<style>p { margin: 0; }span.fr-emoticon.fr-emoticon-img { background-repeat: no-repeat !important; font-size: inherit; height: 1em; width: 1em; min-height: 20px; min-width: 20px; display: inline-block; margin: -0.1em 0.1em 0.1em; line-height: 1; vertical-align: middle; } span.fr-emoticon { font-weight: normal; font-family: "Apple Color Emoji", "Segoe UI Emoji", "NotoColorEmoji", "Segoe UI Symbol", "Android Emoji", "EmojiSymbols"; display: inline; line-height: 0; } blockquote { border-left: solid 2px #5e35b1; color: #5e35b1; margin-left:0; padding-left:5px;}blockquote blockquote{ border-color: #00bcd4; color: #00bcd4;}blockquote blockquote blockquote{ border-color: #43a047; color: #43a047;} table.grid{ border-collapse: collapse;} table.grid td, table.grid th { border: 1px solid #ddd;} .fr-fic.fr-dib{ display: block; margin: 5px auto;}.fr-fic.fr-dib.fr-fir{ text-align: right; margin: 5px 0 5px auto;}.fr-fic.fr-dib.fr-fil{ text-align: left; margin: 5px auto 5px 0;}.fr-fic.fr-dii{ float: none; margin: 5px auto;}.fr-fic.fr-dii.fr-fil{ float: left; margin: 5px auto;}.fr-fic.fr-dii.fr-fir{ float: right; margin: 5px auto;}img.fr-dib.fr-fir { margin-right: 0; text-align: right;}img.fr-dib.fr-fil { margin-left: 0; text-align: left;}img.fr-dib { margin: 5px auto; display: block; float: none;}img.fr-bordered { box-sizing: content-box; border: solid 5px #CCC;}img.fr-shadow { box-shadow: 10px 10px 5px 0px #cccccc;}img.fr-rounded { border-radius: 10px; -moz-border-radius: 10px; -webkit-border-radius: 10px; -moz-background-clip: padding; -webkit-background-clip: padding-box; background-clip: padding-box;}</style><style>
p {
margin: 0;
}
span.fr-emoticon.fr-emoticon-img {
background-repeat: no-repeat !important; font-size: inherit; height: 1em; width: 1em; min-height: 20px; min-width: 20px; display: inline-block; margin: -0.1em 0.1em 0.1em; line-height: 1; vertical-align: middle;
}
span.fr-emoticon {
font-weight: normal; font-family: "Apple Color Emoji", "Segoe UI Emoji", "NotoColorEmoji", "Segoe UI Symbol", "Android Emoji", "EmojiSymbols"; display: inline; line-height: 0;
}
blockquote {
border-left: solid 2px #5e35b1; color: #5e35b1; margin-left: 0; padding-left: 5px;
}
blockquote blockquote {
border-color: #00bcd4; color: #00bcd4;
}
blockquote blockquote blockquote {
border-color: #43a047; color: #43a047;
}
table.grid {
border-collapse: collapse;
}
table.grid td,
table.grid th {
border: 1px solid #ddd;
}
.fr-fic.fr-dib {
display: block; margin: 5px auto;
}
.fr-fic.fr-dib.fr-fir {
text-align: right; margin: 5px 0 5px auto;
}
.fr-fic.fr-dib.fr-fil {
text-align: left; margin: 5px auto 5px 0;
}
.fr-fic.fr-dii {
float: none; margin: 5px auto;
}
.fr-fic.fr-dii.fr-fil {
float: left; margin: 5px auto;
}
.fr-fic.fr-dii.fr-fir {
float: right; margin: 5px auto;
}
img.fr-dib.fr-fir {
margin-right: 0; text-align: right;
}
img.fr-dib.fr-fil {
margin-left: 0; text-align: left;
}
img.fr-dib {
margin: 5px auto; display: block; float: none;
}
img.fr-bordered {
box-sizing: content-box; border: solid 5px #CCC;
}
img.fr-shadow {
box-shadow: 10px 10px 5px 0px #cccccc;
}
img.fr-rounded {
border-radius: 10px; -moz-border-radius: 10px; -webkit-border-radius: 10px; -moz-background-clip: padding; -webkit-background-clip: padding-box; background-clip: padding-box;
}
</style><p>This document outlines the security implications of connecting an AI model to your Halo instance, including how your data is stored and managed. This will depend on the 'Default AI Connection' you have chosen for your Halo instance. For information on how to connect using each model and the pross/cons of using each model checkout <a data-fr-linked="true" href="https://usehalo.com/haloitsm/guides/2385" id="isPasted" target="_blank" rel="noopener noreferrer">Connecting AI to Halo</a>. </p>
