Your data and the model

If you are deciding whether Sloose is allowed near your CRM, this is the page to read. It says what happens, not what we intend.

The short version

• Your file is read in your browser, and stored with your import. Sloose keeps it, with the corrections you make, in Cloudflare’s Oceania region until your plan’s history window has passed since the import was last changed or run — up to 30 days longer after a change of plan, and for 90 days from a suspension whatever the window — or the import is deleted. Its rows are written into your CRM through our API, using your organisation’s own connection.
• The AI features are the only thing that sends any of it to a model, and they send samples, not the file.
• You control how much, with a per-organisation setting: all values, masked values, or none.
• Fields excluded from AI are never sent to the model, in any form — not as they are, and not as their shape — under every setting, the most permissive included, from the moment they are excluded: a question already asked in a conversation is sent again as it was first sent (see What is kept). That includes what a failed formula is allowed to say back: a thrown value is a value. What stands in for such a field’s values is its examples, sent as written.
• The setting covers what goes beside the sample rows too: the values a validation problem is about, the distinct values value mapping asks about, the records the file assistant reads, the values you type to try a helper on, and the values you paste for a field when you ask the AI to fill in a module’s fields.
• Where a feature needs the values themselves, it says so under a setting that withholds them, rather than quietly answering from less: Translate values matches values without the AI, and a run’s errors are explained from their codes and fields — and each page says which setting is why.
• What comes back to you is your own, where it is worked out for you. The setting governs the model, not the answer: a formula’s sample outputs and its error, and the sample outputs on a mapping proposal, are computed from your own rows unmasked, because your browser is you and the model is not.
• One exception: the steps the assistant shows you. What you see of a step is what the MODEL was told — so under the masked or none settings those lines are masked too. Showing you something the model never saw would make it a worse record of what happened, which is the only thing it is for. It is a window rather than a record: each step is trimmed to a couple of hundred characters, so a long one is cut short.
• Nothing is written to your CRM on the model’s say-so. Every AI feature proposes; a person accepts. (An agent connected over MCP can save a template, or change one setting of an import a person has open, without anybody looking first; it cannot run an import.)
• A question you ask about a proposal is kept, for your plan’s history window — through the chat API, or with Ask AI or Not quite… on Map fields’ Which rows & existing or Map columns (all but Suggest columns) while a change of yours is still being saved, when it is kept in your own chat history rather than with the import — so the next one can build on it, the samples sent with each included. Making the setting stricter later does not rewrite it; it stops the earlier questions being sent again. Excluding a field from AI withholds it from the next question on, not in the ones already asked. See What is kept.
• A question you ask about an import is kept with the import when nothing of the import is waiting to be saved — Ask AI about a file on Source, and on Map fields’ Which rows & existing, Map columns and Translate values, Not quite… on a proposed mapping, rule or value there, the formula editor’s Ask AI about the expression it edits, what Draft everything drafts (and Fill the gaps, the same draft asked only about what a template’s check left open, and Draft it anyway, one file and module of it), Explain on a run’s error group or on one of Validate’s problems, Validate’s own Ask AI about all of its problems at once, and Run’s own Ask AI about its run (each asked through the API too, with the conversation it is kept in) — so anyone who can open the import reads what was asked, and by whom, and the next question picks up from it. Asked while a change of yours is still being saved, a question on Which rows & existing or Map columns, but for Suggest columns, is kept in your own chat history instead (above); the rest — Suggest columns on Map columns, Ask AI and Not quite… on Translate values, the formula editor’s Ask AI, Ask AI on Source, Draft everything (and Fill the gaps, Draft it anyway) and Explain on a run’s error group or one of Validate’s problems, and Validate’s and Run’s own Ask AI — only on the page. It keeps the question, the answer, what it proposed and its notes, not the rows sent with it, and it goes with the file it is about (a question about Translate values, about all of Validate’s problems or about the run, and what the draft proposes for your values, is about no one file, and stays with the import), its import and your organisation. See Questions about an import.

If you use no AI features, no part of your data reaches a model at all.

