Free cookie consent management tool by TermsFeed

Security and Compliance

On This Page

Compliance

Appian's AI capabilities are designed to meet enterprise security and compliance requirements. These features operate within Appian's certified cloud infrastructure and adhere to the same robust compliance standards as the core Appian platform, including SOC 2, HIPAA, PCI DSS, and FedRAMP.

Certifications and standards

Appian Cloud maintains compliance with industry-leading security standards, including:

  • SOC 2 Type II
  • ISO 27001
  • HIPAA
  • PCI DSS (for PCI-compliant sites)
  • FedRAMP (for GovCloud environments)

AI capabilities inherit these certifications and operate within the same compliant infrastructure. For the most current information about Appian's compliance certifications, see the Appian Trust Center.

Data handling and privacy

When you use Appian's AI capabilities:

  • Your data remains within your designated region unless you explicitly configure cross-region processing using inference profiles.
  • Data transmitted to AI services is encrypted in transit and at rest.
  • Appian does not use your data to train or improve underlying AI models.
  • You maintain full control over your data and can delete it at any time.

For more information about data privacy, see Private AI.

AI intellectual property and usage

Appian is constantly working to improve your experience by developing advanced AI technology. This includes the prompt templates, system instructions, and orchestration logic that power our AI features.

Keep the following guidelines in mind regarding Appian AI technology:

  • Ownership and access: All AI configurations, prompt logic, and data structuring methods created by Appian remain our exclusive property. We provide these to you as part of your subscription to help you build and use your applications. Any configurations you create and data you process using Appian AI capabilities remain your property.
  • Confidentiality: We consider our AI methodologies to be confidential. You may access them only through your authorized Appian environment.
  • Proper usage: You should use Appian AI technology only to support your work within Appian. Do not copy, extract, or use our AI instructions to train, fine-tune, or prompt any AI models outside of Appian.
  • Technical integrity: Do not attempt to reverse engineer, disassemble, or determine the source code or development methods of our AI systems.

For more information on how we manage your data within these systems, see our Data Privacy documentation.

High availability

Note:  Generative AI Skills, including unstructured document extraction, support high availability. AI skills that require training, such as document classification and structured document extraction, do not.

You can use all AI Skills in high availability environments without impacting other HA features. For more information, see High Availability for Appian Cloud for more information.

Regional availability

Appian offers a range of AI capabilities with availability varying based on geographical location. The following sections outline which regions are supported:

If your Appian environment isn't in a supported region, you can select an inference profile to allow processing in a supported region. If you're using an older model that doesn't use inference profiles, contact Appian Support to configure cross-region support. This doesn't change your environment's region. Refer to the multi-region architecture diagram to learn more about how data is transmitted in this configuration.

Caution:  Changing your Appian environment's region will make any of these AI skills that exist no longer available in your environment. Multi-region environments and migration between regions are not supported.

Inference profiles allow you to extend processing to additional supported regions without changing your environment's region.

However, if Enhanced Business Continuity is enabled for your environment and a failover occurs, AI skill data will be present when you return to your primary region. AI skill data isn't lost permanently in this case.

Appian Composer regional availability

Appian Composer is available in select regions:

Region Name Region Support Status
af-south-1 (Cape Town) Africa unsupported
ap-northeast-1 (Tokyo) Asia Pacific supported
ap-northeast-2 (Seoul) Asia Pacific supported
ap-south-1 (Mumbai) Asia Pacific unsupported
ap-southeast-1 (Singapore) Asia Pacific supported
ap-southeast-2 (Sydney) Asia Pacific supported
ap-southeast-3 (Jakarta) Asia Pacific unsupported
ca-central-1 (Central) Canada unsupported
eu-central-1 (Frankfurt) Europe supported
eu-central-2 (Zurich) Europe supported
eu-north-1 (Stockholm) Europe unsupported
eu-south-1 (Milan) Europe unsupported
eu-west-1 (Ireland) Europe unsupported
eu-west-2 (London) Europe unsupported
eu-west-3 (Paris) Europe unsupported
me-central-1 (UAE) Middle East unsupported
me-south-1 (Bahrain) Middle East unsupported
sa-east-1 (Sao Paulo) South America unsupported
us-gov-east-1 (US-East) United States supported
us-east-1 (N. Virginia) United States supported
us-east-2 (Ohio) United States unsupported
us-west-1 (N. California) United States unsupported
us-west-2 (Oregon) United States supported
us-gov-west-1 (US-West) United States supported

