AI Data Handling Sheet
What is sent, to whom, what is retained, who can see it — on one page.
The AI has read-only access by design. No component of the AI Bridge can write to, or actuate, any SCADA control point — without exceptions and without configuration flags that enable it.
This sheet describes the data flows of the Marketplace AI Bridge, the gateway that lets atvise products use AI during a trial without creating accounts with any AI provider. It exists so that your IT and OT security teams can evaluate the trial without a meeting.
What is sent
When you use an AI feature, your product sends the text to analyze (for example alarm lists, trend summaries or report text) together with a task alias and a short-lived access token to our gateway. The gateway reconstructs the request server-side — model, limits and system instructions are set by the server, never by the client — and forwards it to the AI provider. Nothing else on your server is read or transmitted.
What is never stored
We do not store the content of prompts or responses. Not by default, not for debugging, not in backups. The content exists in memory only for the duration of the request.
What is logged (metadata only)
For billing, abuse prevention and your own consumption dashboard, each request records the following metadata:
Upstream provider
Requests are routed through OpenRouter to the model configured by the Marketplace. Credentials for the provider exist only on our gateway, encrypted at rest. We configure the retention and no-training options available on the provider account and restrict routing accordingly; the currently enabled providers are documented on request.
Spending caps
Every trial has three server-side caps accounted in USD: per request, per day, and for the whole trial period, plus a global program cap. When a cap is reached, requests pause with a clear message — nothing is billed to you.
Who can see the data
Usage metadata is visible to you (your own trial) in your dashboard, and to Marketplace administrators in aggregate for operating the program. Since prompt and response content is not stored, nobody — including us — can read it after the request completes.
Revocation and deletion
You can regenerate your key at any time; administrators can suspend or revoke access immediately, per trial or globally. On revocation the key stops working at once. Usage metadata is retained for accounting; you can request its deletion by contacting us.
When the trial ends
The product keeps working — AI features pause and offer two paths: configure your own AI key (encrypted, never displayed, used only for your installation) or contact us about credits. No data is lost at expiry.
Contact
Questions from your security or data-protection team are welcome: legal@scadanextgen.com. We answer plant-IT questionnaires about this sheet within a few business days.
Last updated: 5 August 2026 — this sheet is versioned together with the gateway.