What is sent, per feature

Feature	Columns	Sample rows
Auto-map	Yes	Up to 20
Value mapping	No	None — only the distinct values it is asked about (up to 150 a field)
Formula assist	Yes	3, chosen from what the expression on screen makes of each row: rows whose result fails the field’s check first, then rows whose results differ in shape (the first rows when there is no preview to choose by), and up to 5 more you marked as wrong, with what each should be. With them, when the expression on screen runs in the preview, goes what it makes of every row, by shape: each digit written 9 and each letter X or x. The 12 commonest shapes are named, each with how many rows come out that way and how many of those fail the field’s check, and the rest are counted together. Nothing of the kind is sent for a true/false rule (a filter, a gate or a guard), for an expression that reads records or old/next, or when the editor is empty or the preview cannot run. Only the number of shapes goes, without the rows or counts, when the setting is none, the field or any column is excluded from the AI, or the column list sent reaches its limit of 500, even when it holds every column
Explain and fix	Yes	Up to 5
Chat	Only if the conversation is about a loaded file	Up to 20
File assistant	The file’s first record	Up to 12 records, its last 5 lines when it runs past them, and up to 10 records that did not parse
Ask AI on a library’s page	No	None — the values you type under Try it on, up to 20, the library’s code and manifest as they are on the page, and the names and descriptions of your organisation’s other helpers
Fill in with AI	No	None of your file’s — up to 20 of the module’s records from your CRM, and the values you paste for a field, up to 20

Along with them go your schema — the module and field names your organisation has, and any annotations an administrator has written; the table’s last two rows send only what they say — and, for explain-and-fix, the question you asked (a suggestion’s words or your own), for a question about the run the last run’s recorded totals and modules (dry or real, how it ended, the rows it wrote, made, updated and failed, and the modules it wrote to — one no longer in the connection included — read from its history, never from the page) and the run as it would go now — each file in the order it runs, by its name (which can say what the file holds), with its row count and its modules in order — and the validation problems themselves: their words as they are, and the values each one is about kept apart, so those values follow the policy below exactly as sample rows do — and a value about a field or column excluded from AI is left out under every setting, and the model told it was. A problem whose words may quote a value — a failed row’s error, which can be the CRM’s own message — is treated as a value itself: its words are left out under masked and deny, and under allow too when it is about a field excluded from AI, or a field filled straight from a column named like a field excluded from AI; the model explains it from its error code and the field it names.

Draft everything (and Fill the gaps) also sends, with each file’s question about how an existing record is found, the file’s name and every other file of the import by its name and its column headers — up to 10 files and 60 headers each, never a row of theirs — so the model can say which modules the file’s rows are records of. Draft it anyway sends neither.

Fill in with AI, on a module’s page, sends that module’s fields as your CRM describes them — each one’s label, type, length, options and whether it is required — with what your organisation has already written about them, and any values you paste for a field. To show the model what the fields hold, it also reads up to 20 of the module’s records from your CRM — the most recently changed, once for the ask and once for What the model is shown — and keeps none of them: Sloose stores none, and the ask tells the AI gateway to keep a record of it (its organisation, model, size and cost) and nothing it carried. Each value read goes up to its first 200 characters. What is read, and what you paste, follow the setting as sample rows do: as they are under allow, as shapes under masked, and under deny nothing is read and nothing pasted is sent. A field excluded from AI is never read, and what you paste for one is not sent, under any setting: its examples stand in for its values. The examples it proposes are made up: one that is, or holds, a value read from your records — any field’s, in any spelling — is not offered. It can also propose excluding a field whose values look personal, and says why. A rule it proposes is run on its examples in the sandbox before it is offered. When the rule fails, the AI is told what happened with its own examples. For an example your organisation wrote, it is told only that the rule failed on one, never which. What you take from its answer becomes that field’s annotation, and like every annotation goes with later AI requests as part of your schema.

Value mapping sends no columns and no sample rows: only the distinct values a field still needs a decision on (up to 150 a field, twelve fields at a time), and for a lookup the names of up to 400 candidate records your browser already holds. It is the one feature that has to read a value to be of any use — Aus means Australia, Xxx means nothing — so it runs under allow, and under masked for a picklist or multi-select field filled straight from a column: that column’s distinct values are sent, without a count of how often each appears. Under masked a lookup is not asked about, since its values and its candidates are the names of records, and neither is a field a formula fills, since a formula can read any column: Translate values matches those in your browser and says so on the field. It never runs for a field excluded from AI, or one filled straight from a column named like a field excluded from AI. Under deny, Translate values matches every value in your browser instead, and says so.