AI agents regional availability

AI agents are available in select regions:

Region Name Region Support Status
af-south-1 (Cape Town) Africa unsupported
ap-northeast-1 (Tokyo) Asia Pacific supported
ap-northeast-2 (Seoul) Asia Pacific supported
ap-south-1 (Mumbai) Asia Pacific supported
ap-southeast-1 (Singapore) Asia Pacific supported
ap-southeast-2 (Sydney) Asia Pacific supported
ap-southeast-3 (Jakarta) Asia Pacific supported
ca-central-1 (Central) Canada supported
eu-central-1 (Frankfurt) Europe supported
eu-central-2 (Zurich) Europe supported
eu-north-1 (Stockholm) Europe supported
eu-south-1 (Milan) Europe supported
eu-west-1 (Ireland) Europe supported
eu-west-2 (London) Europe supported
eu-west-3 (Paris) Europe supported
me-central-1 (UAE) Middle East unsupported
me-south-1 (Bahrain) Middle East unsupported
sa-east-1 (Sao Paulo) South America supported
us-gov-east-1 (US-East) United States unsupported
us-east-1 (N. Virginia) United States supported
us-east-2 (Ohio) United States supported
us-west-1 (N. California) United States supported
us-west-2 (Oregon) United States supported
us-gov-west-1 (US-West) United States unsupported

AI Skills regional availability

Tip:  The Email Classification skill is available in all regions where Appian Cloud is supported.

The following AI skills are available in select regions:

Region Name Region Advanced IDP Tools,
Document Classification, and
Structured Document Extraction		 Prompt Builder and generative AI skills
Africa (Cape Town) af-south-1 Not Supported Not Supported
Asia Pacific (Tokyo) ap-northeast-1 Not Supported Supported
Asia Pacific (Seoul) ap-northeast-2 Supported Supported
Asia Pacific (Mumbai) ap-south-1 Supported Supported
Asia Pacific (Singapore) ap-southeast-1 Supported Supported
Asia Pacific (Sydney) ap-southeast-2 Supported Supported
Asia Pacific (Jakarta) ap-southeast-3 Not Supported Not Supported
Canada (Central) ca-central-1 Supported Supported
Europe (Frankfurt) eu-central-1 Supported Supported
Europe (Zurich) eu-central-2 Not Supported Supported
Europe (Stockholm) eu-north-1 Not Supported Not Supported
Europe (Milan) eu-south-1 Not Supported Not Supported
Europe (Ireland) eu-west-1 Supported Supported
Europe (London) eu-west-2 Supported Supported
Europe (Paris) eu-west-3 Supported Supported
Middle East (UAE) me-central-1 Not Supported Not Supported
Middle East (Bahrain) me-south-1 Not Supported Not Supported
South America (Sao Paulo) sa-east-1 Not Supported Supported
GovCloud (US-East) us-gov-east-1 Supported Supported
GovCloud (US-West) us-gov-west-1 Supported Supported
US East (N. Virginia) us-east-1 Supported Supported
US East (Ohio) us-east-2 Supported Not Supported
US West (N. California) us-west-1 Supported Not Supported
US West (Oregon) us-west-2 Supported Supported

Note:  To use generative AI skills with the Visual elements & text option enabled, you may need to configure an inference profile. If you're using an older model that doesn't use inference profiles, contact Appian Support to use this feature by sending your data to a supported region.

