When you connect an AI provider, it's fair to ask exactly what gets shared and when. This is the straight answer: your data only leaves Stateable when someone on your team actually chats with the assistant, only the parts needed to answer that question go out, and your API key is encrypted and never shown again.
When your data leaves Stateable
The assistant talks to your AI provider only when someone on your team sends it a message. There are no background jobs quietly sending your data anywhere, and nothing is sent unless a person is in the drawer asking a question.
When that happens, what's sent to your provider is:
Your question and the recent back-and-forth of that conversation.
Your field names and types — the labels of your columns — so the assistant can reason about your data structure.
A small sample of a file you attach in the drawer, when you attach one, so it can help with that file.
What is never sent
Your full statement data is not shipped off wholesale. The assistant works against your data inside Stateable and only sends what a specific question needs.
One customer's data is never shared with another. Each organization's data stays separate.
Your API key is never included in anything sent to the model, and is never shown in your browser.
How your API key is stored
When you paste a key into Connect AI (or Settings → Assistant), Stateable encrypts it using Amazon Web Services Key Management Service before saving it. It's decrypted only on our servers, only for the moment it's needed to make a request, and it's never written to logs or sent back to your browser. After you save it, the field shows that a key is set but never displays the key again.
What your AI provider does with your data
Once a request reaches your provider, their policies govern it — not Stateable's. The short version, with each provider's own policy as the authority:
Anthropic does not train models on data sent through the API and keeps it only briefly for safety monitoring. See their Privacy Policy and data retention details.
OpenAI does not train on API data by default and retains it for a limited window for abuse monitoring. See their data usage policy.
Google (Gemini) does not use prompts on a paid API key for training; the free tier is treated differently. See their data governance policy.
A self-hosted endpoint is governed by whoever runs it — review their policy before sending real data.
Turning it off
The assistant is only ever active when a key is connected. If no provider is set up, the assistant simply isn't available — nothing is sent anywhere. To stop using it later, remove the key in Settings → Assistant.
Get help
Still need a hand? Start a conversation from the Support button in the app, or email [email protected]. We reply within one business day for most tickets.
Related articles
Last reviewed: 2026-06-09