The file assistant’s records follow the policy like sample rows. Its first record goes as it is, as column names do everywhere; a column named like a field excluded from AI goes with its cells empty, under every setting. The records that did not parse are masked under masked, and in a file with a column named like a field excluded from AI go with every cell empty, under every setting — keeping only how many fields each has — since their cells do not line up with the columns. The file’s last lines, sent so it can see how a file ends (a grand total, a footnote), follow the setting as the records do, and one that did not parse as those do. Whatever is masked, the model is told it is looking at shapes; whatever is left empty, that it was withheld, not blank in the file.

Row counts above are ceilings, not targets. A file of 40,000 rows sends at most the numbers above, never the file.

The sample policy

One setting per organisation, on the AI and your data page of settings, with three values:

Policy	What leaves
allow	Sample values as they are — except fields excluded from AI, which are left out from when they are excluded.
masked	Every value masked, whatever it is, and fields excluded from AI left out — except that, for value mapping, the distinct values of a column mapped to a picklist or a multi-select are sent without their counts: that column’s alone, never for a field excluded from AI or a column named like one, and never a lookup’s or a formula’s. Column names still go, so mapping still works, and a run’s errors are explained from their codes and fields, without their messages.
deny	No values at all. The model is told none are available and works from column names and your schema alone. Value mapping by the AI is not offered, a run’s errors are explained from their codes and fields, and the file assistant can generate a file but not read yours.

Under Masked, the first line of a file goes to the AI as its column names — including when your file has no header line. Most files have one, and every AI feature works from the column names: without them there is nothing to map or fix. If the first line of yours is data, that line is sent as it is.

A new organisation starts on allow. Choose masked if the heuristic below is not enough of a guarantee for your data.

deny is not a broken mode: auto-map still proposes mappings from column names and your field names, it just cannot use the shape of the data to break a tie. It will be less good at telling a date from a number, and about as good at everything else.

What masking does

Digits become 9, capitals become X, and everything else becomes x — in any script, so a Chinese name is masked exactly as an English one is.

Three things survive, and nothing else does:

• Punctuation — @ . - / : , # ( ) ' and the rest of what Unicode classes as punctuation.
• Ordinary spaces, but not line breaks: a masked value is always one line.
• Nine symbols, written out one by one: + = < > | ~ $ £ €. They are what keeps a phone number looking like a phone number and an amount like an amount.

Everything else is masked or dropped — including emoji, symbols that happen to look like letters, and invisible characters such as zero-width marks and text-direction controls.

The nine symbols are a fixed list and cannot grow. The first two are Unicode categories, so they follow Unicode: if a future version adds a punctuation mark, that mark survives too. We chose that deliberately — punctuation and spaces are the shape a masked value exists to carry, and our own hand-written list would be a worse guess than the standard’s.

A test walks every character Unicode defines, checks that nothing letter-like or number-like gets through, and counts the survivors, so a new Unicode version cannot quietly widen what a mask keeps without one of us being told.

Ada Lovelace        →  Xxx Xxxxxxxx
ada@northwind.com   →  xxx@xxxxxxxxx.xxx
+61 2 9000 1234     →  +99 9 9999 9999
2024-03-17          →  9999-99-99
AC-1002             →  XX-9999

The point is that shape survives and content does not. A masked value still tells the model “this column holds something email-shaped” or “this is a date in ISO order”, which is most of what it needs to propose a mapping — without telling it whose email it is.

Excluding a field from AI

An administrator ticks Exclude from AI on the field. Its values are then never sent to the AI in any form — not as they are, and not as their shape — whatever your organisation’s AI setting. Under every policy, any column that would land in a field excluded from AI is withheld: its cells are left out of the sample rows, and the model is told the column is withheld. The other columns follow the setting.

The match between a column and a field is made by name, since a column has not been mapped to anything yet at auto-map time — a column fuzzy-matching an excluded field’s API name, label or recorded aliases is treated as that field’s data and withheld.

The same field’s values are withheld where they appear in a validation problem, and so are the problem’s own words when they may quote one; the values you paste for the field in Fill in with AI are not shown to the AI; and value mapping leaves the field out.

