This article is for admins, procurement, information security (InfoSec), Legal, Privacy, and works council stakeholders, and can be shared with them directly. It covers Precursive AI, including a summary of the Precursive AI MCP Server. For the Precursive professional services automation (PSA) platform, see the Precursive Security, Privacy and Architecture Overview.

Architecture and shared responsibility

The following sections describe how Precursive AI is built and deployed, how data flows through it, and who is responsible for each part.

Platform architecture and data flow

Precursive AI is a separate Precursive managed package, installed in your Salesforce org alongside the Precursive AI LLM Gateway package, which connects it to the large language model (LLM) gateway. Its AI agents, called Zen Agents, are configured in your org. Their configuration, the context they gather, and the Insights they produce are all stored as records in your org.

Unlike the PSA platform, Precursive AI processes data outside Salesforce. To generate an Insight, the prompt (Agent instructions plus the context you have configured) is sent to two services that Precursive operates through sub-processors: an AI gateway provided by Portkey, and large language models hosted on Microsoft Azure OpenAI. Portkey does not keep request or response content. Microsoft stores prompts and responses only when its abuse monitoring flags them for human review. Microsoft does not publish a fixed retention period. See the Microsoft documentation.

The numbered steps below match the diagram:

1. Zen Agents. A Builder or admin defines each Zen Agent: its data scope and filters, prompt instructions, Actions, schedule and recipients, Insight distribution, and permissions and sharing. A user, schedule, Flow, or list view then starts a run.
2. Agent execution. The run starts inside your org. Everything up to step 4 happens inside Salesforce.
3. Context retrieval. Context Sources retrieve the configured Salesforce data and, if configured, data from your business applications over Model Context Protocol (MCP) servers or APIs. Each Context Source runs as the user who starts the run. Back in Agent execution, field metadata (such as labels and types) is added, fields tagged with compliance categories are removed, and the remaining context is combined with the Agent instructions.
4. LLM Gateway. The prompt leaves Salesforce over Transport Layer Security (TLS) to the Portkey gateway. Portkey checks entitlements and routes the prompt to the Azure OpenAI deployment in your primary region (or the other region, if you permit fallback and the primary is unavailable). It does not store the content.
5. LLM Models. An OpenAI model hosted on Microsoft Azure OpenAI generates the Insight and any recommended actions, in the EU or US data zone.
6. Response safeguards. The response returns to your org and is stored there with its context, as an audit trail. Each point cites the records it came from, and recommended actions carry their rationale. Under a Private sharing model, Insights are shown only to users who can access the underlying records. The exceptions are System Mode and External Email Recipients. Actions wait for the approval of a user unless a Builder has made them Autonomous, and users can give feedback on every Insight.

AI gateway

Precursive routes every AI request through a gateway provided by Portkey. The gateway does two jobs:

• Entitlement enforcement: each org can use only the Zen Agents, models, and volume it is licensed for, and usage is metered per org.
• Model routing: each request goes to the Azure OpenAI deployment in your primary region, and fails over to the other region only if you have permitted fallback.

The Portkey gateway is hosted in US regions and delivered through the Cloudflare network. The gateway reads each request in memory so it can route it, then forwards it unchanged. The Portkey workspace of Precursive uses "Metrics only" logging, so no request or response content is stored. Portkey records only operational metrics (timestamp, token counts, cost, latency, model, and status) and the request metadata described in Data sent outside Salesforce, and keeps them for 12 months for usage analytics.

Portkey is a Precursive sub-processor under a signed data processing agreement.

Deployment model

Precursive AI is a hosted service operated by Precursive. The application runs in your Salesforce org. The gateway and models are run by Precursive on Portkey and Microsoft Azure. Running the models in your own Azure tenant or private cloud is not offered.

Precursive AI is off until it has been provisioned for your org and an admin has installed the packages, assigned permission sets, and configured at least one Zen Agent with its context. Your InfoSec, Legal, and Privacy reviews can be completed before any data leaves Salesforce.

Shared responsibility model

Responsibility for Precursive AI is shared between you, Precursive, and the sub-processors of Precursive.