AI Copilot regional availability

The following AI Copilot features are available in select regions:

Feature Supported regions

AI Copilot for data fabric
(Part of Process HQ)


Data fabric chatbot component
  • Asia Pacific (Mumbai) ap-south-1*
  • Asia Pacific (Seoul) ap-northeast-2
  • Asia Pacific (Singapore) ap-southeast-1
  • Asia Pacific (Sydney) ap-southeast-2
  • Asia Pacific (Tokyo) ap-northeast-1
  • Canada (Central) ca-central-1*
  • Europe (Frankfurt) eu-central-1
  • Europe (Ireland) eu-west-1*
  • Europe (London) eu-west-2*
  • Europe (Paris) eu-west-3
  • GovCloud (US-East) us-gov-east-1
  • GovCloud (US-West) us-gov-west-1
  • South America (Sao Paulo) sa-east-1*
  • US East (N. Virginia) us-east-1
  • US West (Oregon) us-west-2

AI Copilot for reports
(Part of Process HQ)
  • Asia Pacific (Mumbai) ap-south-1*
  • Asia Pacific (Seoul) ap-northeast-2
  • Asia Pacific (Singapore) ap-southeast-1
  • Asia Pacific (Sydney) ap-southeast-2
  • Asia Pacific (Tokyo) ap-northeast-1
  • Canada (Central) ca-central-1
  • Europe (Frankfurt) eu-central-1
  • Europe (Ireland) eu-west-1
  • Europe (London) eu-west-2
  • Europe (Paris) eu-west-3
  • GovCloud (US-East) us-gov-east-1
  • GovCloud (US-West) us-gov-west-1
  • South America (Sao Paulo) sa-east-1
  • US East (N. Virginia) us-east-1
  • US West (Oregon) us-west-2
Composer
  • Asia Pacific (Tokyo) ap-northeast-1
  • Asia Pacific (Seoul) ap-northeast-2
  • Asia Pacific (Singapore) ap-southeast-1
  • Asia Pacific (Sydney) ap-southeast-2
  • Europe (Frankfurt) eu-central-1
  • Europe (Zurich) eu-central-2
  • GovCloud (US-East) us-gov-east-1
  • US East (N. Virginia) us-east-1
Create sample data for record types
  • Asia Pacific (Mumbai) ap-south-1
  • Asia Pacific (Sydney) ap-southeast-2
  • Canada (Central) ca-central-1
  • Europe (Frankfurt) eu-central-1
  • Europe (Ireland) eu-west-1
  • Europe (London) eu-west-2
  • GovCloud (US-East) us-gov-east-1
  • GovCloud (US-West) us-gov-west-1
  • US East (N. Virginia) us-east-1
  • US West (Oregon) us-west-2
Documents Chat
  • Asia Pacific (Mumbai) ap-south-1
  • Asia Pacific (Singapore) ap-southeast-1
  • Asia Pacific (Sydney) ap-southeast-2
  • Asia Pacific (Tokyo) ap-northeast-1
  • Canada (Central) ca-central-1
  • Europe (Frankfurt) eu-central-1
  • Europe (Ireland) eu-west-1
  • Europe (London) eu-west-2
  • Europe (Paris) eu-west-3
  • Europe (Zurich) eu-central-2
  • GovCloud (US-East) us-gov-east-1
  • GovCloud (US-West) us-gov-west-1
  • South America (Sao Paulo) sa-east-1
  • US East (N. Virginia) us-east-1
  • US West (Oregon) us-west-2
Enterprise Copilot
  • Asia Pacific (Mumbai) ap-south-1
  • Asia Pacific (Singapore) ap-southeast-1
  • Asia Pacific (Sydney) ap-southeast-2
  • Asia Pacific (Tokyo) ap-northeast-1
  • Canada (Central) ca-central-1
  • Europe (Frankfurt) eu-central-1
  • Europe (Ireland) eu-west-1
  • Europe (London) eu-west-2
  • Europe (Paris) eu-west-3
  • Europe (Zurich) eu-central-2
  • GovCloud (US-East) us-gov-east-1
  • GovCloud (US-West) us-gov-west-1
  • South America (Sao Paulo) sa-east-1
  • US East (N. Virginia) us-east-1
  • US West (Oregon) us-west-2
Generate test cases for expression rules
  • Asia Pacific (Sydney) ap-southeast-2
  • Canada (Central) ca-central-1
  • Europe (Frankfurt) eu-central-1
  • Europe (Ireland) eu-west-1
  • Europe (London) eu-west-2
  • Europe (Paris) eu-west-3
  • GovCloud (US-East) us-gov-east-1
  • GovCloud (US-West) us-gov-west-1
  • US East (N. Virginia) us-east-1
  • US West (Oregon) us-west-2
Records chat component
  • Asia Pacific (Mumbai) ap-south-1
  • Asia Pacific (Seoul) ap-northeast-2
  • Asia Pacific (Singapore) ap-southeast-1
  • Asia Pacific (Sydney) ap-southeast-2
  • Asia Pacific (Tokyo) ap-northeast-1
  • Canada (Central) ca-central-1
  • Europe (Frankfurt) eu-central-1
  • Europe (Ireland) eu-west-1
  • Europe (London) eu-west-2
  • Europe (Paris) eu-west-3
  • GovCloud (US-East) us-gov-east-1
  • GovCloud (US-West) us-gov-west-1
  • South America (Sao Paulo) sa-east-1
  • US East (N. Virginia) us-east-1
  • US West (Oregon) us-west-2
Smart Search
  • Asia Pacific (Mumbai) ap-south-1
  • Asia Pacific (Singapore) ap-southeast-1
  • Asia Pacific (Sydney) ap-southeast-2
  • Asia Pacific (Tokyo) ap-northeast-1
  • Canada (Central) ca-central-1
  • Europe (Frankfurt) eu-central-1
  • Europe (Ireland) eu-west-1
  • Europe (London) eu-west-2
  • Europe (Paris) eu-west-3
  • Europe (Zurich) eu-central-2
  • GovCloud (US-East) us-gov-east-1
  • GovCloud (US-West) us-gov-west-1
  • South America (Sao Paulo) sa-east-1
  • US East (N. Virginia) us-east-1
  • US West (Oregon) us-west-2
Suggested views
Suggested KPIs
Suggested insight summaries
Ad hoc event detection

