The AI master switch, the residency pin and where your data goes
Your workspace's administrators decide whether AI runs at all, which model answers, whether your data may ever reach AxisSynapse's default model, and how much personal data is removed before anything is sent. These controls live in one place — Workspace Settings → AI Gateway — and apply to every AI feature of the workspace, Axis Assure's included.
TL;DR — The AI master switch off means nothing is sent to any model, and assistants and API keys lose every governance tool. Keep data on your own model means AI uses only the model you configured — never the AxisSynapse default model, not even as a fallback. Where your data goes shows the path every AI call takes, read from the same rules the calls follow. Every change that widens where data may go asks you to confirm it's you, and every change is in the audit log.
The AI master switch
Workspace Settings → AI Gateway → AI master switch. One switch for the whole workspace.
- Off: no AI request leaves the workspace. Axis Assure shows no AI controls at all — no "Draft with AI", no AI review, no mapping suggestions, no compliance copilot — and every AI request is refused before anything is sent; scheduled AI skips its run; and assistants — in the app or through an API key — are not offered any Axis Assure or governance tool (risk, audit and policy tools included) while the switch is off.
- On: the capabilities your plan includes are offered to the people whose roles allow them. Where no model is configured (or the workspace is kept on its own model and has none), Axis Assure says so instead of offering a new draft; drafts already made can still be reviewed.
- Turning it on asks you to confirm it's you with any second factor you have enrolled. Turning it off asks for nothing: it should never be slowed down.
- Every change is recorded in the audit log, with the value before and after.
When the platform cannot read your AI configuration at the moment a request is made, an Axis Assure AI request is refused rather than sent.
Where your data goes
Workspace Settings → AI Gateway → Where your data goes shows, for this workspace:
| Row | What it says |
|---|---|
| Answers from | The model that answers: AxisSynapse's default model, or your own (its provider, its host, and its cloud for Azure OpenAI — commercial, US Government or China). |
| If it fails | The model used if the first one fails — or "nothing else, the call fails". |
| Text embedded by | Where text is sent to be turned into vectors for similarity search — or that nothing leaves and similarity runs on the platform without a model. |
| Retention terms | Whose terms govern what the provider keeps: your own agreement with your provider, or AxisSynapse's with its model provider. |
The panel is read from the same decisions every AI call makes, so it cannot describe a path a call would not take. It names AxisSynapse's own model only as "AxisSynapse default model". Every Axis Assure member sees the same path, without hosts or model names, on Assure → Reports & Setup → About AI.
Keep data on your own model (the residency pin)
Workspace Settings → AI Gateway → Where your data goes → Keep data on your own model.
- On: AI calls go only to the model you configured below. The AxisSynapse default model is never used for this workspace — not as the first model, not as a fallback, not to embed text. Axis Assure's search for grounding ranks your records on the platform without any embedding model.
- On, with no model of your own: every AI call is refused until you configure one or turn the pin off. You may pin first and configure the model after.
- Turning it on asks for nothing (it only narrows where data may go). Turning it off asks you to confirm it's you.
- Off by default, so existing workspaces behave as before.
Bring your own model
Workspace Settings → AI Gateway → Enable Custom Model Routing.
- Providers: Azure OpenAI, OpenAI, Anthropic, or a custom endpoint. An Azure OpenAI endpoint keeps its own host, so a US Government or China endpoint is called where you configured it.
- Endpoints must be https and public: an
http:address or a private, loopback or link-local address is refused when you save it and again when it is used. - Saving the connection always asks you to confirm it's you: on an aggregator endpoint, even the model name can send data to another provider.
- Embeddings go to your own provider for Azure OpenAI and OpenAI. For other providers nothing is embedded by a model: similarity runs on the platform.
- Disconnecting deletes the stored key and asks for nothing.
Personal data removed before sending
Workspace Settings → AI Gateway → Strict PII Scrubbing (on by default) applies to every model, yours included:
- On: US Social Security numbers, payment card numbers (checked, so order numbers are not mistaken for cards), email addresses and phone numbers are removed from what is sent.
- Off: Social Security numbers and payment card numbers are still removed. Turning it off asks you to confirm it's you.
- Names are never removed: no pattern can tell a name from an ordinary word. Axis Assure sends people to the model as roles ("system owner") wherever a request would name them, but names written inside your evidence are sent as written.
Systems that hold CUI or are categorised High
Axis Assure does not send the records of a system that holds controlled unclassified information (CUI) or is categorised High to a model — unless your workspace keeps data on its own model, and that model is your own Azure Government deployment or a model you host yourself (a custom endpoint).
- Which systems: decided from each system's own data in Axis Assure, never its name — a system whose CMMC asset scope includes CUI assets, an information type marked CUI, or a FIPS 199 categorisation of High in any security objective or information type.
- Which requests: any AI request about a record of such a system — an implementation's narrative, a review of its evidence, a finding's response — and any request that is not about one system (a policy, a questionnaire answer, a program's plan, the compliance copilot) while your workspace has such a system, since it could read that system's records.
- What you see: the request is refused before anything is sent, with the reason, in your language. No draft is made and no AI run is recorded. The compliance copilot is not shown.
- To use AI on such a system: in Workspace Settings → AI Gateway, configure your own Azure Government model or a custom endpoint you host, and turn on Keep data on your own model.
Your provider's authorisation
Axis Assure cannot tell whether a provider is authorised for CUI or High data. Clearing the path for your own Azure Government or self-hosted model is a statement that your workspace controls where that data goes; make sure your provider's authorisation and your agreements cover it.
External assessors
An external assessor's seat may use the AI an engagement offers only when its seat allows AI (May use AI on this engagement, off by default) and your workspace's master switch is on. What the assessor's AI requests may read is what the engagement sees.
What is recorded
- Every setting change: one audit entry with the value before and after; for the model connection, which fields changed and whether the key was replaced — never the key.
- Every AI request: who asked, the capability, the prompt version, the model and provider, whether a fallback was used, how many sources were cited and the outcome — never the prompt, the answer's words or licensed framework text.
- Every AI request's record (who asked, the sources it cited by reference, the outcome and the draft) is kept as a compliance record of the workspace for six years, as long as the evidence it cites. Erasing a person clears who asked; who accepted or rejected a draft is kept as its review record.
Related
Related