sent to AI sub-processors for processing - either OpenAI (standard deployment, United States) or Microsoft Azure OpenAI (UK/EU deployment), routed via Portkey (the LLM gateway used for usage metering and rate limiting)
3. The AI-generated insight is returned to the customer's Salesforce org

Data processed by AI sub-processors is retained for up to 30 days for abuse monitoring, after which it is deleted. Salesforce data residency is determined by the customer's own Salesforce region.

Handling of Personal Data (PII) and Compliance-Categorised Fields

Customers are in full control of what data is included in Context Sources. Nothing is sent to the AI automatically - you determine which Salesforce records and fields are used to provide context.

In addition to this general control, Precursive AI includes a compliance category filtering layer that specifically addresses fields tagged with Salesforce compliance categories.

How Compliance Category Filtering Works

Salesforce allows fields to be tagged with compliance categories at the field level: PII, HIPAA, GDPR, PCI, CCPA, and COPPA. By default, Precursive AI strips any field carrying one of these tags from the AI context before it is sent to the LLM. This is the secure default - no compliance-categorised data flows through unless you explicitly allow it.

This filtering runs server-side at context build time and cannot be bypassed from the client.

If your organisation's policy permits certain compliance-categorised fields to be included in AI context, an admin can configure this in the Data Privacy tab of Precursive AI Settings. For step-by-step instructions, see Configuring Compliance Category Filtering.

Extending Context with External Sources

Where customers choose to extend AI context using external sources (e.g. MCP servers or APIs), these sit outside Salesforce's native access control model. As such, Precursive requires admin-controlled configuration and recommends only trusted, validated data sources, as equivalent RBAC controls may not apply to data retrieved from external systems.

Insight Access Controls (RBAC)

When your org uses a private sharing model for Insight Results, Precursive AI enforces role-based access controls to ensure users only see insights derived from data they are permitted to access directly.

For all the details, see Insight Sharing and Access Control.

Logging and Monitoring

Customer data sent to AI sub-processors is not logged or retained by Precursive. There is no logging toggle to enable - this behaviour is constant.

Precursive does maintain internal execution logs for diagnostic purposes (such as run completion status, timing, and error details). These logs do not include customer context data sent to the AI service.

Secure Development Practices

The following secure development practices apply to Precursive AI:

• Static code analysis on every build
• Code reviews and version control for all changes
• Open source vulnerability scanning
• Secure CI/CD deployment pipelines

Use of Sub-processors

Precursive AI uses the following sub-processors for AI processing:

• OpenAI - AI model processing for standard deployments. Data location: United States. SOC 2 Type II, GDPR, and CCPA compliant. Data not used for model training.
• Microsoft Azure OpenAI - AI model processing for UK/EU deployments. Data location: UK or EU region. SOC 2 Type II, ISO 27001, GDPR, and CCPA compliant. Data not used for model training.
• Portkey - LLM gateway providing usage metering, rate limiting, and observability for AI requests. ISO 27001, SOC 2, and GDPR compliant. Customer data is transiently forwarded via Portkey for routing purposes only and is not stored by Portkey.

Data Residency Options

• Standard Deployment (US) - data is processed by OpenAI in the United States.
• UK/EU Deployment - for customers requiring regional data residency, data is processed by Microsoft Azure OpenAI within the UK or EU region.

For comprehensive information on international data transfers, data portability, backup and retention policies, and personnel security, refer to the Precursive Security, Privacy and Architecture Overview

Reporting a Security Concern

If a security issue related to Precursive is identified or suspected, please report it immediately: support@precursive.com