(Part of Process Insights)
  • Asia Pacific (Mumbai) ap-south-1*
  • Asia Pacific (Seoul) ap-northeast-2
  • Asia Pacific (Singapore) ap-southeast-1
  • Asia Pacific (Sydney) ap-southeast-2
  • Asia Pacific (Tokyo) ap-northeast-1
  • Canada (Central) ca-central-1*
  • Europe (Frankfurt) eu-central-1
  • Europe (Ireland) eu-west-1*
  • Europe (London) eu-west-2*
  • Europe (Paris) eu-west-3
  • GovCloud (US-East) us-gov-east-1
  • GovCloud (US-West) us-gov-west-1
  • South America (Sao Paulo) sa-east-1*
  • US East (N. Virginia) us-east-1
  • US West (Oregon) us-west-2

* Sites in these regions have a smaller context window when using AI Copilot. Users can work with up to 30 record types, and may also need to start a new session more frequently.

Tip:  We are continuously working to expand support across all regions. While the some regions do not currently support AI Copilot features, we are committed to extending our capabilities and look forward to bringing these innovative tools to these regions in the future. Stay tuned for updates as we enhance our global support to better serve you!

Add AI skill endpoints to your network allowlist

To ensure the AI skill is available in your environment, locate your environment's region in the table below and add the corresponding endpoints to your network allow list. Add the endpoints that corresponds to your site's region, even if you send AI skill data to a different supported region.

