# Data security and compliance

> Delegate's redaction layer, data handling, network requirements, and compliance certifications.

This page covers the data-handling, network, and compliance detail behind the claims in [Security overview](security-overview.md). It is written for security and compliance reviewers evaluating Delegate before deployment.

Delegate runs on UiPath Automation Cloud and inherits its platform-wide security posture, including the AI Trust Layer. This page covers the essentials; for the full platform-level detail — infrastructure, sub-processors, data residency, and certifications — see [Data security and compliance](https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/data-security-and-compliance) in the Automation Cloud admin guide.

## Preventing accidental data leakage

Independent of every other control, Delegate runs an always-on redaction layer so that sensitive data does not leak by accident.

- **Secrets and personal data are removed from tool output before the model sees it.** Every tool's output is checked against more than 560 patterns and redacted. This covers API keys and tokens (AWS, Azure, GCP, OpenAI, GitHub, Stripe, Slack, and many more), private keys and certificates, database connection strings, and personal data such as national identifiers, credit cards, bank and routing numbers, passports, medical identifiers, emails, phone numbers, and IP addresses.
- **Telemetry and logs are cleaned** of user paths and emails before anything leaves the device.
- **Diagnostics and settings exports are redacted**, including tokens, secrets, and credentials.

This runs on the device and is on by default, so secrets are stripped before tool output is sent to the model.

This is separate from, and in addition to, the AI Trust Layer's own in-flight PII masking described below.

## Where your data goes

| Question | Answer |
|---|---|
| Does my screen or data reach a large language model? | Yes. The content a task needs, including screenshots, is processed by a model. Delegate does not call a model vendor directly — every request passes through the UiPath AI Trust Layer over an encrypted, service-to-service-authenticated connection, under a contractual ban on training with your data. |
| Which models process my data? | The model you select processes your request — see [Choosing the LLM model](choosing-the-llm-model.md). It reasons about your request and interprets what it sees on screen. Requests route through the AI Trust Layer, or your own model if you bring one. |
| Can we use our own model? | Yes. You can bring your own model, including one hosted locally or on-premises. In that case, the entire data flow stays within your environment and under your control. |
| Is my data used to train AI models? | No. Training on customer data is contractually prohibited. Model providers also don't retain your data beyond short-lived, in-memory processing used to serve the request — typically cleared within minutes, and at most 24 hours depending on the provider. |
| Is it encrypted? | Yes. TLS 1.2+ in transit, including the connection to the model gateway, and AES-256 at rest. |
| Where are my conversations stored? | By default, conversation history is stored in UiPath Automation Cloud. A local-only mode keeps that history on your machine. Either way, the content a task needs is still processed by the model — local-only changes where history is stored, not whether data is processed. |
| How is my data deleted? | Deleting a conversation yourself triggers a permanent hard delete. Your organization can also request an organization-wide deletion — for example, under GDPR Article 17 — handled server-to-server. |
| Who can see my login? | Your existing UiPath identity (OIDC). Tokens are encrypted in the operating-system keystore — Windows DPAPI or macOS Keychain. |
| Who at UiPath can see my data? | UiPath support staff only, with your explicit approval, and every access is tracked and logged. Your data is never aggregated or used to build profiles. |
| Can content Delegate reads take it over, through prompt injection? | Delegate is layered against this: the model itself resists treating instructions found in a webpage, document, or email as commands; independent of the model, your authorization and restriction rules — blocked paths and apps, the scripting sandbox, per-operation Allow/Ask/Block — still gate any consequential action even if the model is fooled; and the AI Trust Layer can add a further, configurable prompt-injection detection layer. |
| Is personal data masked before it reaches the model? | The AI Trust Layer applies configurable PII masking to requests at the gateway, pseudonymizing common personal identifiers before the model sees them. This is separate from the on-device redaction layer described above, which strips secrets and personal data from tool output before it is even sent. Gateway-level masking does not classify clinical or health-record content as a distinct category, and it does not visually redact screenshots before they reach the model. |

## Models and inference

| Question | Answer |
|---|---|
| Which LLM powers Delegate, which provider hosts it, in which region does inference run? | Delegate is powered by the models available through the AI Trust Layer. Available providers, their hosting regions, and routing are documented in [AI features and model routing](https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/ai-features-and-model-routing). Routing is configured per tenant, product, and feature — see [Configuring LLMs](https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/configuring-llms). |
| What models handle Computer Use / screen interpretation, and where are they hosted? | The frontier model you have selected interprets what it sees on screen, the same model that handles the rest of your request. A UiPath-hosted location-grounding API works alongside it to pinpoint exact screen coordinates from the locator description the model generates. |
| Can admins restrict which models are available to Delegate users? | Yes. The Delegate policy in Automation Ops controls which models are available, alongside other security settings — see [Governance with Automation Ops](centralized-configuration.md). |

## Network and deployment

- **Outbound HTTPS only**, to UiPath domains for authentication, APIs, and AI inference. No inbound connections are required.
- **Telemetry carries operational signals only** — errors, timings, feature usage. It never includes conversation content, tool output, or screenshots.
- Delegate honors your system proxy and enterprise root certificates.
- See [Installation](installation.md) for supported operating systems and hardware.

## Compliance and certifications

Delegate inherits the compliance posture of UiPath Automation Cloud, published at the UiPath Trust Center: SOC 1 and SOC 2 Type 2, ISO/IEC 27001, 27017, and 27018, ISO/IEC 42001 (AI management), HIPAA, HITRUST, C5, IRAP, and Cyber Essentials Plus, together with GDPR commitments and a published sub-processor list. See the [Automation Cloud data security and compliance guide](https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/data-security-and-compliance) for the underlying detail on each certification and the sub-processor list.

Delegate falls under your organization's existing Automation Cloud Data Processing Addendum (DPA) — no separate or amended agreement is needed to use it.

## Shared responsibility

UiPath owns the platform: the redaction layer, encryption, access controls, and the security of the AI Trust Layer itself. Your organization owns how Delegate is configured for your environment — approval modes, tool permissions, blocked paths and apps — and reviewing what Delegate produces before acting on it.