Agent Studio data

Agent Studio genies use data to process your workflows. This requires storing essential recipe information in Data tables and uploading and maintaining data in knowledge bases and skills.

Data residency

Data residency refers to which geographic region processes and stores the data associated with genie interactions. Data residency is a critical consideration for organizations subject to data localization requirements such as GDPR, country-specific data sovereignty rules, or financial services regulations governing cross-border data transfers.

DATA CENTER LOCATIONS

Genies are available to all users in the US, EU, AU, SG, and JP data centers. Genie models are hosted in the US, EU, and APAC regions and respect data residency requirements where possible. Contact your Customer Success representative if you're interested in using genies or require additional information.

This means that selecting the appropriate Workato data center for your workspace is the primary mechanism for ensuring model inference happens in the correct region. If your organization is subject to EU data localization requirements, your workspace should be in the EU data center - which routes model inference to EU-hosted models.

Data security

Development and staging environments exist to test genie behavior before deploying to production. Testing requires conversations, Skill invocations, and Knowledge Base queries. Don't use real production data, including customer records, employee personal information, financial data, or patient records. Workato recommends that you use synthetic data for testing.

The risks of using production data in lower environments include the following:

• Data exposure: Lower environments typically have less restrictive access controls than production. Developers, testers, and contractors who have legitimate access to the lower environment may not have legitimate access to the production data. Using production data in the lower environment exposes it to a broader audience than intended.

• Regulatory violation: Using real personal data in a lower environment without appropriate controls may violate the regulation's data handling requirements if your data is subject to GDPR, HIPAA, CCPA, or other privacy regulations. Particularly if the lower environment is hosted in a different region from the production environment.

• Data quality contamination: Test operations that create, update, or delete records using production data can contaminate production data quality even in an isolated environment if the environment boundaries aren't correctly enforced.

• Use synthetic data in development and staging environments: Synthetic data should be realistic enough to test the genie's behavior, including realistic names, plausible values, and representative data structures. Invest in a synthetic data generation process rather than copying production data for genies that require large volumes of realistic test data.

Conversation data retention

Conversation record retention length affects the utility and level of risk for genie usage. Longer retention provides more history for debugging, QA, and compliance evidence. It also means more personal data retained for longer, increasing the risk surface for data breaches and the compliance burden under privacy regulations.

The proper retention period depends on:

• Operational need: How far back do builders need to look to debug issues? 90 days of conversation history is sufficient for operational purposes for most genies. Edge cases that require looking further back are rare enough that they do not justify indefinitely long retention.

• Compliance requirements: Some regulatory frameworks specify minimum or maximum retention periods for AI system interaction records. Financial services firms subject to MiFID II may be required to retain client communication records for five to seven years. Healthcare organizations subject to HIPAA may have specific retention requirements for records involving patient data. Identify the applicable requirements before configuring retention.

• Privacy obligations: Under GDPR and similar frameworks, personal data should not be retained longer than necessary for the purpose for which it was collected. If conversations are retained for debugging purposes, the retention period should be the minimum needed for debugging - not indefinitely. Document the retention purpose and period as part of the genie's data protection impact assessment if one is required.

• Data subject rights: Users may request deletion of their personal data under GDPR, CCPA, or similar regulations. Have a process for responding to these requests that includes conversation history. Know how to identify all conversation records for a specific user, how to export them for a subject access request, and how to delete them for an erasure request. Verify that the Workato platform's retention and deletion capabilities support these requirements.