Security & Privacy FAQ
This document addresses the most common security, privacy, and compliance questions enterprises ask when evaluating AI-based solutions. It covers both on-premises and SaaS deployment models. Where answers differ by deployment model, a SaaS deployment note is included.
Data Privacy & Handling
What data does Robi AI send to external services?
Robi AI submits context information to Azure OpenAI for processing that includes:
- User prompts
- Contextual UAC system information such as task details, workflow states, and execution logs (specific information is dependent on user prompt or agent requirements)
- Documentation embeddings
- Tool lists
No raw credential data, passwords, or full database contents are transmitted. The scope of data sent is limited to what is contextually necessary to answer the user's question.
Does Stonebranch or Microsoft use our data to train AI models?
No. Robi AI uses Azure OpenAI Service, which operates under Microsoft's data privacy commitments for enterprise customers. Azure OpenAI does not use customer data submitted via the API to train, retrain, or improve its foundational models. Your UAC data remains yours and is not used for any model training purposes by either Stonebranch or Microsoft.
Where is our data processed and stored?
Data is processed within your organization's own Azure subscription and Azure OpenAI instance, meaning you control the Azure region, compliance boundary, and data residency. Robi AI does not route data through Stonebranch's infrastructure. The Vector Database (used for documentation embeddings) is deployed within your own environment as part of the Robi AI installation.
For SaaS customers, the UAC Controller and Robi AI components are hosted by Stonebranch, but AI inference (LLM calls) still routes to your own Azure OpenAI instance. This means model-level data residency and the Azure compliance boundary remain under your control. Similar to the UAC database, the Vector database is provisioned within Stonebranch's hosted environment for SaaS deployments; confirm with your Stonebranch account team which Azure region that environment runs in if geographic data residency is a requirement.
Does Robi AI store conversation history or user prompts?
Robi AI does not contain a persistent conversation store. Conversation context is held in memory only for the duration of the conversation. Closing the chat window clears the conversation immediately; otherwise, it is automatically purged after a 24-hour inactivity TTL.
Interaction activity is captured in UAC's standard audit and activity logs (AI Service log: ai.log; AI MCP Server log: ai-mcp.log), which your team controls and can configure for retention, rotation, and access.
For SaaS customers, logs are written within Stonebranch's hosted environment. Ask your Stonebranch account team about log access procedures, retention settings, and whether log export to your own SIEM is supported.
Is any data shared with Stonebranch as part of normal operations?
For on-premises deployments: No. The AI Service, AI MCP Server, and Vector Database all run within your own infrastructure. The components expose standard operational metrics (aggregate counts and durations only), which remain within your environment on-premises. For SaaS, these operational metrics may be collected by Stonebranch's hosted monitoring. Stonebranch does not have a data pipeline into your Robi AI deployment and does not receive telemetry, prompts, or results.
For SaaS customers, UAC and the Robi AI components are hosted within Stonebranch's environment, so Stonebranch has infrastructure-level access as the hosting provider. However, AI inference (where your prompt and UAC data are actually processed by the LLM) routes to your own Azure OpenAI instance and does not pass through Stonebranch's systems. Review Stonebranch's DPA for the full scope of data processed in the SaaS hosting relationship.
Architecture & Deployment
What is the Robi AI architecture and where do components run?
Robi AI consists of three primary components: (1) the AI Service, which handles LLM orchestration and communicates with Azure OpenAI; (2) the AI MCP Server (Model Context Protocol), which exposes UAC tools and data to the AI; and (3) the Vector Database, which stores documentation embeddings for context-aware responses. For on-premises deployments, all three components run within your own environment and are not hosted by Stonebranch.
For SaaS customers, the AI Service, AI MCP Server, and Vector Database are hosted by Stonebranch as part of the managed deployment. The critical distinction is that LLM inference still calls your own Azure OpenAI endpoint; Stonebranch does not provision a shared model for SaaS customers.
Which AI model providers are supported?
Robi AI officially supports Azure OpenAI only. This is a deliberate design choice to ensure enterprise-grade security, compliance, and data residency controls. Azure OpenAI requires customers to provision their own Azure subscription with the Azure OpenAI service, meaning model inference happens within your Azure tenancy. While other model providers may be technically configurable, they are not supported.
What Azure OpenAI resources are required?