<style>p { margin: 0; }span.fr-emoticon.fr-emoticon-img { background-repeat: no-repeat !important; font-size: inherit; height: 1em; width: 1em; min-height: 20px; min-width: 20px; display: inline-block; margin: -0.1em 0.1em 0.1em; line-height: 1; vertical-align: middle; } span.fr-emoticon { font-weight: normal; font-family: "Apple Color Emoji", "Segoe UI Emoji", "NotoColorEmoji", "Segoe UI Symbol", "Android Emoji", "EmojiSymbols"; display: inline; line-height: 0; } blockquote { border-left: solid 2px #5e35b1; color: #5e35b1; margin-left:0; padding-left:5px;}blockquote blockquote{ border-color: #00bcd4; color: #00bcd4;}blockquote blockquote blockquote{ border-color: #43a047; color: #43a047;} table.grid{ border-collapse: collapse;} table.grid td, table.grid th { border: 1px solid #ddd;} .fr-fic.fr-dib{ display: block; margin: 5px auto;}.fr-fic.fr-dib.fr-fir{ text-align: right; margin: 5px 0 5px auto;}.fr-fic.fr-dib.fr-fil{ text-align: left; margin: 5px auto 5px 0;}.fr-fic.fr-dii{ float: none; margin: 5px auto;}.fr-fic.fr-dii.fr-fil{ float: left; margin: 5px auto;}.fr-fic.fr-dii.fr-fir{ float: right; margin: 5px auto;}img.fr-dib.fr-fir { margin-right: 0; text-align: right;}img.fr-dib.fr-fil { margin-left: 0; text-align: left;}img.fr-dib { margin: 5px auto; display: block; float: none;}img.fr-bordered { box-sizing: content-box; border: solid 5px #CCC;}img.fr-shadow { box-shadow: 10px 10px 5px 0px #cccccc;}img.fr-rounded { border-radius: 10px; -moz-border-radius: 10px; -webkit-border-radius: 10px; -moz-background-clip: padding; -webkit-background-clip: padding-box; background-clip: padding-box;}</style><style>
p {
margin: 0;
}
span.fr-emoticon.fr-emoticon-img {
background-repeat: no-repeat !important; font-size: inherit; height: 1em; width: 1em; min-height: 20px; min-width: 20px; display: inline-block; margin: -0.1em 0.1em 0.1em; line-height: 1; vertical-align: middle;
}
span.fr-emoticon {
font-weight: normal; font-family: "Apple Color Emoji", "Segoe UI Emoji", "NotoColorEmoji", "Segoe UI Symbol", "Android Emoji", "EmojiSymbols"; display: inline; line-height: 0;
}
blockquote {
border-left: solid 2px #5e35b1; color: #5e35b1; margin-left: 0; padding-left: 5px;
}
blockquote blockquote {
border-color: #00bcd4; color: #00bcd4;
}
blockquote blockquote blockquote {
border-color: #43a047; color: #43a047;
}
table.grid {
border-collapse: collapse;
}
table.grid td,
table.grid th {
border: 1px solid #ddd;
}
.fr-fic.fr-dib {
display: block; margin: 5px auto;
}
.fr-fic.fr-dib.fr-fir {
text-align: right; margin: 5px 0 5px auto;
}
.fr-fic.fr-dib.fr-fil {
text-align: left; margin: 5px auto 5px 0;
}
.fr-fic.fr-dii {
float: none; margin: 5px auto;
}
.fr-fic.fr-dii.fr-fil {
float: left; margin: 5px auto;
}
.fr-fic.fr-dii.fr-fir {
float: right; margin: 5px auto;
}
img.fr-dib.fr-fir {
margin-right: 0; text-align: right;
}
img.fr-dib.fr-fil {
margin-left: 0; text-align: left;
}
img.fr-dib {
margin: 5px auto; display: block; float: none;
}
img.fr-bordered {
box-sizing: content-box; border: solid 5px #CCC;
}
img.fr-shadow {
box-shadow: 10px 10px 5px 0px #cccccc;
}
img.fr-rounded {
border-radius: 10px; -moz-border-radius: 10px; -webkit-border-radius: 10px; -moz-background-clip: padding; -webkit-background-clip: padding-box; background-clip: padding-box;
}
</style><style>
p {
margin: 0;
}
span.fr-emoticon.fr-emoticon-img {
background-repeat: no-repeat !important; font-size: inherit; height: 1em; width: 1em; min-height: 20px; min-width: 20px; display: inline-block; margin: -0.1em 0.1em 0.1em; line-height: 1; vertical-align: middle;
}