For PCI-compliant sites, use the endpoints that include -strict in the string.

Designer endpoints support proper rendering of the user interface. S3 endpoints enable storage for the model and related data.

AI skills may not be available in all regions.

Region Name Designer Endpoint S3 Endpoint
Africa (Cape Town) https://ai-skill-designer-af-south-1.appiancloud.com https://appian-custom-ai-customer-af-south-1-customer-bucket.s3.af-south-1.amazonaws.com
Asia Pacific (Tokyo) https://ai-skill-designer-ap-northeast-1.appiancloud.com https://appian-custom-ai-customer-ap-northeast-1-customer-bucket.s3.ap-northeast-1.amazonaws.com
Asia Pacific (Seoul) https://ai-skill-designer-ap-northeast-2.appiancloud.com https://appian-custom-ai-customer-ap-northeast-2-customer-bucket.s3.ap-northeast-2.amazonaws.com
Asia Pacific (Mumbai) https://ai-skill-designer-ap-south-1.appiancloud.com https://appian-custom-ai-customer-ap-south-1-customer-bucket.s3.ap-south-1.amazonaws.com
Asia Pacific (Singapore) standard site:
https://ai-skill-designer-ap-southeast-1.appiancloud.com

PCI-compliant site:
https://ai-skill-designer-strict-ap-southeast-1.appiancloud.com		 https://appian-custom-ai-customer-ap-southeast-1-customer-bucket.s3.ap-southeast-1.amazonaws.com
Asia Pacific (Sydney) standard site:
https://ai-skill-designer-ap-southeast-2.appiancloud.com

PCI-compliant site:
https://ai-skill-designer-strict-ap-southeast-2.appiancloud.com		 https://appian-custom-ai-customer-ap-southeast-2-customer-bucket.s3.ap-southeast-2.amazonaws.com
Asia Pacific (Jakarta) https://ai-skill-designer-ap-southeast-3.appiancloud.com https://appian-custom-ai-customer-ap-southeast-3-customer-bucket.s3.ap-southeast-3.amazonaws.com
Canada (Central) standard site:
https://ai-skill-designer-ca-central-1.appiancloud.com

PCI-compliant site:
https://ai-skill-designer-strict-ca-central-1.appiancloud.com		 https://appian-custom-ai-customer-ca-central-1-customer-bucket.s3.ca-central-1.amazonaws.com
Europe (Frankfurt) https://ai-skill-designer-eu-central-1.appiancloud.com https://appian-custom-ai-customer-eu-central-1-customer-bucket.s3.eu-central-1.amazonaws.com
Europe (Zurich) https://ai-skill-designer-eu-central-2.appiancloud.com https://appian-custom-ai-customer-eu-central-2-customer-bucket.s3.eu-central-2.amazonaws.com
Europe (Stockholm) https://ai-skill-designer-eu-north-1.appiancloud.com https://appian-custom-ai-customer-eu-north-1-customer-bucket.s3.eu-north-1.amazonaws.com
Europe (Milan) standard site:
https://ai-skill-designer-eu-south-1.appiancloud.com

PCI-compliant site:
https://ai-skill-designer-strict-eu-south-1.appiancloud.com		 https://appian-custom-ai-customer-eu-south-1-customer-bucket.s3.eu-south-1.amazonaws.com
Europe (Ireland) https://ai-skill-designer-eu-west-1.appiancloud.com https://appian-custom-ai-customer-eu-west-1-customer-bucket.s3.eu-west-1.amazonaws.com
Europe (London) standard site:
https://ai-skill-designer-eu-west-2.appiancloud.com

