# LLM Data Handling

**Status:** Draft internal reference  
**Purpose:** Answer co-founder/customer questions about what Ask QIEN sends to LLM providers, what stays private, and what controls exist or are still needed.

## Short Answer

Not everything in Ask QIEN goes to an LLM.

However, when AI features are enabled for a tenant, the core operational content needed for those features can be sent to Anthropic. That includes ticket descriptions, ticket messages, structured ticket fields, selected KB entries, expert responses for KB proposal generation, and text sent for translation.

We do not currently send the entire database wholesale. We also do not send auth tables, sessions, tenant membership lists, billing-like AI usage logs, or every KB entry on every request. The app builds task-specific prompts and sends only the content required for each AI job.

The strongest current privacy control in Ask QIEN is tenant-level `dataProcessingConsent`. If it is disabled, the AI gateway blocks LLM calls for that tenant. We do not yet have fine-grained switches such as "summaries on, drafts off", automatic redaction, per-field exclusion, or customer-managed LLM keys.

## Current Anthropic Posture

Based on Anthropic's current public documentation for commercial products/API:

- Claude API keys are generated in the Claude Console and API access is subject to Anthropic's Commercial Terms of Service.
- A Claude Pro/Max consumer subscription is not the same thing as Claude API access. If we are using an `ANTHROPIC_API_KEY` in the app, that should be a Claude Console API key, even if the same person also pays for a Claude Pro seat.
- Anthropic says it does not use data shared through commercial products, including the API, to train models unless the customer opts into a program such as the Development Partner Program.
- Anthropic describes itself as a processor for commercial customers, processing submitted data according to customer instructions to provide the service.
- Standard API retention is documented as deletion of inputs and outputs within 30 days, with exceptions such as law, Usage Policy enforcement, or separately agreed terms.
- Zero data retention is available only under certain enterprise API arrangements. It is not something we can assume is active just because we use an API key.
- Anthropic Console usage/cost reporting shows usage by model, date/time, API key, token counts, cost, rate limits, and CSV exports; it is not described as a prompt-content review interface.

Operationally, this means we should tell customers:

> We use Anthropic's commercial API for selected AI workflows. Anthropic's current commercial API documentation states that API inputs/outputs are not used to train models by default, are retained under standard retention for up to 30 days unless a different agreement applies, and can be subject to zero-data-retention terms only if arranged with Anthropic. We should confirm our account settings and contract before making customer-facing commitments.

### If the Key Belongs to Ramon's $20/Month Claude Account

This needs careful wording.

If the production environment variable is an actual Claude API key (`ANTHROPIC_API_KEY`, typically an `sk-ant-api...` key created in Claude Console), then our app is using the Claude API. Anthropic's API docs say API keys are generated in Claude Console and API access is subject to Commercial Terms of Service. In that case, the API/commercial retention and training posture above is the relevant baseline.

If, instead, someone is using Claude through the consumer Claude.ai chat product, Claude Pro, Claude Max, the Claude desktop/mobile app, or Claude Code authenticated through a consumer subscription, then the consumer-product data rules apply, not the API/commercial posture.

What likely happened here:

- Ramon may personally pay $20/month for Claude Pro.
- Separately, he may also have created a Claude Console API key.
- The app cannot use the Claude Pro chat subscription directly; it uses an API key through the Anthropic SDK.
- Therefore the important thing to verify is not "does Ramon pay $20/month?" but "which Anthropic organization/workspace issued the API key, what terms apply to that API org, and is it standard retention or ZDR?"

Recommended correction to customer-facing wording:

> Our deployed app uses an Anthropic API key, not the Claude Pro chat interface. We need to verify the API key's Console organization, billing/workspace, Development Partner Program status, and whether standard API retention or zero data retention applies before making commitments.

Immediate action item:

- Log into the Anthropic Console for the account/workspace that issued the production `ANTHROPIC_API_KEY`.
- Confirm it is a Claude API/Console key.
- Confirm the organization is not enrolled in the Development Partner Program.
- Confirm whether it is standard API retention or a ZDR/HIPAA-ready enterprise arrangement.
- Replace any personal founder-owned production key with an Ask QIEN organization-owned key, scoped to production, with billing/admin access controlled by the company.

