Every enterprise security review of an AI feature starts roughly in the same place:

These are the right questions to ask. This article explains, in plain language, how Cutover AI handles your data, what is processed, what is retained, and what we do not do with your information.

When you use Cutover AI:

When you use Cutover AI, your request is processed by Cutover’s AI service over the same internal service path used by the Cutover platform. The AI service is not exposed to the public internet and is reachable only by tenants using it through Cutover.

The service then calls AWS Bedrock in the AWS region configured for your Cutover instance:

This is a data sovereignty guarantee, not a configurable default. EU customer data is never processed in US regions, and US customer data is never processed in EU regions.

Cutover uses foundation models hosted through AWS Bedrock, including:

These models run on AWS infrastructure through Bedrock. Third-party model providers do not receive customer requests directly — their models run within AWS infrastructure. Even when traffic moves between AWS services, it remains within the AWS network.

Cutover AI processes customer data only for the duration of a request.

Examples of data processed may include:

This data is:

Cutover does not retain:

The full conversation history is stored only locally on your device and is sent to the AI service each time a new request is made to provide the necessary context for generating a response. Cutover does not store this conversation history in a database or retain it after processing.

Customer payload data is not retained in databases, caches, or logs. Requests are isolated from one another, with no shared customer context between sessions or between customers.

To operate and monitor the AI service, Cutover retains limited operational telemetry such as:

This telemetry is used to monitor service health, investigate issues, and improve platform reliability.

Telemetry does not include:

Cutover AI does not have direct access to the Cutover core database.

Instead, it interacts with Cutover using the same Public API available to external integrations, using the credentials of the user who initiated the AI request.

This means:

All actions are:

Every AI action is recorded in the platform audit trail in the same way as user actions.

In practice, Cutover AI can only perform actions that a human user could perform manually — it simply does so more quickly and through natural language interaction.

Cutover does not fine-tune models on customer data.

Customer inputs and outputs are not used to train:

AWS Bedrock’s terms prohibit AWS and the third-party model providers it hosts from using customer inputs or outputs to train their models. This commitment is contractual and enforced at the AWS service layer, not dependent on Cutover configuration.

Cutover AI uses off-the-shelf foundation models and techniques such as:

These techniques do not require customer data to become part of model weights.

Each AI request is handled independently.

There is:

One customer’s runbooks and operational data do not influence another customer’s AI responses.

Cutover AI is designed to process customer data securely and only for the purpose of generating the requested response.

In summary:

✅ Processed within AWS Bedrock in your configured AWS region

✅ Not exposed to the public internet

✅ Customer content processed in-flight and discarded after response

✅ No customer payload data stored in databases, caches or logs

✅ Operational telemetry retained without prompts, outputs, or API keys

✅ Same permissions as the calling user

✅ All actions authenticated and audited

✅ No model training on customer data

✅ AWS contractually prohibits model providers from training on customer inputs or outputs

✅ No cross-tenant data sharing or reuse