> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.pivotal.app/llms.txt.
> For full documentation content, see https://docs.pivotal.app/llms-full.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pivotal.app/_mcp/server.

# Privacy

Pi reads your workspace data so it can answer questions about it. The questions teams ask before they trust an AI feature in production are below, with direct answers.

### What data can Pi see?

Pi sees the records your account can see in Pivotal. That includes customers, contacts, onboardings, tasks, comments, attachments, audit log entries, and your voice profile. If your role can't open a customer, Pi can't read it either. Permissions in Pivotal apply to Pi without exception.

### What can Pi never see?

* Data from any other workspace, including workspaces in the same organization you don't belong to.
* Records you've been removed from, going forward.
* Data from connected systems (HubSpot, Stripe, Slack) that Pivotal hasn't synced into the workspace. Pi only reads what's in Pivotal.
* Your password, API keys, or billing details.

### Where does my prompt history live?

Every prompt you send and every response Pi returns is stored against your account in Pivotal's database, encrypted at rest. Retention follows your **Prompt history** setting in [Pi preferences](/product/ask-pi/pi-preferences). The default is 90 days. After the retention window, prompts and responses are deleted.

A workspace admin can view aggregate Pi usage (number of prompts per user, top prompt types) at **Admin > Audit log > Pi queries**. The admin view does not include prompt text.

### Does Pi train on my data?

No. Pi runs on Anthropic's API with zero-retention enabled. Your prompts and the data Pi pulls to answer them are not used to train models. Anthropic discards the request after the response is returned.

### Is data sent in clear text?

No. Every Pi request travels over TLS to Anthropic's API. Your workspace data is encrypted at rest in Pivotal's database. Voice profile samples carry the same protection.

### Can I see what Pi accessed for a given answer?

Yes. Turn on **Cite by default** in [Pi preferences](/product/ask-pi/pi-preferences) and Pi attaches a source chip under every answer. The chip lists the records Pi read (customer ids, onboarding ids, comment ids). Click any chip to open the source record.

### Who at Pivotal can read my prompts?

Pivotal staff cannot read your prompts without your written consent, given case-by-case for support. If you email `help@pivotal.app` and approve access, support reads only the thread you flag, and access expires after 72 hours.

### How do I export or delete my prompt history?

Open **Account > Pi preferences > Prompt history > Manage** to export your full prompt log as JSON or delete it. Deletion is immediate and permanent.

### What about EU residency?

If your workspace is on the EU plan, all Pi traffic routes through Anthropic's EU endpoint and prompt history is stored in our Frankfurt region. Workspace admins set residency at **Admin > Workspace settings > Data residency**.

## Related

* [Pi preferences](/product/ask-pi/pi-preferences)
* [Limitations](/product/ask-pi/limitations)
* [Roles and permissions](/product/setup/roles-and-permissions)

Email **[help@pivotal.app](mailto:help@pivotal.app)** with a screenshot of where you got stuck and the customer or onboarding id from the URL.