Data handling & security
What Encatch sends to your provider, what it keeps, and how your API key is protected
Encatch sends your provider only what each AI feature needs, keeps none of those requests, and never shows your API key again after you save it.
What Encatch sends to your provider
Each request goes to the connection and model you configured for that capability (or the project default).
| Feature | Data sent to your provider |
|---|---|
| AI form builder | The prompt you write, and the current form draft when you ask the assistant to change it |
| External Insights chat | Your question and the project feedback being analysed |
| Topic categorisation | Written response text, and the topic groups assigned to that question |
| Destination AI filter | Feedback text, your filter prompt, and any context fields you selected (questions and answers, device, location, or user information) |
| Destination AI filter (Jev engine) | The same data as Destination AI filter |
| Translation | Form or survey text to translate |
| Refine text | The respondent's draft answer |
| Feedback Q&A | The respondent's question and the knowledge-base text you configured |
| Sample data | Form question text needed to write realistic sample answers |
What Encatch keeps
Encatch doesn't store the requests it sends to your provider or the raw responses it gets back. The results you see in Encatch, such as themes and summaries, are saved with your survey data, just as they are with Encatch's built-in AI.
How your API key is protected
- Your key is stored encrypted at rest.
- Your key is write-only. Once saved, no one can view it in Encatch, including admins.
- To change it, you replace it with a new key. See Manage providers.
What your provider agreement covers
Once data reaches your provider, your agreement with them governs how it's processed, including retention, model training, and region. Before connecting, we recommend that you:
- Review your provider's data retention and training settings for API usage.
- Create a dedicated API key for Encatch, so you can monitor and revoke it separately.
- Set a spending limit or usage alert in your provider's console.
- Rotate the key according to your security policy.
Was this page helpful?