• Customer: You decide whether Precursive AI is used and what it can see. You configure Zen Agents, choose which objects, fields, Files, and external applications provide context, decide which compliance categories (if any) may be sent, choose a primary region and whether fallback is permitted, and control who can run Zen Agents and view Insights through Salesforce permissions and sharing. Connecting an external application is your decision, and so is its configuration. You are also responsible for having a lawful basis for the data you submit, and for reviewing AI outputs before acting on them.
• Precursive: Precursive designs, develops, and supports the Precursive AI packages. It operates the AI gateway and the Azure OpenAI resources that process requests, and it selects and versions the models. It maintains the data access, compliance filtering, and Insight access controls described in this article, and manages its sub-processors under written data processing agreements.
• Sub-processors: Portkey runs the AI gateway infrastructure. Microsoft runs the Azure OpenAI service and the data centers where models run. Salesforce continues to host your org and all stored data.

Precursive AI MCP Server

The Precursive AI MCP Server lets your users connect an AI assistant that your organization has already approved, such as Claude, to Zen Agents and Insights. It is a Salesforce Hosted MCP server created in your own org, and the AI assistant is supplied by your own vendor. Each user signs in with their own Salesforce login, and every request runs with their permissions and the Insight access check. The server does not change your Salesforce business records. Any data that the user can read can be returned to their AI assistant, under your agreement with that AI vendor. For how it works, what it costs, and the controls available, see Precursive AI MCP Server security and data privacy.

Access control

You choose what Precursive AI can see. Nothing is sent automatically: each Zen Agent uses only the objects, fields, related records, Files, and external sources configured for it.

Context Sources

Each Context Source is a Flow that Precursive AI runs as the user who starts the run. For a scheduled run, that is the user who started the Insights Scheduler. Precursive AI removes compliance-tagged fields from what a Flow returns, but it does not remove other fields. How each Flow is built and set to run decides which records and fields reach the context, so return only the data that each Zen Agent needs.

System Mode

An admin can choose System Mode in two places. System Mode bypasses the record and field security of your org for the people it applies to:

• On a Context Source, System Mode leaves its records and fields out of the check against the access of each viewer.
• On a Zen Agent, System Mode shares the Agent and every Insight from it with a named System Mode Viewers group. For its members, Precursive AI skips the record, field, and Agent Viewers checks.

For example, users with a Salesforce Platform license can then see Insights built from Opportunities they cannot open.

⚠️ Warning: System Mode shows people data that their own Salesforce access hides. Get approval from the owner of your security model first.

System Mode is off until an admin with a dedicated permission set allows it. Precursive AI keeps the 10 most recent allow and disallow changes, with who made each change and when. Field History keeps the changes to System Mode on each Context Source and Zen Agent. In an upgraded org, you might need to turn on field history tracking for these fields. If an admin disallows System Mode, every Context Source and Agent stops applying it and Precursive AI removes the System Mode Viewers shares. Access that people already gained through a System Mode Context Source is kept. See Let anyone see an Insight with System Mode.

Insight access

Insights follow the same principle. Under a Private sharing model, a user sees an Insight only if they can see its Zen Agent and every record and field it was built from. The exceptions are System Mode, described above, and External Email Recipients, who receive emailed Insights without a check. See Insight sharing and access control.

Actions

Precursive AI is read-only by default. Agents read data and write only their own results. Actions can update Salesforce records, but they run in Supervised mode by default: the AI recommends, and a user decides whether to apply. A Builder can make an individual Action Autonomous, so it applies automatically when the confidence of the model reaches a threshold, 90% by default. These changes appear as AI Updated or AI Added in results, and every change runs under the Salesforce permissions of the user who ran the Zen Agent.

External applications

External business applications are reached only through admin-configured Named Credentials, using MCP servers or API actions. Data retrieved from them is outside the Salesforce sharing model, so connect only trusted systems and scope the credentials of the connection to what the Zen Agent needs.

Data security and privacy

The following sections describe what leaves Salesforce, how personal data is filtered, where requests are processed, and how long data is kept.

Data sent outside Salesforce

Each request contains content and metadata.

The content is the Agent instructions (the Precursive system prompt plus your configured instructions) and the filtered context. It passes through Portkey without being stored, and is processed by Azure OpenAI.

The metadata identifies the request so it can be checked against entitlements, routed, and metered. It uses Salesforce record IDs rather than names, and contains no record names, field values, or other business content apart from the org name.

Metadata	Contents
Org	Salesforce org ID, org name, and org type (for example production or sandbox)
User	Salesforce user ID of the running user
Entitlement	Entitlement key and Agent tier the request counts against
Records	Salesforce IDs of the Zen Agent, the Insight, and, for Actions, the Zen Agent Action
Request	Request type (Insight or Action), what triggered it (for example UI, schedule, or Flow), and the installed package version

Handling of personal data (PII)

Salesforce lets admins tag fields with compliance categories: PII, GDPR, HIPAA, PCI, CCPA, and COPPA. By default, Precursive AI removes every tagged field from the context before anything is sent outside Salesforce. This filtering runs server-side when context is built and cannot be bypassed from the browser. If your policy allows a category to be used, an admin can allow it in Precursive AI Settings > Data Privacy. See Configuring Compliance Category Filtering.

