> ## Documentation Index > Fetch the complete documentation index at: https://docs.getinteract.com/llms.txt > Use this file to discover all available pages before exploring further. # Overview > How Interact protects your data — connectors, chat retention, AI processing, access control, and hosting. This page explains how Interact handles data in practice. It is an overview for administrators and users — not a legal contract. Binding terms are in Interact; see [Legal documents](#legal-documents). ## How Interact uses your data Interact connects to the data warehouse and platforms you configure, runs queries and analyses, and returns answers in chat, reports, jobs, and monitors. In that flow: * **You** decide which systems to connect, which semantic models agents may use, and who in your organisation can access which agents. * **Turntwo Interact** processes that data as a processor under the DPA when it is Subscriber Data (for example chats, query results shown in Interact, and reports). * **AI model providers** receive the prompts and context needed to answer a question for the models enabled on your agents — nothing more than that request requires. Interact is built for marketing and business analytics. Do not bring special-category personal data into Interact, and keep connected data limited to what your analysis needs. ## Data access & connectors Data Analyst agents reach your warehouse only through a **connector you assign per agent**, and only through the **semantic models** you select for that agent. That combination is the main access-control model in Interact. ```mermaid theme={null} flowchart TB SA[Data warehouse connector] --> Agent Models[Allowed semantic models] --> Agent Agent --> Tables[Source tables of those models] Tables --> WH[Your warehouse] ``` > [accordion] Encrypted credentials > > Service account credentials are encrypted with **Google Cloud KMS** before storage. They are decrypted only at query time and are never shown to AI models. > [accordion] Per-agent warehouse connection > > Each agent selects its own warehouse connection. You can create multiple connectors with **different credentials and IAM scopes** (for example a marketing-only service account vs a broader analytics account) and attach the right one to each agent. > [accordion] Semantic models and source tables > > For every agent you select which semantic models it may use. Each model maps to a warehouse source table. The agent queries through those models; if raw SQL is enabled, it may only read the **source tables of the selected models** — not arbitrary tables in the project. > [accordion] Least privilege in your cloud > > Provision each warehouse service account with the minimum access required — typically read-only roles on the datasets that agent’s models need. Prefer separate accounts when agents serve different sensitivity levels. > [accordion] Read-only warehouse queries > > Connectors run read-only `SELECT` queries. Interact does not write to, modify, or delete data in your warehouse. ## Query & LLM limits These are separate controls: one protects your **warehouse bill** (bytes scanned), the other caps **AI spend** in Interact. ### Warehouse query limits On each warehouse connector you can set a **maximum billable data volume per query**. For BigQuery this is configured in megabytes (default 1000 MB ≈ 1 GB) and passed through as `maximumBytesBilled`. If a query would scan more than that limit, the warehouse rejects it — so a single agent query cannot run an unbounded scan against your project. ### LLM cost caps AI usage is measured in Credits (based on model-provider cost). Administrators can cap spend at several levels: | Level | What you can set | Where | | - | - | - | | **Organisation** | A monthly **credit limit**. When it is reached, Interact stops starting new paid work for the rest of the month (work already running may finish). | **Settings → Usage → Limits** | | **Organisation default per member** | A default LLM usage limit in **€** per member, with a **weekly** or **monthly** reset period. Applies to every member without a group or personal override. | **Settings → Usage → Limits** | | **Group** | A per-member LLM usage limit in **€** for members of that group. | **Settings → Groups** (group settings) | | **User** | A personal LLM usage limit in **€** for one member. | **Settings → Members** | **Which member limit applies:** personal override → otherwise the **strictest (lowest) group** limit among the member’s groups → otherwise the organisation default → otherwise no member limit. Organisation credit limits and member LLM caps are independent of the warehouse per-query byte limit. ## Chat & AI processing ### Chat history Interact stores chat history so users can continue conversations and review past answers. | Chat type | Retention | | - | - | | Unsaved chats | Deleted after **180 days** | | Saved chats | Deleted after **2 years**, or earlier if you delete them or your agreement with Turntwo ends | ### AI models Agents use **Anthropic Claude** by default. You can choose a different model per agent (for example Google Gemini or OpenAI GPT). Only the providers for the