How Promptless uses AI

Promptless uses AI language models to generate documentation suggestions for your team. This page explains how Promptless uses AI and how it protects customer data throughout that process. Each point links to the security page where it is documented in full.

Which AI models Promptless uses

The default configuration for cloud-hosted customers uses AWS Bedrock. Promptless is built on a model-agnostic architecture that works with a variety of models, but the final choice of model will be determined by you and the Promptless team during onboarding. For the full list of AI infrastructure providers, see subprocessors.

Promptless does not train models on your data

Regardless of model choice, Promptless does not use customer data for pre-training or fine-tuning language models. Your content is used solely to generate your documentation suggestions. On the default AWS Bedrock path, model providers do not have access to your prompts or completions, so your content is not available to them to train their models. For more detail, see privacy policy and subprocessors.

Promptless processes trigger and integration data in real time and doesn’t store it

When a GitHub PR trigger, a Slack thread, or a context source such as Linear or Jira drives a documentation update, Promptless processes that content in real time to generate suggestions and then discards it. Promptless does not retain a copy of source code, support conversations, or other integration data. For more detail, see data handling and classification and privacy policy.

What Promptless stores

Promptless stores minimal data and otherwise operates in a stateless manner:

Copies of your documentation, which is typically public.
Feedback you provide about the quality of documentation updates.
Integration auth tokens, not the content behind them.

For more detail, see data handling and classification.

Promptless does not process end-user data

Promptless is not configurable to process or store sensitive end-user data for your organization. For more detail, see data handling and classification.

Least-privilege access to your tools

Promptless follows the principle of least privilege:

Context sources are read-only, and you control the integration scope, so Promptless accesses only the repositories, channels, or projects that you configure.
For especially security-conscious setups, you can connect context sources through a dedicated service account, rather than a broadly privileged individual’s, and share only the specific projects, drives, or folders it needs — limiting Promptless to exactly what you share.
The one exception is your documentation repository, where Promptless opens pull requests, limited to the documentation paths you configure.
If you prefer not to grant write access at all, read-only options are available: a read-only GitHub app that opens pull requests from a fork, and a read-only GitLab token.
Access can be revoked or rotated at any time.
Your data is isolated per organization: every record is tagged with an organization ID and queries are scoped to that organization, so there are no shared data contexts between customers. See network architecture for the multi-tenant security model.
Inside Promptless, role-based access control enforces three roles: Admin, Editor, and Collaborator.

For more detail, see access and permissions.

Encryption

Data in transit is encrypted using TLS 1.2 or higher, and data at rest is protected using AES-256 encryption. For more detail, see network architecture.

Enterprise and self-hosting options

Enterprise customers can self-host Promptless or use customer-managed model deployments so external AI providers never process your content. Self-hosting keeps all data within your own environment. For more detail, see self-hosting and subprocessors.