Fields that hold personal data but are not tagged are sent if they are included in a Context Source. Review your compliance-category tagging, and the field selection of each Zen Agent, before you turn on Precursive AI.

Under the Precursive AI Terms of Service, sensitive personal data such as health or payment card information may not be processed through Precursive AI without the prior written consent of Precursive.

The Salesforce user ID of the person running a Zen Agent is sent with each request. It is used for entitlement metering and as an abuse-monitoring identifier for Microsoft, and never for profiling.

Data residency and model routing

All models run on Microsoft Azure OpenAI Data Zone Standard deployments, in an EU data zone (resource in Sweden Central) and a US data zone (resource in East US 2). A Data Zone Standard deployment keeps model processing inside its data zone. Any prompts and responses Microsoft stores for abuse monitoring stay in the geography where the Azure resource is deployed.

You choose two things:

• Primary region: EU or US. Model processing takes place in that data zone.
• Fallback: whether requests may fall back to the other data zone if the primary deployment is unavailable.

Primary region	Fallback permitted	Fallback not permitted
EU	EU data zone, falling back to the US data zone only if the EU deployment is unavailable	EU data zone only. Requests are never processed in the US.
US	US data zone, falling back to the EU data zone only if the US deployment is unavailable	US data zone only

Choosing EU with no fallback is the only way to guarantee model processing in the EU.

Whatever you choose, every request passes through the Portkey gateway, which runs in US regions (see AI gateway). Your stored Salesforce data stays in the region of your Salesforce org.

International data transfers

Transfers between the UK and the European Economic Area (EEA) need no additional safeguards, because each recognizes the other as providing adequate data protection. Where personal data is transferred to a country without an adequacy finding, including the US hop through the AI gateway, transfers are made under the EU Standard Contractual Clauses (Decision (EU) 2021/914, Module Two: Controller to Processor), supplemented for UK transfers by the UK Addendum of the Information Commissioner's Office (ICO). Unless your Order Form says otherwise, the clauses are governed by Irish law. The full terms are in clause 5 of the Data Processing Addendum.

Encryption

All traffic between Salesforce, the Portkey gateway, and Microsoft Azure OpenAI is encrypted in transit with TLS 1.2 or higher. Data stored in your org is encrypted at rest by Salesforce, and Salesforce Shield Platform Encryption can be applied where your edition supports it.

Data retention and deletion

Outside your org, retention is limited to the minimum each service needs:

Location	What is kept	How long
Your Salesforce org	Insights, recommended actions, the context snapshot (as Files), user feedback, and interactions	Until you delete them
Microsoft Azure OpenAI	Only prompts and responses flagged by abuse monitoring for human review, stored in the geography where the Azure resource is deployed	No fixed period published by Microsoft. See the Microsoft documentation
Portkey	Operational metrics and request metadata. No request or response content.	Content: not retained. Metrics and metadata: 12 months
Precursive	No prompts or responses. Internal diagnostic logs hold only run status, timing, and error details.	Not applicable

The automated abuse monitoring of Microsoft checks every request for harmful content and patterns of misuse, such as repeated attempts to get around content filters. Nothing is stored at this stage. A prompt and response are stored only if they are flagged and the automated review of Microsoft cannot resolve them, so that authorized Microsoft staff can review them. For deployments in the European Economic Area, those reviewers are located in the EEA. Microsoft does not report when an individual request is stored or reviewed. If it confirms abuse, it notifies the Azure account owner, which is Precursive. The detail is set out in the Microsoft Data, privacy, and security for Foundry Models sold by Azure and Abuse monitoring documentation. Data processing by Microsoft is governed by the Microsoft Products and Services Data Protection Addendum.

Inside your org, deleting an Insight also deletes its context Files and the user interaction records linked to it. Uninstalling the Precursive AI package removes all of its data, and Salesforce generates a data export file for the user performing the uninstall.

On termination, under clause 3.7 of the Data Processing Addendum, Precursive will delete or return all customer personal data it holds, at your option, within 30 days, and will certify deletion on written request.

AI risk management

The following sections describe how models are used and the controls that address the risks specific to large language models.