PCI-compliant site:
https://ai-skill-designer-strict-eu-west-2.appiancloud.com		 https://appian-custom-ai-customer-eu-west-2-customer-bucket.s3.eu-west-2.amazonaws.com
Europe (Paris) https://ai-skill-designer-eu-west-3.appiancloud.com https://appian-custom-ai-customer-eu-west-3-customer-bucket.s3.eu-west-3.amazonaws.com
Middle East (UAE) https://ai-skill-designer-me-central-1.appiancloud.com https://appian-custom-ai-customer-me-central-1-customer-bucket.s3.me-central-1.amazonaws.com
Middle East (Bahrain) https://ai-skill-designer-me-south-1.appiancloud.com https://appian-custom-ai-customer-me-south-1-customer-bucket.s3.me-south-1.amazonaws.com
South America (São Paulo) https://ai-skill-designer-sa-east-1.appiancloud.com https://appian-custom-ai-customer-sa-east-1-customer-bucket.s3.sa-east-1.amazonaws.com
GovCloud (US-East) https://ai-skill-designer-us-gov-east-1.appiancloud.us https://cai-gov-customer-us-gov-east-1-customer-bucket.s3-fips.us-gov-east-1.amazonaws.com
GovCloud (US-West) https://ai-skill-designer-us-gov-west-1.appiancloud.us https://cai-gov-customer-us-gov-west-1-customer-bucket.s3-fips.us-gov-west-1.amazonaws.com
US East (N. Virginia) standard site:
https://ai-skill-designer-us-east-1.appiancloud.com

PCI-compliant site:
https://ai-skill-designer-strict-us-east-1.appiancloud.com		 https://appian-custom-ai-customer-us-east-1-customer-bucket.s3.us-east-1.amazonaws.com
US East (Ohio) https://ai-skill-designer-us-east-2.appiancloud.com https://appian-custom-ai-customer-us-east-2-customer-bucket.s3.us-east-2.amazonaws.com
US West (N. California) standard site:
https://ai-skill-designer-us-west-1.appiancloud.com

PCI-compliant site:
https://ai-skill-designer-strict-us-west-1.appiancloud.com		 https://appian-custom-ai-customer-us-west-1-customer-bucket.s3.us-west-1.amazonaws.com
US West (Oregon) standard site:
https://ai-skill-designer-us-west-2.appiancloud.com

PCI-compliant site:
https://ai-skill-designer-strict-us-west-2.appiancloud.com		 https://appian-custom-ai-customer-us-west-2-customer-bucket.s3.us-west-2.amazonaws.com

Note that these endpoints are only used for publicly accessible environments. They do not apply to environments accessed over VPN, PrivateLink, or Dual Access.

Inference profiles and cross-region data flow

Inference profiles define the set of pre-configured regions that an AI model can use for processing. Unlike single-region configurations, inference profiles enable processing across multiple supported regions.

Newer AI models use inference profiles to run properly. Check that your applications are set up with the right profiles to keep them working smoothly when older models are phased out.

System administrators select the appropriate inference profile for your environment in the Appian Administration Console. When you choose a profile, the model card lists the supported regions so you can confirm where data will be processed before saving.

images/automation/ai-services.png

Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to closeimages/automation/ai-services.png

AI service architecture

This section applies to AI Skills and AI Copilot features.

Our AI architecture is designed with private AI as the foundation and upholds those principles. Learn more about private AI features.

Single region architecture

Appian's AI architecture utilizes a single AWS region to provide a secure and scalable AI as a service solution. These capabilities are in-line with the architecture of Appian Cloud deployments, which also use AWS as the provider.

images/automation/ai-architecture.png

Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to closeimages/automation/ai-architecture.png

Note:  When an inference profile is selected, Amazon Bedrock can operate in any of the regions defined in that profile.

Multi-region architecture

If your site is not located in a region that supports a feature, you can select an inference profile to send your data to a supported region.

images/automation/ai-architecture-multi.png

Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to closeimages/automation/ai-architecture-multi.png

Note:  

Foundational principles

Foundational principles of our AI architecture apply to single- and multi-region implementations.