models you use receive that request’s prompts and data. AI model providers are often located outside the EEA (typically the United States). Transfers use an adequacy decision (such as the EU–US Data Privacy Framework where the provider is certified) or the European Commission’s Standard Contractual Clauses. Query results and chat content are used to answer your questions in Interact. They are **not used to train Interact’s own models**. | Provider | Training / data use | Source | | - | - | - | | **Anthropic (Claude)** | Default model. Turntwo has **not enabled** Anthropic’s options to use customer data for training. Anthropic’s commercial API does not use inputs or outputs for training unless a customer explicitly opts in. | [Is my data used for model training?](https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training) | | **OpenRouter** | Used to route some models. OpenRouter does not use your inputs or outputs for model training. The underlying model provider’s terms still apply. | [Privacy Policy](https://openrouter.ai/privacy) | If you select another model, that provider’s terms apply. Provider policies can change; material updates are reflected in the documents listed under [Legal documents](#legal-documents). ### Guardrails You can add guardrails on an agent — for example PII detection and redaction on user messages, or checks on agent output — to reduce the chance that sensitive values reach a model or a response. ## Access control & governance | Control | What it does | | - | - | | **Organisations** | Each organisation’s data is separated from other organisations. | | **Members & roles** | Admins control who can join the organisation and what they can configure. | | **Groups** | Restrict which users can see and use specific agents. | | **Agent data access** | Limit semantic models (and therefore source tables) per agent and assign user-group access. | | **Two-factor authentication** | Available organisation-wide for **email and password** logins. You can require members who sign in with a password to enroll an authenticator app. SSO sign-in is not covered by this 2FA setting. | | **SSO** | Available when enabled for your organisation. | | **Support access** | Turntwo staff access for support is limited by your organisation’s support access settings. | ## Hosting & data residency Interact’s application and primary data stores run in the **European Union** (for example application hosting and database storage in Frankfurt). Some subprocessors — especially AI model providers and certain background services — process data in or from the United States under the safeguards described above. Services you connect yourself (your warehouse, Slack, Teams, sign-in providers, MCP servers, and similar) are under your control and are not Turntwo subprocessors. ## Security practices Turntwo maintains an information security management system aligned with **ISO/IEC 27001**. Measures include: * Encryption in transit (TLS) and at rest * Encrypted storage of connector credentials via a managed key management service * Role-based access and organisation isolation * Logging, error monitoring, and incident alerting * Regular backups with point-in-time recovery of the application database * Agent actions on external platforms only after explicit user approval * Staff confidentiality and least-privilege access to production systems Full detail is in Annex 2 of the Data Processing Agreement. ## Recommended customer controls * Create **separate connectors** (different service accounts) when agents need different warehouse privileges, and assign them per agent. * On each agent, allow only the **semantic models** (and therefore source tables) that agent should see. * Prefer views or column masking in the warehouse when PII must stay out of those source tables. For example, hash `customer_id` values so agents can still join and count customers without seeing the original IDs. * Set a sensible **max billable data volume per query** on each warehouse connector. * Set **organisation credit limits** and **member / group LLM caps** where you need spend control. * Enable **2FA** for password logins (and SSO where available) for your organisation. * Use guardrails on agents that handle broader or more sensitive questions. * Review member, group, and agent access periodically. * Keep data that must never reach an AI interface out of connected datasets entirely. ## Legal documents | Document | Where to find it | | - | - | | Privacy Policy | [interact.turntwo.com/legal/privacy](https://interact.turntwo.com/legal/privacy) | | User Terms | [interact.turntwo.com/legal/user-terms](https://interact.turntwo.com/legal/user-terms) | | Data Processing Agreement | [interact.turntwo.com/legal/dpa](https://interact.turntwo.com/legal/dpa) | | Subprocessors | [interact.turntwo.com/legal/subprocessors](https://interact.turntwo.com/legal/subprocessors) | | Subscription Terms | [interact.turntwo.com/legal/subscription-terms](https://interact.turntwo.com/legal/subscription-terms) | Questions about privacy or security: [info@turntwo.com](mailto:info@turntwo.com). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.