AI privacy
The planning model does not receive your full spreadsheet
AI is used for structured rule suggestions, not file execution. The product builds a narrow request from the deterministic profile, and the optional sample control determines whether any masked example values are included.
What is sent when samples are off
The default request contains dataset-level counts, encoding information, column names, inferred types, missing percentages, unique counts, detected issue summaries, and warnings. It does not contain raw file bytes, storage keys, signed file URLs, user identity, sample rows, or per-column sample values.
This statistics-only mode can still support suggestions about types, missingness, duplicates, and known issue categories while reducing the amount of value-level context shared with the model.
What changes when you opt in to masked samples
If you turn on the sample option, the request may add existing masked per-column examples and at most five masked rows created by the profiling pipeline. The setting is explicit for each plan generation and remains off by default.
Masking lowers exposure but does not make sample data risk free. You should leave the option off for sensitive datasets unless the additional context is appropriate for your use case.
- Default: statistics only
- Opt-in: up to five masked rows
- Never: the full uploaded file in the planning request
- Context and data-dictionary previews are not sent to AI
Execution happens in a separate deterministic service
After the model returns suggestions, the server validates them against the operation schema and current profile. You review and confirm the plan before a different Worker applies those rules to the file.
Recipe mapping, advanced operations, and the development-only context editor do not enter the real model request or Worker payload in this phase. Their preview exists to refine future product contracts without expanding current data sharing.