Two Azure OpenAI model deployments are required: one for the chat/reasoning model and one for generating documentation embeddings. You will need an active Azure subscription with Azure OpenAI provisioned, an API key, an endpoint URL, and the deployment names for both models. All of these resources exist within your Azure environment.
This requirement is the same for SaaS customers. You provision and own the Azure OpenAI resources; Stonebranch's hosted environment is configured to call your endpoint using your API key. This ensures inference data never transits a shared model instance.
Does Robi AI require internet access?
For on-premises deployments, Robi AI requires outbound HTTPS access to your Azure OpenAI endpoint (hosted in your chosen Azure region). All other components run locally. No inbound internet access is required.
For SaaS customers, internet connectivity is inherent to the deployment model. Outbound LLM calls route from Stonebranch's hosted environment to your Azure OpenAI endpoint over HTTPS.
Access Control & Authentication
How is access to Robi AI controlled within UAC?
Access to Robi AI features is governed by UAC's existing role-based access control (RBAC) framework. Viewing and configuring AI Settings requires a valid AI License and the following roles:
- Configuring (write) requires ops_admin.
- Viewing (read) requires ops_admin OR ops_service.
The Robi AI Assistant and Analyze Now features are enabled system-wide by the administrator.
AI capabilities do not bypass UAC's existing permission model. Actions taken via Robi AI are subject to the same authorization checks as direct UI interactions.
What prevents users from taking unauthorized actions through Robi AI?
Robi AI is instructed to request explicit user confirmation before any write or destructive operation (such as launching a task or updating a record). This human-in-the-loop control means no unintended changes occur silently.
System contexts also provide explicit instructions on the type of prompts and associated tools that are allowed from user prompt requests.
Independently, the Controller's RBAC permission model authorizes every action, so the AI can never exceed the user's existing rights regardless of the confirmation flow.
Is there an audit trail for AI interactions?
Yes. Both the AI Service and AI MCP Server write activity logs (ai.log and ai-mcp.log) to their respective Tomcat instance log directories. Log levels are configurable (INFO, DEBUG, etc.). By default, logs roll daily and at 10MB file size, with 7 days of compressed archive retention by default. These settings are all configurable to align with your retention policy. These logs can be ingested into your SIEM or log management platform.
In addition to the AI Service and MCP Server logs, actions that Robi AI performs against Universal Controller are captured in the Controller's standard audit records (the same audit trail as manual UI/API actions). Each record is attributed to the acting user and is tagged with the Robi AI and MCP Server version identifiers (recorded in the audit record's Info field), so AI-originated changes are distinguishable and traceable within your existing auditing.
For SaaS customers, logs reside within Stonebranch's hosted environment. Confirm with your account team whether direct log access, log forwarding to your SIEM, or log export is available, and what the standard retention period is.
Can individual AI features be disabled?
Yes. The AI Assistant and AI Analyze features can be independently enabled or disabled through the AI Settings page in the UAC Administration panel.
MCP tool whitelisting is configured at the AI Service configuration-level. Individual MCP tools can be selectively enabled or disabled via the AI Service configuration, allowing administrators to limit AI capabilities to a specific, approved set of operations, configurable independently for the Assistant and Analyze features.
Does Robi AI support SOC 2, ISO 27001, or other compliance frameworks?
Robi AI is built on Azure OpenAI, which is covered under Microsoft Azure's compliance certifications, including SOC 2 Type II, ISO 27001, ISO 27018, HIPAA, FedRAMP (Government regions), and others. Since Robi AI uses your own Azure environment for AI processing, your organization inherits Azure's compliance posture for that layer. The Stonebranch UAC platform maintains its own compliance certifications; contact Stonebranch for the current documentation package.
For SaaS customers, Stonebranch as a hosted service provider is also in scope for compliance reviews. Request Stonebranch's SOC 2 report and any applicable certifications for the hosted UAC environment as part of your assessment.
How does Robi AI handle GDPR or other data protection regulations?
Because LLM inference is processed within your own Azure subscription (in your chosen Azure region), you control the geographic scope of AI data processing. Azure OpenAI's data processing agreement supports GDPR compliance. Since Robi AI does not retain conversation data persistently, there is no long-term personal data store to manage. Review Microsoft's Azure Data Processing Agreement and Stonebranch's DPA for complete coverage.
For SaaS customers, Stonebranch is a data processor for the hosted environment. The Stonebranch DPA should cover the hosting relationship. The Azure DPA covers LLM inference. Request both documents from your Stonebranch account team.