AI model use and training

Precursive AI uses OpenAI models hosted on Microsoft Azure OpenAI. Customer data is never used to train, retrain, fine-tune, or improve any model, by Precursive, Microsoft, Portkey, or any other third party.

The commitment of Microsoft is set out in its Data, privacy, and security documentation: prompts and completions are not available to OpenAI and are not used to train, retrain, or improve the models.

AI risk controls

A large language model brings risks that other Salesforce features do not, such as prompt injection and inaccurate output. Precursive AI applies the following controls:

• Prompt injection: The Precursive system prompt separates instructions from data. Salesforce records and content from external applications are passed to the model as a structured data block, labeled as context data, while instructions come only from the Precursive system prompt and your configured Agent instructions. The model must return a fixed response format and cite the context data behind every point it makes. Zen Agents can only use the fixed set of Actions configured for them, so the model cannot invent new operations. Supervised Actions also need a person to approve them.
• Content safety: Azure OpenAI content filtering is applied to every request and response.
• Accuracy and human oversight: Insights are generated by AI and can be wrong. Each Insight links to the records it was built from, so users can check it. Users can give feedback on Insights, and Supervised Actions keep a person in control of every change.
• EU AI Act: Precursive AI is designed for project, account, and delivery insight. Under clause 2.4 of the Precursive AI Terms of Service, it must not be the sole basis for decisions with legal or similarly significant effects on individuals without meaningful human review. That includes uses treated as high-risk under the EU AI Act, such as employment and worker management. Precursive does not provide Precursive AI for high-risk uses, and does not act as a provider or deployer of a high-risk AI system in respect of your use.

Application security

Precursive AI is built under the same secure development lifecycle as the Precursive platform. This includes static code analysis on every build, peer code review with version control, open-source dependency scanning, and hardened continuous integration and delivery (CI/CD) pipelines.

Logging, monitoring, and incident response

The following sections describe the audit trail that Precursive AI keeps and how Precursive responds to a security incident.

Logging and audit

Precursive AI keeps its audit trail in your org. Agent runs, Insights, the context used, recommended actions, Actions that the AI applied (AI Updated and AI Added), and user feedback are all stored as records you can report on. Changes in Setup appear in the Salesforce Setup Audit Trail. Precursive AI keeps the 10 most recent allow and disallow changes to System Mode in a protected setting, and Field History keeps the System Mode changes on each Context Source and Zen Agent.

Outside your org, Portkey holds the operational metrics described above, and Precursive keeps internal diagnostic logs of run status, timing and errors. Neither contains prompt or response content, so Precursive personnel have no access to customer data sent to AI sub-processors.

Incident response

Precursive maintains a formal incident response process covering classification, escalation, customer notification, root cause analysis, and corrective action. Under clause 3.5 of the Data Processing Addendum, Precursive notifies you without undue delay on becoming aware of a personal data breach, with the nature of the breach, its likely consequences, and the measures taken. Where the CCPA Addendum applies, notification is within 72 hours.

Governance and compliance

The following sections list the sub-processors that Precursive AI uses and the certifications and agreements that apply.

Use of sub-processors

Precursive AI uses the following sub-processors in addition to Salesforce:

Sub-processor	Purpose	Location	Certifications	Content retention
Microsoft (Azure OpenAI)	Model inference	Your primary region, plus the other data zone if you permit fallback	ISO 27001/27017/27018, SOC 2 Type II, GDPR	Only content flagged for human review. No fixed period published (Microsoft documentation)
Portkey	AI gateway: entitlement enforcement, model routing, and usage metering	US regions, delivered through Cloudflare	ISO 27001, SOC 2 Type II, GDPR, HIPAA	None (metrics only)

The vendor of the AI assistant that your users connect to the Precursive AI MCP Server is contracted by your organization and is not a Precursive sub-processor.

The current sub-processor list is maintained in the Precursive Privacy Policy.

Compliance and certifications

Precursive operates an information security management system certified to ISO/IEC 27001:2022 and audited annually, and Precursive AI is in its scope. Precursive supports customer compliance with GDPR, the UK Data Protection Act, and CCPA. Personal data processing is governed by the Privacy Policy, the Data Processing Addendum, and the Precursive AI Terms of Service.

On request, Precursive can provide the ISO 27001 certificate and Statement of Applicability, the Data Processing Addendum, and the Precursive AI Terms of Service.

Report a security concern

If you identify or suspect a security issue related to Precursive AI, contact support@precursive.com immediately.