AI Data Processing and Residency for Agentic LLM Features

Stellar Cyber minimizes the information that AI services receive, anonymizes or obscures personal information where the workflow supports it, keeps your security data isolated by tenant, and prevents AI providers from using your data to train models. This topic explains what information Stellar Cyber sends to AI services and analyzes with agentic Large Language Model (LLM) features, where AI processing occurs, and how Stellar Cyber protects personal and sensitive information during AI-assisted workflows.

• Personal Information that Stellar Cyber Anonymizes or Obscures

• Feature-by-Feature Processing

• Data Retention and Model Training

• Where AI Data Is Processed

Personal Information that Stellar Cyber Anonymizes or Obscures

Where the workflow supports it, Stellar Cyber uses anonymization to detect and obscure common personal information categories before AI processing when the workflow supports anonymization. The process is designed to preserve security meaning while reducing exposure of direct identifiers.

Stellar Cyber can anonymize or obscure the following personal information types:

• IP addresses

• URLs

• Email addresses

• Personal names

• Phone numbers

• Locations

When Stellar Cyber anonymizes these values, it replaces the original value with a consistent protected token so the AI feature can still reason about relationships in the data. For example, the AI feature can recognize that the same anonymized user or host appears in multiple places without seeing the original identifier.

The anonymization process has measured high recall for the supported personal information categories. Some workflows use partial anonymization instead of full tokenization because security analysis often depends on preserving relationships among users, devices, hosts, observables, and events.

Feature-by-Feature Processing

Stellar Cyber sends only the information needed to support each AI workflow. The exact data depends on the feature that you use and the context that you provide.

AI Feature	Information Processed by the AI Feature	How Stellar Cyber Protects the Information
AI Investigator	Your investigation request, the relevant data schema, and summarized or aggregated investigation context when needed.	Stellar Cyber anonymizes user-specific and tenant-specific identifiers before sending the request. For table summaries, Stellar Cyber anonymizes aggregated data on your Data Platform before sending it for AI processing. Raw security data remains in the platform.
Alert Auto Triage	Structured alert context, including alert metadata, observables, threat intelligence, user and device context, and related entity history.	Stellar Cyber removes personal information where possible before AI processing. Full tokenization is not always applied because Alert Auto Triage, including its Verdict Signal Checks (VSCs), requires sufficient security context to correlate related signals accurately. Stellar Cyber limits the information sent to the AI service to the security context needed for alert triage and verdict evaluation and keeps requests tenant-isolated.
Case Analysis	Case details, related alerts, observables, threat intelligence, user and device context, and activity history relevant to the case.	Stellar Cyber removes personal information where possible and sends structured security context instead of unrestricted raw data. The workflow preserves enough relationship context to help you understand how signals connect across the case.
AI Assistant	Your free-text prompts and the context that you include or request the assistant to analyze.	You control the prompt content. Stellar Cyber applies tenant isolation and AI provider data protection controls to the request and response.
Email Phishing Auto Triage	Email security context needed to classify and explain suspected phishing, such as sender and recipient fields, subject, URLs, attachments or attachment metadata, headers, and message content relevant to the phishing determination.	Email triage requires enough email context to assess whether a message is malicious. Stellar Cyber limits the information to phishing-analysis context and applies protection controls for tenant isolation, retention, and AI provider use. Personal information can appear in email artifacts, but Stellar Cyber uses that information only to perform the phishing analysis and does not allow the AI provider to train models with it.

Data Retention and Model Training

Stellar Cyber does not allow AI providers to use customer data for model training. Stellar Cyber uses zero data retention controls for AI provider requests where supported, so prompts and responses are not stored on AI provider servers for later use.

Each AI request remains isolated to the tenant that initiated it. Stellar Cyber processes the request through the auditable API layer that Stellar Cyber provides rather than allowing unrestricted access to customer environments.

Where AI Data Is Processed

Stellar Cyber hosts SaaS platform data in Oracle Cloud Infrastructure (OCI) regions selected for the deployment. For example, Latin America deployments can use the Brazil/São Paulo OCI region for the SaaS platform.

Data residency for stored customer data and the location where AI inference occurs are not always the same. Depending on region availability, customer data may be stored in one region while AI processing occurs in another supported region.

AI processing region support depends on the AI feature and deployment configuration. The following table summarizes the current documented status.

Region	Current AI Processing Status	Notes
United States	Available	Current central AI processing is available through the supported AI backend.
European Union/Europe	Available through the Early Access Program (Frankfurt, Germany)	AI requests from EU deployments automatically route to the Europe-based AI endpoint. EU on-premises and Stellar Cyber-hosted SaaS deployments use an EU-configured AI endpoint by default.
Asia Pacific	Planned	Japan and Singapore regional data residency is planned for future AI processing expansion, which might occur elsewhere depending on where OpenAI provides inference processing.
Brazil/Latin America	Not currently a supported AI processing region	The SaaS Stellar Cyber Platform can be hosted in the Brazil/São Paulo OCI, but current AI processing in Brazil/Latin America is not currently supported. AI inference calls route to the United States for processing.