Can we perform a third-party security assessment of Robi AI?
For on-premises deployments, your security team or third-party assessors have full access to assess the deployment within your own environment. Contact Stonebranch for additional technical documentation to support your assessment.
For SaaS customers, third-party penetration testing of Stonebranch's hosted environment typically requires coordination with Stonebranch. Contact your account team to understand the terms and process for security assessments against the SaaS deployment.
Is there a data processing agreement (DPA) available for Robi AI?
Stonebranch provides a Data Processing Agreement for UAC customers. For the AI processing layer, the primary data processing relationship is between your organization and Microsoft Azure (for Azure OpenAI), as Stonebranch does not handle LLM inference for on-premises deployments. Contact your Stonebranch account team to request the DPA.
For SaaS customers, Stonebranch is a covered data processor for the hosted environment, making the Stonebranch DPA directly relevant and important to obtain. You will need both the Stonebranch DPA (for hosting) and the Microsoft Azure DPA (for LLM inference via your Azure OpenAI instance).
Operational Security & Monitoring
How do we monitor the health and security posture of Robi AI?
Robi AI exposes health and performance metrics through Observability endpoints on the AI Service, compatible with standard monitoring tooling. Logs are written to configurable file paths and can be forwarded to your SIEM, log aggregation platform, or monitoring stack. Both the AI Service and AI MCP Server support configurable log levels, enabling detailed audit trails when needed.
For SaaS customers, infrastructure-level monitoring is managed by Stonebranch. Ask your account team about SLAs, incident notification procedures, and whether metric feeds or log exports to your monitoring tools are available.
What happens if the Azure OpenAI service is unavailable?
Robi AI degrades gracefully when Azure OpenAI is unavailable. UAC itself continues to operate normally; all core workload automation functions are unaffected. Only the AI Assistant and AI Analyze features become temporarily unavailable. No data loss or workflow disruption occurs.
How are software vulnerabilities and patches managed for Robi AI?
Robi AI components are maintained and patched by Stonebranch as part of the product release cycle. Third-party security scans are conducted on a nightly basis and addressed based on risk analysis and scoring. Customers receive security updates through the standard UAC upgrade process. Stonebranch recommends maintaining a current UAC version to ensure timely access to security patches.
For SaaS customers, Stonebranch applies patches and upgrades to the hosted environment directly, typically without requiring customer action. Confirm with your account team the patch cadence, change notification process, and maintenance window policies.
Can Robi AI actions be rate-limited or throttled to prevent misuse?
Rate limiting on the AI processing side is governed by your Azure OpenAI deployment's token quota and throughput tier, which you configure within your Azure subscription.
For SaaS customers, Azure OpenAI rate limits are still governed by your own Azure deployment configuration, since you bring your own Azure OpenAI instance.
AI Risk & Responsible Use
Can Robi AI autonomously take actions without human approval?
No. Robi AI is designed with a human-in-the-loop model. Before any write or destructive operation, such as launching a task, updating a record, or modifying a workflow, Robi AI is instructed to request explicit user confirmation. Read-only actions do not require confirmation but are still subject to UAC's RBAC controls.
How do we prevent sensitive information from being inadvertently exposed through AI responses?
Robi AI's responses are scoped to what the authenticated user is already authorized to see within UAC; it does not grant access to data beyond the user's existing permissions. Additionally, AI responses are generated within the context of the current user session, so no cross-user data leakage occurs. For highly sensitive environments, administrators can limit AI tool access using the configurable Tools settings to restrict which UAC data the AI can surface.
What is the risk of AI 'hallucination' affecting operational decisions?
Robi AI uses a Retrieval-Augmented Generation (RAG) approach, grounding its responses in actual UAC documentation (via the Vector Database) and live system data (via the MCP Server). This significantly reduces the risk of hallucinated responses compared to a purely generative approach. For UAC documentation questions, Robi includes reference links to the source documentation pages so users can verify answers. Stonebranch recommends that operators validate AI-suggested corrective actions before applying them in production.
Does Robi AI support our AI governance and acceptable use policy requirements?
Robi AI's design supports common enterprise AI governance requirements: human-in-the-loop controls for write operations, role-based access gating, audit logging of AI interactions, configurable tool scopes, and no persistent storage of user prompts. Stonebranch can provide documentation to support your AI governance review. The key architecture fact is that AI inference routes to your own Azure OpenAI instance regardless of deployment model.