span.fr-emoticon {
font-weight: normal; font-family: "Apple Color Emoji", "Segoe UI Emoji", "NotoColorEmoji", "Segoe UI Symbol", "Android Emoji", "EmojiSymbols"; display: inline; line-height: 0;
}
blockquote {
border-left: solid 2px #5e35b1; color: #5e35b1; margin-left: 0; padding-left: 5px;
}
blockquote blockquote {
border-color: #00bcd4; color: #00bcd4;
}
blockquote blockquote blockquote {
border-color: #43a047; color: #43a047;
}
table.grid {
border-collapse: collapse;
}
table.grid td,
table.grid th {
border: 1px solid #ddd;
}
.fr-fic.fr-dib {
display: block; margin: 5px auto;
}
.fr-fic.fr-dib.fr-fir {
text-align: right; margin: 5px 0 5px auto;
}
.fr-fic.fr-dib.fr-fil {
text-align: left; margin: 5px auto 5px 0;
}
.fr-fic.fr-dii {
float: none; margin: 5px auto;
}
.fr-fic.fr-dii.fr-fil {
float: left; margin: 5px auto;
}
.fr-fic.fr-dii.fr-fir {
float: right; margin: 5px auto;
}
img.fr-dib.fr-fir {
margin-right: 0; text-align: right;
}
img.fr-dib.fr-fil {
margin-left: 0; text-align: left;
}
img.fr-dib {
margin: 5px auto; display: block; float: none;
}
img.fr-bordered {
box-sizing: content-box; border: solid 5px #CCC;
}
img.fr-shadow {
box-shadow: 10px 10px 5px 0px #cccccc;
}
img.fr-rounded {
border-radius: 10px; -moz-border-radius: 10px; -webkit-border-radius: 10px; -moz-background-clip: padding; -webkit-background-clip: padding-box; background-clip: padding-box;
}
</style><style>
p {
margin: 0;
}
span.fr-emoticon.fr-emoticon-img {
background-repeat: no-repeat !important; font-size: inherit; height: 1em; width: 1em; min-height: 20px; min-width: 20px; display: inline-block; margin: -0.1em 0.1em 0.1em; line-height: 1; vertical-align: middle;
}
span.fr-emoticon {
font-weight: normal; font-family: "Apple Color Emoji", "Segoe UI Emoji", "NotoColorEmoji", "Segoe UI Symbol", "Android Emoji", "EmojiSymbols"; display: inline; line-height: 0;
}
blockquote {
border-left: solid 2px #5e35b1; color: #5e35b1; margin-left: 0; padding-left: 5px;
}
blockquote blockquote {
border-color: #00bcd4; color: #00bcd4;
}
blockquote blockquote blockquote {
border-color: #43a047; color: #43a047;
}
table.grid {
border-collapse: collapse;
}
table.grid td,
table.grid th {
border: 1px solid #ddd;
}
.fr-fic.fr-dib {
display: block; margin: 5px auto;
}
.fr-fic.fr-dib.fr-fir {
text-align: right; margin: 5px 0 5px auto;
}
.fr-fic.fr-dib.fr-fil {
text-align: left; margin: 5px auto 5px 0;
}
.fr-fic.fr-dii {
float: none; margin: 5px auto;
}
.fr-fic.fr-dii.fr-fil {
float: left; margin: 5px auto;
}
.fr-fic.fr-dii.fr-fir {
float: right; margin: 5px auto;
}
img.fr-dib.fr-fir {
margin-right: 0; text-align: right;
}
img.fr-dib.fr-fil {
margin-left: 0; text-align: left;
}
img.fr-dib {
margin: 5px auto; display: block; float: none;
}
img.fr-bordered {
box-sizing: content-box; border: solid 5px #CCC;
}
img.fr-shadow {
box-shadow: 10px 10px 5px 0px #cccccc;
}
img.fr-rounded {
border-radius: 10px; -moz-border-radius: 10px; -webkit-border-radius: 10px; -moz-background-clip: padding; -webkit-background-clip: padding-box; background-clip: padding-box;
}
</style><p><br></p><p><strong><span style="font-size: 14pt;">Default Halo Connection</span></strong></p><p id="isPasted"><strong><span style="font-size: 12pt;">Data Transmission and Data Processing</span></strong></p><p><strong>API Connection: </strong>The Halo system connects to Halo's OpenAI integration via an API. Data is sent over this connection for processing. </p><p><br></p><p><strong>In Flight Encryption:</strong> Data is transmitted over secure connections using encryption protocols TLS 1.3 (1.2 fallback) to ensure data privacy and security during transmission. </p><p><br></p><p><strong>Vectorisation and Generative Functions: </strong>The data sent to OpenAI is used for vectorisation and generating novel output. Vectorisation is a process that converts text into numerical vectors for machine learning purposes. Generative capabilities takes input data and defined prompts for a specific purpose and returns novel output that is integrated into the platform.