That is a heuristic: a column holding an excluded field’s data under a name nothing recognises is sent as it is. If you want more than a good-faith match, masked reduces every value to its shape but one kind: a column you map to a picklist or a multi-select has its distinct values sent, so the AI can match them to the list’s options — nothing else of its rows. A lookup’s values and a formula’s are matched in your browser instead, and a row filter is written from what you ask for and the shapes of your rows rather than from the values. deny sends no values at all.

What stands in for the field’s values is its examples. They are sent to the AI as written, under every setting, so the model still knows what the field holds — which means an excluded field’s examples should be made up. The field’s Examples box on its module’s page says so: Sent to the AI as written, in place of this field’s values: use made-up values like these.

See Field annotations for where to set it.

Where the model runs

Calls go to Anthropic through a Cloudflare AI Gateway that we operate. Each feature runs its own model: most use a Claude Sonnet model, and explaining a problem and writing a formula use a Claude Opus model.

A deployment with no AI configured answers “not configured” rather than failing obscurely, a model that can’t be asked just now answers “unavailable” and charges nothing, and every AI route is metered against your organisation’s credit balance — so AI usage is accountable per feature (GET /ai/usage) rather than invisible until the invoice.

What is never sent

• Your whole file. Only the samples and values described above ever reach the model.
• CRM records — with two exceptions. Value mapping for a lookup, under allow, sends the names of the records your browser already fetched for it to match against, so the model can say which record “Acme Pty” means. And Fill in with AI, on a module’s page, reads up to 20 of that module’s records from your CRM each time it is asked, and sends what the AI setting allows of them. Sloose reads your CRM to build no other prompt.
• A value of your files through the MCP tool validate_import. It checks an import’s rows as the Validate step does, but what it returns to the connected assistant is the problems in words with each quoted value left as “…”, their row numbers and counts, and the names of your columns and fields. It returns no value of your file under any setting, and no text a formula threw about a row, so a formula an assistant writes cannot be used to read cells back. Row numbers and counts are returned, so which rows a check stops on is not hidden from it.
• Credentials of any kind — your Zoho refresh token is encrypted at rest on our side and is never part of any prompt.
• Any value from your files, from an organisation whose policy is deny — not a sample row, not a value a validation problem is about, not the values you type to try a helper on, not the values you paste for a field. The question you ask, your column names and your schema still go: without them there is nothing to ask. So do the expressions you have written — a mapping’s formula, the row filter in force, the formula you are asking about — as you wrote them, under every setting: a value you typed into one goes with it. And so does a helper library’s code, on its page’s Ask AI: it is the thing being asked about.

Turning it off

There is no AI without a deliberate action: every feature is a button somebody presses. Setting the organisation policy to deny removes the sample rows; not pressing the buttons removes the calls. An organisation with too few credits for a call cannot make it at all: it is refused before anything is sent.

What is kept, and for how long

The questions you ask about a proposal are kept. A conversation held through the chat API (POST /ai/chat) with no import named — and Ask AI or Not quite… on Map fields’ Which rows & existing or Map columns, all but Suggest columns, asked while a change of yours is still being saved, which cannot be kept with the import as it stands and is kept in your own chat history instead — send the model the questions and answers before them in that conversation — that is what lets “not quite, use the legal name” mean something — so Sloose stores them. What is stored, in Cloudflare’s Oceania region with the rest of your organisation’s data:

• each question you asked, with the sample rows sent with it, exactly as the setting let them through when you asked;
• the answer, and the steps taken to reach it — the tools the model called and what they told it.

Every other AI request — but a question kept with an import, below — is one request: what it sends is used for that answer, and Sloose stores none of it — only a record that the call was made. That includes every question below that is asked while a change of yours is still being saved — at any other time each is kept with the import:

• Suggest columns on Map columns;
• Ask AI and Not quite… on Translate values;
• the formula editor’s Ask AI;
• Ask AI on Source;
• Draft everything, Fill the gaps and Draft it anyway;
• Explain on a run’s error group or on one of Validate’s problems;
• Validate’s and Run’s own Ask AI.

Asked then, the answer stays on the page. Fill in with AI on a module’s page is always one request: there is no import to keep it with, and what you take from it is kept as your fields’ annotations, not as a conversation.

