> ## Documentation Index
> Fetch the complete documentation index at: https://docs.introw.io/llms.txt
> Use this file to discover all available pages before exploring further.
# AI Security
> Where Introw's AI runs, what it can reach, and what happens to the data it reasons over: prompts kept out of retention and out of training, and access scoped to the person asking.
export const Impact = ({children}) =>
{children}
;
export const Personas = ({children}) =>
{children}
;
export const Pains = ({children}) =>
{children}
;
AI Security is the answer to the questions a security review asks before your partner program is allowed to use AI at all: where it runs, what it can reach, and what happens to the data it reasons over.
> Turning AI on should not cost you a quarter of legal review.
> Introw's agents read only what the person asking may already see, and every model call leaves through one gateway that keeps your prompts out of retention and out of training.
## The problem it solves
Four questions decide whether AI ever reaches your partner data:
| Without Introw | With Introw |
| --------------------------------------- | ----------------------------------- |
| You cannot say where prompts end up | Prompts are not kept or trained on |
| A partner's question reaches other data | Each answer stops at their own data |
| You cannot tell what the AI reads | You choose what it reads |
| AI acts with nobody checking | You approve what matters |
## Impact
The AI that actually ships is the AI a reviewer can sign off in an afternoon. Everything on this page is written to be handed to that reviewer.
for your business
* **Enterprise**
A SOC 2 Type 2 report, an ISO/IEC 27001:2022 certification, a GDPR programme, and your data hosted on AWS in Europe
* **Trustworthy**
Model providers must drop your prompts on completion and never train on them, enforced at one gateway rather than feature by feature
* **In your CRM**
The agents read your CRM through the permissions of the person asking, and write back through the same audited paths your team uses
for your partners
* **Self-serve**
A partner gets their answer in seconds, and nobody else in your program sees the deal they asked about
* **Enabled**
Their own security team gets a straight answer too, because the same posture covers the assistant your partners talk to
[A day in the life of your partners](/days-in-the-life)
* **CRM Administrator** - scoped access, and no writes you did not authorise
* **Partner Operations** - the switches that decide what AI may do
* **Economic Buyer** - AI you can turn on without a legal project
* **Partner Alliance Managers** - their data stays their own
## How it works
Introw runs on AWS in Europe, and your partner data is stored there.
The agents are part of the same application as the rest of Introw, on the same infrastructure, under the same access controls.
Introw holds a SOC 2 Type 2 report, is certified to ISO/IEC 27001:2022, and runs a GDPR compliance programme.
The report and the certificate themselves, the hosting regions, the subprocessor list and the retention detail are published in the [Introw Trust Center](https://trust.introw.io), which is the document to hand a security review.
Model calls leave through a single AI gateway, the Vercel AI Gateway, and the data rules are enforced there rather than in each feature.
Every agent answer, and every embedding behind the knowledge search they run on, routes only to model providers that delete prompts and responses on completion and do not train on them.
It holds for every agent in Introw, and no feature can opt out of it by omission.
Introw builds, trains and hosts no model of its own, runs no training or fine-tuning of any kind on your data, and uses no consumer-grade AI tooling: models are reached through the gateway under enterprise API terms.
The current vendor set is published on the live [subprocessor list](https://trust.introw.io/subprocessors).
An agent has no view of your data of its own.
It reads through the permissions of whoever is asking, which is what makes the partner-facing agent safe to put in front of a partner: their question is answered from their own records and the content you published to them, and another partner's deals are not reachable, on any channel.
Answers are grounded in your CRM and the sources in your [knowledge base](/features/ai/knowledge-base), so an agent does not improvise from the open internet.
When an agent takes an action, it runs through the same permissioned paths your team uses in the product and is recorded the same way, so the trail behind an AI-made change looks like the trail behind a human one.
What stays yours is the on switch and the judgment.
The partner-facing agent does nothing until you enable it, the agents that assist your team are configured one by one, and a program can run with none of them on.
Instructions set each agent's tone, scope, and the point where it escalates to a person instead of guessing.
[AI approvals](/features/ai/approvals) keep a human on the decisions you choose to keep, and every conversation is traced, so you can read back what was asked and what was answered.
Model selection is the one thing you do not configure: it sits behind the gateway rather than in a per-organisation setting, which is exactly what lets the retention rule be enforced centrally instead of negotiated feature by feature.
Two things a reviewer usually asks about late.
Partners are never users of your CRM, so no external seat, licence, or CRM login is involved in any of this.
And your CRM credentials are held outside the application in a dedicated vault, so an agent reaches your CRM through the same brokered connection the rest of Introw uses.