</p><p><br></p><p id="isPasted"><strong><span style="font-size: 12pt;">Data Storage</span></strong></p><p><strong>Temporary vs. Permanent Storage:</strong> Depending on the service's architecture and policies, data might be stored temporarily during processing. There is no permanent storage of data unless specified as part of the service agreement. </p><p><br></p><p><strong>Virtual Agents: </strong>When using the default virtual agents data will be retained by Open AI only for chats started by an unauthenticated user. Data will be held for a period of 30 days for usage monitoring purposes, the data will not be used to train models. This is in line with OpenAI's zero data retention policy <a href="https://developers.openai.com/api/docs/guides/your-data#data-retention-controls-for-abuse-monitoring" target="_blank" rel="noopener noreferrer">here</a>. Zero data will be retained for authenticated users. For more information on virtual agents checkout our guide <a href="https://usehalo.com/haloitsm/guides/2336" target="_blank" rel="noopener noreferrer">here</a>. </p><p><br></p><p id="isPasted"><strong><span style="font-size: 12pt;">Access to Data</span></strong></p><p><strong>Access Restrictions:</strong> Access to data is restricted to authorised personnel only, which might include system administrators or specific employees within Halo with a need-to-know basis. </p><p><br></p><p><strong>Customer Control: </strong>Customer have control over their data and can request deletion of permanent data stored in their instance at any time. </p><p><br></p><p><strong>Data Privacy Compliance: </strong>Halo complies with relevant regional data protection regulations (GDPR, CCPA, HIPPA) to ensure user privacy and data security. </p><p><br></p><p id="isPasted"><strong><span style="font-size: 12pt;">Security and Compliance</span></strong></p><p>Enabling this connection enables Halo’s OpenAI to become a sub processor of the data. Any resulting output of any AI functionality remains siloed in your tenant’s Halo’s database that follows our standard Data Protection Agreement. You can view our GDPR statement <a data-fr-linked="true" href="https://usehalo.com/gdpr/" id="isPasted" target="_blank" rel="noopener noreferrer">here</a> and your account manager (Customer Success Manager) can provide a copy of the data protection agreement. </p><p><br></p><p><strong><span style="font-size: 14pt;">Own OpenAI connection</span></strong></p><p><strong><span style="font-size: 12pt;">Data Transmission and Processing</span></strong></p><ul><li>When data is sent to OpenAI's API, it is transmitted over a secure connection (HTTPS with TLS Encryption) for processing. </li><li>Data retention and residency is in control of the customer utilising their own connections with the corresponding configuration options at organisation and projects level. Further detail on this can be located <a data-fr-linked="true" href="https://platform.openai.com/docs/guides/your-data#how-to-use-data-residency" id="isPasted" target="_blank" rel="noopener noreferrer">here</a>. </li><li>The data is used to generate a response, such as vectorisation or language model output, based on the request made. </li></ul><p id="isPasted"><strong><span style="font-size: 12pt;">Data Storage</span></strong></p><p><strong>Temporary Storage: </strong>OpenAI processes