LLM Sub-Processor Data Flow

1. Purpose

This page provides data-flow transparency for AI processing referenced in our Privacy Policy and Data Processing Addendum. It describes when data reaches a third-party LLM provider (only through a provider key the tenant connects itself), what is transmitted, whose agreement applies, what Intended keeps afterwards, and how customers keep LLM processing off. Intended will update it whenever the data categories transmitted or the set of AI providers involved changes.

2. Default: no LLM processing

Intended's authority decisions are made by deterministic rules and customer-configured policies, and by people when a decision is escalated. By default no LLM is called and no Customer Data is transmitted to any LLM provider. The two features described in Section 3 are each off by default and are enabled per tenant, only by a tenant owner or administrator, in the Operator Console under Settings → Privacy & AI. Each change to those settings is recorded in the tenant's hash-chained audit log with the actor, time, and the old and new values.

The following never call an LLM, regardless of tenant settings: the /v1/agent-intent endpoint, the SDK, the hosted MCP server, the MCP gateway, the hosted LLM gateway's own decision path, framework integrations, escalation and approval workflows, and policy evaluation.

3. When a third-party LLM provider receives data

Intended does not send Customer Data to any third-party AI provider and engages none as a sub-processor. As of the Last Updated date of this page, of the two optional features below, only AI-assisted classification calls a third-party LLM provider, and only with the tenant's own API key. AI policy drafting and product improvement run on models Intended hosts in its own infrastructure:

4. What data is transmitted

Only the data listed below is transmitted to the tenant's provider, and only while AI-assisted classification is on. Personal data is transmitted only to the extent a user includes it in the request text or hints. AI policy drafting transmits nothing to a third-party provider.

5. Processing boundary and what Intended keeps

• AI-assisted classification: the provider's response is parsed into Intended's structured intent schema and checked against the tenant's list of allowed actions. If the provider is unreachable, times out, or still does not return a valid structured intent after one correction attempt, the compilation fails and no action is authorized. The resulting structured intent is then evaluated by the deterministic policy engine; the model does not make the authority decision.
• AI-assisted classification: Intended stores the structured result derived from the provider's response (the proposed action, confidence, rationale, assumptions, missing fields, and any alternative interpretations) in the tenant's compilation record and audit run log. The request text itself is stored only as a SHA-256 digest and length, unless the tenant has enabled raw prompt logging, in which case a pattern-redacted copy is stored encrypted under a tenant-specific key. These records follow the tenant's plan retention.
• AI policy drafting: the description is processed by the model Intended hosts and is not transmitted to any third party. Intended does not store the description or the model's response. Only rules that a user chooses to save are stored.

6. Whose agreement applies

Intended engages no LLM provider as a sub-processor. AI-assisted classification uses the tenant's own provider API key, so the provider processes those requests under the tenant's own agreement with it, including that provider's retention and training terms. Tenants should review those terms before turning the feature on. Intended sends the provider only the data listed in Section 4.

7. Keeping LLM processing off

Because both features are off by default, no action is needed to keep Customer Data away from LLM providers. Customers who want an explicit control can use either of the following. When either applies, classification uses the deterministic rules backend and AI drafting is refused, and no data is transmitted to any LLM provider by those features.

• Tenant setting: the "Block all AI" switch in the Operator Console under Settings → Privacy & AI overrides both features for every request. It can be changed only by a tenant owner or administrator from a Console session (API keys cannot change it), and each change is recorded in the tenant's audit log.
• Per-request header: the header `X-Intended-Disable-LLM: 1` (or `true`) forces rules-only processing for that request on every natural-language path (/intent/compile, /lim/*, /v1/classify, /v1/classify/batch, /v1/classify/explain, webhooks, and the simulator) and refuses AI drafting.

8. Customer AI traffic through Intended's gateways

Customers may route their own AI traffic through Intended's hosted LLM gateway or connect their own AI assistants to Intended's MCP server or MCP gateway. In these cases the AI provider is chosen and contracted by the customer, and the customer's own provider credentials are used. Intended does not use an LLM to make decisions on this traffic. The LLM gateway forwards the customer's requests to the customer's provider without storing prompts or responses, and sends Intended only the tool calls it needs to decide on. Results returned by Intended's MCP tools (such as decisions, rationale, recorded action text, and policy packs) enter the customer's AI conversation and are processed under the customer's agreement with its AI provider. The "Block all AI" setting does not apply to this traffic because Intended is not the party calling the AI provider.

9. Changes and customer notice

Intended treats changes to the LLM sub-processor list, the data categories transmitted, or the opt-out mechanism as material changes to the Subprocessor List, subject to the 30-day advance-notice and objection-rights procedure defined in the Subprocessor List (/legal/subprocessors, Section 2). Customers subscribed to subprocessor notifications will be notified by email; material changes are also logged in the Change Log section of the Subprocessor List.

10. Contact

Questions about this page, about LLM sub-processor data handling, or about the controls in Section 7 may be directed to dpa@intended.so. Data-subject rights requests (access, deletion, rectification) follow the process documented at /legal/privacy and are fulfilled within the statutory windows described there. A plain-language technical description is available at /developers/docs/security/ai-use.