Multi-tenant AI service: Appian's multi-tenant AI service is shared among multiple customers in a given region and has multiple layers of control to restrict data access to respective customer sites. The service has site-level controls to restrict data access and encryption/decryption permissions, whether that distinction is a separate customer site or a separate site within a single customer's environment. This shared service approach allows for economies of scale.

Data transit and retention:

  • All of your data stays within the Appian Cloud environment.
  • All data in-transit is encrypted using TLS.
  • Communication between Appian and the AI service uses asymmetric signing where each customer site has a unique key used to verify its identity.
  • Communication between the AI service, Amazon Bedrock, and Amazon Textract uses AWS Signature V4 authentication to verify the identity of the requesting service.
  • Bedrock and Textract are stateless, so no information is retained.

Learn more about Amazon Bedrock and Amazon Textract.

AI Agents

AI agents follow all of the foundational AI security principles including the principles of the tools they use. When an AI agent invokes a tool, it checks the initiator's access. If the user lacks permission, the AI agent doesn't run. AI agents always operate with the initiator's access and can't exceed user permissions or bypass object-level security.

Document classification and extraction

The document classification and document extraction AI skills use Amazon Textract to recognize the content within the documents.

When the ML model is called during training, testing, or process execution, the associated documents are uploaded to an S3 bucket. The documents are kept in the same region as the customer site.

Additionally, the bucket is:

  • Encrypted using keys specific to each customer site
  • Segmented for each customer site
  • Not accessible by application developers or users

Note:  If the documents to be classified or extracted contain protected data, then this protected data would be required in order to leverage extraction and classification features. Customers can use other mechanisms to redact protected data that is considered as proprietary, sensitive, or confidential, and data containing PII/PHI in accordance with their organization's policies prior to using these AI skills.

All data used for a model both at training and execution is retained until the AI skill is deleted. The model package is deleted when the AI skill object is deleted.

When a user submits a reconciliation task after document extraction, the updated key-value pair mappings are entirely stored within the application on the customer's site.

Learn how document extraction works in Appian.

Data fabric chat components

Appian AI Copilot powers multiple components that allow business users to ask questions of their data fabric, including:

When using these components, users can only chat with records they have access to. Record-level security is the responsibility of the customer to develop and maintain. No records data is retained in either the AI service or Bedrock due to their stateless nature.

Document-based chat components

Because Enterprise Copilot and Documents Chat use retrieval-augmented generation (RAG) to enable users to ask questions about documents, these features index and persist data in Bedrock. Documents used in either of these features are uploaded to an S3 bucket, and processed by Bedrock to create and store vector embeddings in an OpenSearch-based vector index. The documents and vector embeddings are kept in the same region as the customer site. Although documents and embeddings are persisted and stored in S3, chat prompts and responses remain stateless. Prompts or responses are not logged, stored, used to train models, or shared with third parties.

Additionally, the bucket is:

  • Encrypted using keys specific to each customer site
  • Segmented for each customer site
  • Not accessible by application developers or users

Deleting documents

Documents are deleted in S3, along with the related vector embeddings in OpenSearch, in the following situations:

  • A document is deleted from Enterprise Copilot
  • A user hasn't chatted with a document for 30 days

Smart search doesn't require generative AI to answer queries. Instead, it uses embeddings to enable semantic matching. When you enable smart search, Appian uses Bedrock to create vector embeddings from your data source and stores those embeddings in a managed OpenSearch-based vector index. Vector embeddings are kept in the same region as the customer site.

Smart search follows all of the foundational AI security principles. Additional key aspects of smart search architecture and compliance include:

  • Indexed fields: Only the fields you configure for smart search are embedded.
  • Retention: When you disable fields that you previously selected for smart search on a record type, or delete individual records like text or documents for fields that are currently enabled for smart search, Appian deletes the document in S3 and the related vector embeddings in OpenSearch. Smart search deletions can take up to one week (7 days).
  • Access controls: Smart search respects Appian record-level and field-level security; users only see results they are authorized to view.

Feedback