the data temporarily in memory to generate the response. This is necessary for the API to function and return results. This applies to all AI functionalities with the exception of <a data-fr-linked="true" href="https://usehalo.com/haloitsm/guides/2336" id="isPasted" target="_blank" rel="noopener noreferrer">virtual agents</a>. </p><p><br></p><p><strong>Permanent Storage:</strong> This will only apply when deploying the <a data-fr-linked="true" href="https://usehalo.com/haloitsm/guides/2336" id="isPasted" target="_blank" rel="noopener noreferrer">virtual agent functionality</a> in Halo. OpenAI as standard does not retain or store user data or API requests permanently. Once the processing is complete and the response is generated, the transaction data is removed as Halo will remove temporary stored data from OpenAI as soon as the interaction is completed. </p><p><br></p><p id="isPasted"><strong><span style="font-size: 12pt;">Data Access</span></strong></p><p>Access by OpenAI: <strong>The data is not accessible to OpenAI after processing unless there is a specific agreement or requirement for logging, auditing, or troubleshooting purposes. OpenAI prioritises user privacy and data security. </strong></p><p><br></p><p><strong>Access by Third Parties:</strong> The data is not shared with third parties unless explicitly agreed upon by the user or required by law. </p><p id="isPasted"><br></p><p><strong><span style="font-size: 12pt;">Privacy and Security</span></strong></p><p><strong>Privacy Policies:</strong> OpenAI's privacy policy and terms of service govern the handling of data, ensuring compliance with privacy regulations and industry standards. </p><p><br></p><p><strong>Data Anonymisation: </strong>OpenAI implements data anonymisation techniques to prevent any association of input data with individual users or organizations. </p><p><br></p><p><strong><span style="font-size: 14pt;">Own Azure OpenAI Connection</span></strong></p><p id="isPasted"><strong><span style="font-size: 12pt;">Data Transmission and Processing</span></strong></p><p><strong>Secure Transmission:</strong> Data sent to Azure OpenAI via API is transmitted securely over HTTPS to ensure that it is protected during transit. </p><p><br></p><p><strong>Processing:</strong> The data is processed by the Azure OpenAI models to generate the desired output, such as vectorised data. This processing occurs in real-time and leverages Azure's powerful AI infrastructure. </p><p><br></p><p id="isPasted"><strong><span style="font-size: 12pt;">Data Storage</span></strong></p><p><strong>Ephemeral Data Storage: </strong>Azure OpenAI as standard processes data in memory and does not persistently store user data after the processing task is completed. This means that the data is not retained beyond the immediate processing needs. The Azure documentation for this can be found <a data-fr-linked="true" href="https://learn.microsoft.com/en-us/azure/ai-foundry/how-to/concept-data-privacy" id="isPasted" target="_blank" rel="noopener noreferrer">here</a>.</p><p><br></p><p id="isPasted"><strong><span style="font-size: 12pt;">Data Retention and Access</span></strong></p><p><strong>No Long-Term Storage: </strong>By default, Azure OpenAI does not store the data sent for processing. The output is returned to the calling application, and the input data is discarded. </p><p><strong><br></strong></p><p><strong>Access to Data: </strong>Since the data is not stored, there is no direct access to it after processing by either Microsoft or external parties. Only the client (ITSM system) has access to both input data and the results returned from the API. </p><p><br></p><p id="isPasted"><strong><span style="font-size: 12pt;">Security and Compliance</span></strong></p><p><strong>Data Privacy: </strong>Microsoft is committed to ensuring data privacy and compliance with various industry standards and regulations, such as GDPR. </p><p><br></p><p><strong>Compliance Standards:</strong> Azure adheres to numerous compliance certifications, ensuring that data handling practices meet stringent security requirements.