## What We Send Today

| Workflow | Trigger | Sent to LLM | Not intentionally sent |
| --- | --- | --- | --- |
| Completeness assessment | Ticket submitted or line manager follow-up | Current submission text, prior clarification Q&A, configured prompt copy, issue category, affected system, action requested, target language | Full user table, session data, unrelated tickets, all KB |
| Summarization | Ticket passes completeness | Ticket reference, ticket message bodies, project name, issue category, affected system, action requested | User emails, auth/session tables, unrelated tickets |
| Sentiment/urgency | Ticket triaged | Ticket reference, submission text, message bodies, issue category, affected system, declared priority | All KB, auth/session tables |
| Tag suggestion | Ticket triaged | Ticket reference, submission text, issue category, affected system, up to 30 KB title/slug vocabulary items | KB bodies, unrelated tenant data |
| Response draft | Ticket ready for expert response | Ticket reference, ticket message bodies, AI summary, success criteria, action requested, top retrieved KB entries including body markdown | All KB entries, auth/session tables, unrelated tenant data |
| KB update proposal | Expert response sent | Ticket reference, latest AI draft if present, expert response body, existing KB titles, resolution severity/concern | Full KB bodies, auth/session tables |
| Response translation preview | Expert asks to send across languages | Expert response draft text and target language | Ticket history unless included in the draft |
| KB translation | Expert generates a KB translation | KB title and body markdown | Other KB entries |
| Ticket display translation/backfill | Backfill or translation job | Ticket title and structured display fields; sometimes message/artifact content for translation | Auth/session tables, unrelated tenants |

## What Stays Local Today

These are not intentionally sent to the LLM as part of current prompt construction:

- Passwords or secrets. The app uses magic links/SSO and does not store user passwords.
- Auth sessions and verification tokens.
- Tenant membership lists, except the current user's tenant/role is used for authorization outside the prompt.
- Whole database dumps.
- Unrelated tenant data.
- Full KB corpus on every ticket. Response drafting retrieves a small set of matching KB entries.
- Knowledge embeddings. Current embeddings are deterministic local vectors generated in app code, not calls to an external embedding API.
- AI usage log content. `ai_call_logs` stores provider/model/token/cost/success/error metadata, not prompt or response text.

Important caveat: user-authored text can contain names, emails, device information, lot numbers, SOP references, or other sensitive details. If a user types sensitive information into a ticket, KB entry, or expert response, and an AI workflow needs that text, that sensitive information may be sent to the LLM provider.

## Current Product Controls

| Control | Current state | Notes |
| --- | --- | --- |
| Tenant AI consent | Implemented as `tenant_configs.data_processing_consent` | Blocks AI gateway calls when false. |
| Human expert review | Implemented for final responses | AI drafts do not go directly to line managers without expert action. |
| Translation review | Implemented for cross-language expert responses and KB translations | Some generated translations require review/approval before display. |
| Tenant isolation | Implemented in app queries and role guards | Should later add PostgreSQL RLS for defense in depth. |
| AI call metadata logging | Implemented | Logs model/provider/token/cost/success metadata, not prompt bodies. |
| Local deterministic KB embeddings | Implemented | Avoids sending KB content to an external embedding provider. |
| Provider/model config | Implemented per tenant | Currently still routes through Anthropic gateway code path. |

## Current Gaps

| Gap | Why it matters |
| --- | --- |
| No fine-grained AI feature switches | Customers may want summaries but not KB proposal generation, or translation but not response drafts. |
| No automatic redaction | Sensitive identifiers typed into tickets can be included in prompts. |
| No prompt preview/export for admins | We cannot easily show exactly what was sent for a given AI call. |
| No per-field data classification | The app does not distinguish ordinary operational content from regulated, confidential, export-controlled, or customer-secret content. |
| No zero-data-retention verification workflow | We have not documented whether our Anthropic account has ZDR or standard 30-day retention. |
| No customer-managed key / BYO provider control | Tenants cannot yet route through their own Anthropic account or private deployment. |
| No per-agent audit trail of prompt payload hashes | We log metadata but not a tamper-evident hash of the prompt payload. |
| No customer-facing AI data processing statement | We need a plain-language version for diligence and contracts. |

## Switches We Can Use or Add

### Available Now

1. **Tenant-level AI data processing consent**
   - DB/config field: `tenant_configs.data_processing_consent`
   - Effect: LLM gateway calls throw `DataProcessingConsentError`.
   - Limitation: coarse-grained. It disables all LLM calls through the gateway, not specific features.

