AI Data Processing and Residency for Agentic LLM Features

Stellar Cyber uses OpenAI as the Large Language Model (LLM) provider for AI-assisted features. Stellar Cyber minimizes the information that OpenAI receives, keeps your security data isolated by tenant, and prevents OpenAI from using your data to train models. AI Investigator anonymizes personal information where the workflow supports it. Alert Auto Triage and Case Analysis do not anonymize the context sent for analysis. This topic explains what information Stellar Cyber sends to OpenAI and analyzes with agentic LLM features, where AI processing occurs, and how Stellar Cyber protects personal and sensitive information during AI-assisted workflows.

• Personal Information that Stellar Cyber Anonymizes or Obscures

• Feature-by-Feature Processing

• Data Retention and Model Training

• Where AI Data Is Processed

Personal Information that Stellar Cyber Anonymizes or Obscures

Where the workflow supports it, AI Investigator uses anonymization to detect and obscure common personal information categories before AI processing. The process is designed to preserve security meaning while reducing exposure of direct identifiers.

AI Investigator can anonymize or obscure the following personal information types:

• IP addresses

• URLs

• Email addresses

• Personal names

• Phone numbers

• Locations

When Stellar Cyber anonymizes these values, it replaces the original value with a consistent protected token so the AI feature can still reason about relationships in the data. For example, the AI feature can recognize that the same anonymized user or host appears in multiple places without seeing the original identifier.

Alert Auto Triage and Case Analysis do not apply this anonymization. These workflows preserve identifiers and command lines so the analysis can correlate related security signals.

Feature-by-Feature Processing

Stellar Cyber sends only the information needed to support each AI workflow. The exact data depends on the feature that you use and the context that you provide.

AI Feature	Information Processed by the AI Feature	How Stellar Cyber Protects the Information
AI Investigator	Your investigation request, the relevant data schema, and summarized or aggregated investigation context when needed.	Stellar Cyber anonymizes user-specific and tenant-specific identifiers before sending the request. For table summaries, Stellar Cyber anonymizes aggregated data on your Data Platform before sending it for AI processing. Raw security data remains in the platform.
Alert Auto Triage	Structured alert context, including alert metadata, observables, threat intelligence, user and device context, and related entity history.	Stellar Cyber limits the context to what the analysis needs and keeps requests tenant-isolated. The context is not anonymized: identifiers such as IP addresses, hostnames, usernames, domains, file paths, and command lines are processed in their original form. Masking these details would reduce the accuracy of the analysis.
Case Analysis	Case details, related alerts, observables, threat intelligence, user and device context, and activity history relevant to the case.	Stellar Cyber limits the context to what the analysis needs and keeps requests tenant-isolated. The context is not anonymized: identifiers such as IP addresses, hostnames, usernames, domains, file paths, and command lines are processed in their original form. Masking these details would reduce the accuracy of the analysis.
AI Assistant	Your free-text prompts and the context that you include or request the assistant to analyze.	You control the prompt content. Stellar Cyber applies tenant isolation and AI provider data protection controls to the request and response.

Information Sent to Third-Party Enrichment Services

In addition to LLM processing, Stellar Cyber can query threat intelligence and reputation providers to add context to an alert. These providers include VirusTotal, URLscan, and AbuseIPDB. Stellar Cyber sends only specific observables to these providers, such as IP addresses, URLs, domains, and file hashes. Raw telemetry is not sent to these providers.

Data Retention and Model Training

Stellar Cyber does not allow OpenAI to use customer data for model training. Stellar Cyber uses zero data retention controls for OpenAI requests where supported, so prompts and responses are not stored on OpenAI servers for later use.

Each AI request remains isolated to the tenant that initiated it. Stellar Cyber processes the request through the auditable API layer that Stellar Cyber provides rather than allowing unrestricted access to customer environments.

Where AI Data Is Processed

Stellar Cyber hosts SaaS platform data in Oracle Cloud Infrastructure (OCI) regions selected for the deployment. For example, Latin America deployments can use the Brazil/São Paulo OCI region for the SaaS platform.

Data residency for stored customer data and the location where AI inference occurs are not always the same. Depending on region availability, customer data may be stored in one region while AI processing occurs in another supported region.

AI processing occurs in Frankfurt, Germany, or the United States, depending on the AI region configured for your deployment. The processing location is determined by this configuration, not by the geographic location of your deployment. The following table summarizes the current documented status.

Region	Current AI Processing Status	Notes
United States	Available	Current central AI processing is available through the supported AI backend.
European Union/Europe	Available through the Early Access Program (Frankfurt, Germany)	AI requests use this endpoint when the deployment is configured to use the EU (Frankfurt) AI region. On-premises deployments outside the EU can also use this region.
Asia Pacific	Planned	Japan and Singapore regional data residency is planned for future AI processing expansion, which might occur elsewhere depending on where OpenAI provides inference processing.
Brazil/Latin America	Not currently a supported AI processing region	The SaaS Stellar Cyber Platform can be hosted in the Brazil/São Paulo OCI, but current AI processing in Brazil/Latin America is not currently supported. AI inference occurs in Frankfurt, Germany, or the United States, depending on the AI region configured for your deployment.