Every request also passes through our AI gateway (Cloudflare AI Gateway), these and the questions above alike. The gateway keeps a log of each request and its response, sample rows included, so that we can investigate problems — except Fill in with AI’s, which carry records read from your CRM: of those it keeps the metadata alone (the organisation, the feature, a request ID, the model, its size, tokens, cost and status) and nothing they carried. The log holds the most recent 10 million requests and deletes the oldest as new ones arrive.

For how long. Each question and its answer are deleted once your plan’s history window has passed since the question was asked — 7 days on Free, up to a year on the larger plans, and up to 30 days longer after a change of plan, the same clock as your run history. A conversation goes when nothing is left in it, and every conversation goes when your organisation is erased.

When the setting changes. A stored conversation is never rewritten: what was sent stays as it was sent. If the setting becomes stricter — from all values to masked, or from either to none — the next question in that conversation is sent without the earlier ones, and its answer says so; every question after it keeps to that. Loosening the setting does not send the earlier ones again.

When a field is excluded from AI during a conversation, the exclusion applies from then on: the next question withholds it, and the questions already asked are not rewritten — they are still sent with that conversation’s later questions as they were first sent.

Questions about an import

The questions asked about an import are kept with the import, not with the person who asked, when nothing of the import is waiting to be saved — otherwise as above: Ask AI about a file on its Source step, and on Map fields — Which rows & existing, Map columns, Translate values, Not quite… on a proposed mapping, rule or value there — the formula editor’s Ask AI about the expression it edits, what Draft everything, Fill the gaps or Draft it anyway drafts, each part’s share kept with that part, Explain on a run’s error group or on one of Validate’s problems, Validate’s own Ask AI about all of its problems at once, and Run’s own Ask AI about its run — each asked through the API too, with the conversation it is kept in. A failure’s conversation is the failure’s, not the run’s: the same failure on the next run carries it on. Anyone who can open the import reads them — the thread shows who asked each — you, a colleague by name or someone no longer in Sloose, with through an agent for a question an agent asked for them, or through the API for one an API token asked, and the import’s AI activity lists every one, newest first — and the next question there is sent with the ones before it, which is what lets that, but keep the Vendor rows mean something to the model. For each question Sloose keeps, in Cloudflare’s Oceania region:

• the question, and the answer;
• what the answer proposed, and where: a row filter, a different way of reading the file, a change to its shape, or a generated sample — a sample by its columns and its size, not by its rows; a column, a formula or a fixed value for a field, a column to leave out, how an existing record is found, which rows a module takes, when a record a row finds is updated, what one of your file’s values becomes, and an expression written into the formula editor;
• the answer’s notes: what it could not do, and what Sloose refused of it — a step that did not run, a filter that failed. Under the masked and none settings a note never says a value of your file: a filter that failed on a row is kept as having failed, not with the error the row gave;
• what of the file the answer was made from under your organisation’s AI data setting: its values, their shapes, or none of it;
• who asked it, and whether in the app, with an API token or by an agent.

The rows sent with a question are not kept with it. What was asked before goes back to the model as words: each question, its answer, what it proposed, and what became of the last answer, read off the import as it stands — used, changed by hand, still waiting, turned down, or not taken. An answer in the formula editor waits in the editor, which Sloose does not keep: while the editor is open it says whether the answer still waits or was turned down, and once it is closed what became of the answer is read off the import alone. A change to the file itself is read off which answer made the file the import holds, which Sloose keeps with the file; a guess on Which rows & existing, Map columns or Translate values, and one you turned down there, keeps which answer made it. An answer, what it proposed and, under the all-values setting, its notes can still quote values from your file.

For how long. The same clock as the questions above: each is deleted once your plan’s history window has passed since it was asked, up to 30 days longer after a change of plan. It goes earlier: a question about a file with the file when it is removed from the import — what the draft proposes for your values, and a question about all of Validate’s problems or about the run, are about no one file, and stay with the import — every question with the import when it is deleted or expires, and with your organisation when it is erased. A person who is deleted leaves their questions with the import, naming nobody.

When the setting changes, the rule is the one above: a kept question is never rewritten, and it is sent again only while the setting is no stricter than what the questions about to be sent were made from. Under a stricter one the next question starts afresh, and says so.