2. **Anthropic account privacy settings**
   - Confirm that the Anthropic organization is not enrolled in the Development Partner Program.
   - This is an Anthropic Console/org setting, not an app code setting.

3. **Anthropic zero data retention**
   - Available only through an eligible enterprise/API arrangement.
   - We need to confirm with Anthropic Sales/account docs whether our API key is covered.
   - Not a simple environment variable we can flip inside Ask QIEN.

4. **Use no-LLM fallback behavior**
   - Some workflows fail open to manual expert review if the LLM fails or is disabled.
   - We should make this behavior explicit in the UI when tenant AI is disabled.

### Recommended Product Switches to Add

1. Per-tenant feature toggles:
   - completeness questions
   - summarization
   - sentiment/urgency
   - tag suggestions
   - response drafting
   - KB update proposals
   - translation
   - regulatory source guidance
2. Per-field redaction/exclusion:
   - lot numbers
   - serial numbers
   - personal names
   - emails
   - free-text attachments
   - customer-marked confidential content
3. Prompt payload audit:
   - prompt hash
   - prompt template version
   - source record IDs
   - source content hashes
   - generated output hash
4. Customer-managed provider option:
   - tenant-owned Anthropic key
   - future Bedrock/Vertex route
   - future ZDR/private endpoint support where available
5. Admin-facing AI data map:
   - show which workflows are enabled
   - show what categories of data each workflow sends
   - show provider/model/retention posture

## Recommended Customer-Facing Answer

> Ask QIEN does not send the entire database to an LLM. AI workflows send task-specific subsets of data, such as the current ticket text, selected ticket history, relevant structured fields, and a small set of retrieved KB entries when drafting a response. Authentication records, sessions, tenant membership lists, unrelated tenant data, and whole database dumps are not intentionally sent to the LLM.
>
> We currently use Anthropic's commercial API for selected AI workflows. Anthropic's public commercial/API documentation states that commercial API data is not used to train models by default, unless a customer opts into a program such as the Development Partner Program. Standard API input/output retention is documented as up to 30 days unless a separate agreement, legal requirement, or Usage Policy enforcement exception applies. Zero data retention requires an eligible enterprise/API arrangement and should be confirmed contractually.
>
> Ask QIEN also has a tenant-level AI processing consent switch. If disabled, LLM gateway calls are blocked and the workflow falls back to human expert review. We are planning finer-grained AI controls, redaction, and customer-facing AI data-flow documentation before making stronger privacy commitments.

## Recommended Next Actions

1. Confirm Anthropic account posture:
   - Commercial/API account type.
   - Whether the production key is company-owned or a founder personal key.
   - Development Partner Program status.
   - Standard retention vs zero-data-retention agreement.
   - Whether our planned use is covered by current commercial terms and DPA.
2. Add an internal AI data map:
   - workflow
   - input data categories
   - provider
   - model
   - retention posture
   - fallback behavior
3. Add per-feature tenant controls.
4. Add prompt payload hashes and source-record IDs to AI logs.
5. Add redaction/classification design before broader regulated customer rollout.
6. Prepare a customer-facing "AI Data Processing Overview" derived from this doc.

## Source Links

- Anthropic data usage / commercial training policy: https://code.claude.com/docs/en/data-usage
- Claude API authentication and API keys: https://platform.claude.com/docs/en/manage-claude/authentication
- Claude API access / Commercial Terms note: https://support.claude.com/en/articles/8114521-how-can-i-access-the-claude-api
- Anthropic API and data retention: https://platform.claude.com/docs/en/manage-claude/api-and-data-retention
- Anthropic processor/controller help article: https://support.claude.com/en/articles/9267385-does-anthropic-act-as-a-data-processor-or-controller
- Anthropic organization data retention: https://privacy.anthropic.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data
- Anthropic zero data retention: https://privacy.anthropic.com/en/articles/8956058-i-have-a-zero-data-retention-agreement-with-anthropic-what-products-does-it-apply-to
- Anthropic Development Partner Program: https://support.claude.com/en/articles/11174108-about-the-development-partner-program
- Anthropic Console cost and usage reporting: https://support.claude.com/en/articles/9534590-cost-and-usage-reporting-in-the-claude-console