</p><p><br></p><p id="isPasted"><strong><span style="font-size: 12pt;">Data Submission and Vectorization</span></strong></p><p><strong>Data Submission: </strong>The Halo system sends data to Azure AI Search via its REST API. This data typically consists of documents or text that need to be indexed and vectorized for enhanced search capabilities.</p><p><br></p><p><strong>Vectorization:</strong> Azure AI Search uses AI models to convert the submitted text into vector representations. These vectors capture the semantic meaning of the text, allowing for more advanced search capabilities such as semantic search and similarity matching.</p><p><br></p><p id="isPasted"><strong><span style="font-size: 12pt;">Data Storage</span></strong></p><p><strong>Temporary Storage:</strong> During processing, the data is temporarily stored in Azure’s infrastructure. This temporary storage is required to perform operations like indexing, vectorization, and enrichment.</p><p><br></p><p><strong>Indexing:</strong> After processing, the data is stored in an index within Azure AI Search. This index is a data structure optimized for search operations and includes both the raw text and its vector representation.</p><p><br></p><p id="isPasted"><strong><span style="font-size: 12pt;">Data Access and Security</span></strong></p><p><strong>Access Control: </strong>Access to the indexed data is controlled through Azure’s robust security mechanisms. This includes:</p><ul><li>Authentication: Users must authenticate using Azure Active Directory (AAD) or an API key to access the data.</li><li>Authorization: Role-Based Access Control (RBAC) is used to manage permissions, ensuring that only authorized users or applications can access or modify the data.</li></ul><p><strong>Data Encryption: </strong>Data is encrypted both in transit and at rest to protect it from unauthorized access. Azure uses industry-standard encryption protocols to ensure data security.</p><p><br></p><p><strong>Storage Location:</strong> Data is stored within the Azure region specified during the setup of the Azure AI Search service. Users can select regions to comply with data residency requirements.</p><p><br></p><p id="isPasted"><strong><span style="font-size: 12pt;">Data Retention and Deletion</span></strong></p><p><strong>Data Retention: </strong>The data remains in the index as long as needed for search operations. Users can manage the lifecycle of the data through Azure portal settings, allowing them to update or delete indexes as required.</p><p><br></p><p><strong>Data Deletion: </strong>When an index is deleted, all data within it, including vectorized representations, is permanently removed from Azure AI Search.</p><p id="isPasted"><br></p><p><strong><span style="font-size: 12pt;">Compliance and Privacy</span></strong></p><p><strong>Compliance:</strong> Azure AI Search complies with various industry standards and regulations, including GDPR, HIPAA, and ISO/IEC 27001, ensuring that data handling meets legal and regulatory requirements.</p><p><br></p><p><strong>Privacy: </strong>Azure adheres to strict privacy policies, ensuring that customer data is not accessed or used by Microsoft personnel or third parties without explicit consent.</p><p><br></p><p><br></p>
