Free cookie consent management tool by TermsFeed Security and Compliance [AI Capabilities]
Security and Compliance

Compliance

AI skills are only available for Cloud customers at this time. Self-managed and Appian Government Cloud customers don't have access to this feature.

Appian Cloud HIPAA or PCI-DSS customers: Before enabling this feature, please review its compliance to ensure it aligns with your organization's security requirements.

Regional availability

Tip:  Unless listed below, AI skills are available in all regions.

The following AI skills are available in select regions:

Region Name Region Document Classification Document Extraction Prompt Builder
Africa (Cape Town) af-south-1 Not Supported Not Supported Not Supported
Asia Pacific (Mumbai) ap-south-1 Supported Supported Not Supported
Asia Pacific (Seoul) ap-northeast-2 Supported Supported Not Supported
Asia Pacific (Singapore) ap-southeast-1 Supported Supported Supported
Asia Pacific (Sydney) ap-southeast-2 Supported Supported Not Supported
Asia Pacific (Tokyo) ap-northeast-1 Not Supported Not Supported Supported
Canada (Central) ca-central-1 Supported Supported Not Supported
Europe (Frankfurt) eu-central-1 Supported Supported Supported
Europe (Ireland) eu-west-1 Supported Supported Not Supported
Europe (London) eu-west-2 Supported Supported Not Supported
Europe (Milan) eu-south-1 Not Supported Not Supported Not Supported
Europe (Paris) eu-west-3 Supported Supported Not Supported
Europe (Stockholm) eu-north-1 Not Supported Not Supported Not Supported
Europe (Zurich) eu-central-2 Not Supported Not Supported Not Supported
Middle East (Bahrain) me-south-1 Not Supported Not Supported Not Supported
Middle East (UAE) me-central-1 Not Supported Not Supported Not Supported
South America (Sao Paulo) sa-east-1 Not Supported Not Supported Not Supported
US East (N. Virginia) us-east-1 Supported Supported Supported
US East (Ohio) us-east-2 Supported Supported Not Supported
US West (N. California) us-west-1 Supported Supported Not Supported
US West (Oregon) us-west-2 Supported Supported Supported

If your Appian environment isn't in a supported region listed above, you can elect to use these AI skills by sending your data to a supported region. This doesn't change your environment's region. Contact Appian Support to learn more. Refer to the multi-region architecture diagram to learn more about how data is transmitted in this configuration.

Caution:  Changing your Appian environment's region will make any of these AI skills that exist no longer available in your environment. Multi-region environments and migration between regions are not supported.

However, if Enhanced Business Continuity is enabled for your environment and a failover occurs, AI skill data will be present when you return to your primary region. AI skill data isn't lost permanently in this case.

Add AI skill endpoints to your network allowlist

To ensure the AI skill is available in your environment, locate your environment's region in the table below and add the corresponding endpoint to your network allow list. Add the endpoint that corresponds to your site's region, even if you send AI skill data to a different supported region.

AI skills may not be available in all regions.

Region Name Endpoint
Asia Pacific (Mumbai) https://ai-skill-designer-ap-south-1.appiancloud.com
Asia Pacific (Jakarta) https://ai-skill-designer-ap-southeast-3.appiancloud.com
Asia Pacific (Seoul) https://ai-skill-designer-ap-northeast-2.appiancloud.com
Asia Pacific (Singapore) https://ai-skill-designer-ap-southeast-1.appiancloud.com
Asia Pacific (Sydney) https://ai-skill-designer-ap-southeast-2.appiancloud.com
Asia Pacific (Tokyo) https://ai-skill-designer-ap-northeast-1.appiancloud.com
Canada (Central) https://ai-skill-designer-ca-central-1.appiancloud.com
Europe (Frankfurt) https://ai-skill-designer-eu-central-1.appiancloud.com
Europe (Ireland) https://ai-skill-designer-eu-west-1.appiancloud.com
Europe (London) https://ai-skill-designer-eu-west-2.appiancloud.com
Europe (Paris) https://ai-skill-designer-eu-west-3.appiancloud.com
US East (N. Virginia) https://ai-skill-designer-us-east-1.appiancloud.com
US East (Ohio) https://ai-skill-designer-us-east-2.appiancloud.com
US West (N. California) https://ai-skill-designer-us-west-1.appiancloud.com
US West (Oregon) https://ai-skill-designer-us-west-2.appiancloud.com

Note that these endpoints are only used for publicly accessible environments. They do not apply to environments accessed over VPN, PrivateLink, or Dual Access.

AI service architecture

This section applies to AI Skills and the records chat component. Learn more about private AI features.

Our AI architecture is designed with private AI as the foundation and upholds those principles.

Single region architecture

Appian's AI architecture utilizes a single AWS region to provide a secure and scalable AI as a service solution. These capabilities are in-line with the architecture of Appian Cloud deployments, which also use AWS as the provider.

Multi-region architecture

If a customer site is not located in a region that supports a feature, customers can elect to send their data to a supported region.

Note:  The email classification AI skill uses neither of these services (Amazon Bedrock or Amazon Textract).

Foundational principles

Foundational principles of our AI architecture apply to single- and multi-region implementations.

Multi-tenant AI service: Appian's multi-tenant AI service is shared among multiple customers in a given region and has multiple layers of control to restrict data access to respective customer sites. The service has site-level controls to restrict data access and encryption/decryption permissions, whether that distinction is a separate customer site or a separate site within a single customer's environment. This shared service approach allows for economies of scale.

Data transit and retention:

  • All of your data stays within the Appian Cloud environment.
  • All data in-transit is encrypted using TLS.
  • Communication between Appian and the AI service uses asymmetric signing where each customer site has a unique key used to verify its identity.
  • Communication between the AI service, Amazon Bedrock, and Amazon Textract uses AWS Signature V4 authentication to verify the identity of the requesting service.
  • Bedrock and Textract are stateless, so no information is retained.

Learn more about Amazon Bedrock.

Learn more about Amazon Textract.

Document classification and extraction

The document classification and document extraction AI skills use Amazon Textract to recognize the content within the documents.

When the ML model is called during training, testing, or process execution, the associated documents are uploaded to an S3 bucket. The documents are kept in the same region as the customer site.

Additionally, the bucket is:

  • Encrypted using keys specific to each customer site
  • Segmented for each customer site
  • Not accessible by application developers or users

Note:  If the documents to be classified or extracted contain protected data, then this protected data would be required in order to leverage extraction and classification features. Customers can use other mechanisms to redact protected data that is considered as proprietary, sensitive, or confidential, and data containing PII/PHI in accordance with their organization's policies prior to using these AI skills.

All data used for a model both at training and execution is retained until the AI skill is deleted. The model package is deleted when the AI skill object is deleted.

When a user submits a reconciliation task after document extraction, the updated key-value pair mappings are entirely stored within the application on the customer's site.

Learn how document extraction works in Appian.

Records chat

Users can only chat with records they have access to. Record-level security is the responsibility of the customer to develop and maintain. No records data is retained in either the AI service or Bedrock due to their stateless nature.

Open in Github Built: Wed, May 08, 2024 (07:58:07 PM)

Security and Compliance

FEEDBACK