A request travels the same path whether it comes from a partner, your team, or an assistant over MCP:
```mermaid theme={"theme":{"light":"github-light","dark":"github-dark"}}
flowchart LR
ask["A partner or your team asks"] --> scope["Scoped to their permissions"]
scope --> gateway["One zero-retention gateway"]
gateway --> answer["Answer or scoped action, traced"]
```
## Prompt injection and untrusted content
An agent reads text your team did not write: a partner's message, a document in the knowledge base, a page from your site, and, if you connect one, whatever your own MCP server returns.
Treating any of that as a trustworthy instruction is the actual risk, and it is the one Introw is built to remove.
An instruction hidden in content cannot widen what an agent is allowed to do, because none of the limits live in the prompt.
**The toolset is fixed.**
Each agent has one defined set of program actions: search partners, deals, tasks, submissions and activity, read commissions, funds, tiers and goals, submit a form, add a comment, create or update a task, update a CRM property, coach a deal.
There is no general-purpose web browsing and no code execution in it, and no conversation can add a tool to it.
**Authorization sits outside the model.**
Every tool call runs with the organisation, the partner, the portal and, where you scope it that way, the individual visitor's own records resolved from the authenticated session, never from anything the model or the conversation supplies.
A message that tells the agent to go and look at another partner's deals has nothing to redirect: the scope was settled before the model saw a word.
**Writes are checked again at the moment of writing.**
An agent can only change the CRM properties you made editable on that record's list.
Ask it for anything else and the write is refused with the permitted fields named, and it offers to leave a comment instead.
Submissions that need judgment sit behind [AI approvals](/features/ai/approvals), where a person decides.
**A connected MCP server stays yours.**
Introw reaches it over HTTPS with a bearer token your server issues, and your server authorizes every call, so your own rules apply on top of Introw's.
A connection cannot be saved until it passes a live test that lists the tools the server exposes, so you see exactly what you are handing the agent before you hand it over.
Delete the connection and those tools leave the agent with it.
Abuse and off-topic pressure are handled the same way, by scope rather than by a word list.
The agent's **Instructions** set what it will discuss, in what tone, and the point where it stops and escalates to a person, and you test it as a partner persona before it goes live, so you watch the boundaries hold before a partner does.
## What a security review asks
**Where does our data go?** It is stored on AWS in Europe with the rest of your Introw data. Prompts leave to a model provider through one gateway and are not kept there.
**Do you train on our data?** No. Introw runs no training or fine-tuning on your data and builds no model of its own, and the gateway routes only to providers that neither retain your prompts and responses nor train on them.
**Can one partner's question surface another partner's data?** No. Every answer and every action is scoped to the permissions of the person asking, on every channel the agent answers in.
**How do you handle prompt injection?** By containment rather than by filtering. An agent's tools are a fixed set, its scope comes from the authenticated session rather than the conversation, writes are re-checked against what you made editable, and the decisions that matter sit behind human approval. Text in a document, a message or a tool response cannot widen any of that.
**We want to connect our own MCP server. What does that expose?** Only the tools your server chooses to expose, reached over HTTPS with a token your server issues and authorizes per call. You inspect the tool list in a live test before the connection can be saved, and deleting the connection removes those tools from the agent.
**Are the conversations stored?** Yes. Conversations with the partner support agent are kept in its Conversation History, along with the feedback your team leaves on answers, and access follows your normal Introw permissions. The model provider keeps nothing.
**Can we turn AI off?** Yes. The partner-facing agent is off until you enable it, and the agents that help your team are enabled per feature.
**Can we choose the model?** No, and that is deliberate. Central model selection is what makes the retention rule enforceable in one place.
**Who is accountable for what an agent does?** You are, and the record shows it: conversations are traced, actions run through the same permissioned paths as your team's, and approvals keep a person on the decisions you choose to keep.
**Where is the paperwork?** The SOC 2 Type 2 report, the ISO/IEC 27001:2022 certificate, the subprocessor list and the retention detail all live in the [Introw Trust Center](https://trust.introw.io). For anything it does not answer, ask your Introw contact or [support](mailto:support@introw.io).
## Going deeper
Certifications, subprocessors, and the full security posture.
The sources every agent is allowed to answer from.
Instructions, scope, and when it escalates to a person.
How people get into Introw, and what they can reach.
**Works with**
You choose the sources every agent is allowed to answer from.
AI reviews the submission and a human keeps the decision wherever you want one.
What a partner may see in the portal is the ceiling on what the agent will tell them.
Your team and your partners reach the same scoped toolset from their own assistant, over OAuth.