Security

What Celeste sends to AI providers, and which providers

Go Fig sends AI requests only through providers' business API tiers, whose standard terms provide that data submitted via the API is not used to train their models. We never use consumer-tier endpoints, and we do not fine-tune any model on customer data.

Beyond those no-training terms, we minimize what is ever sent. Celeste transmits the minimum needed to understand your question, generate an accurate SQL query, and describe the result back to you in words.

Sent to AI providers

Never sent to AI providers

The search index

Separately from answering any one question, Go Fig maintains a search index so Celeste can find the right table without scanning everything. That index is Google Cloud Vertex AI Vector Search, located in the United States, and Google generates the embeddings from the text we send it.

More goes to the index than to a single prompt. It holds table and field names, types and descriptions; statistical profiles of your fields, including value ranges and frequently occurring values; a small number of sample rows; the definitions of your flows, dashboards and saved questions; the question text your users submit; and the contents of any knowledge file you upload. The redaction described below is applied to sample rows and to profiled and sampled values. It is not applied to descriptions or knowledge-file content, which reach the index as your users wrote them.

Records derived from your data carry your organization ID, and retrieval of those records is filtered by that ID at Google, not only in our code. There is no fixed retention period on the index. Records are removed when the underlying table is deleted, when you disable AI features, and when your organization is deleted.

Improving Celeste

We review conversation content from real usage to evaluate and improve Celeste's own accuracy. This is internal quality work, and it is not model training: no customer data trains any foundation model as a result of it.

Conversations selected for review pass an automated screen that excludes anything showing signs of personal data. Anything the screen flags goes to a queue where an authorized person reviews it before it can be used. Organizations that want to be excluded from this entirely can request it at [email protected].

Connections you direct

Everything above describes Celeste, where we control the payload. Separately, Go Fig publishes a Model Context Protocol (MCP) server that lets you connect your Go Fig organization to an external AI assistant such as Claude. If you set that up, data from your organization flows to that assistant's provider under your agreement with them, not ours. The caps and redaction described on this page govern what Celeste sends; they do not govern what you pull through a connection you control. We authenticate the connection and log the access. This is Section 3.4 of the Data Processing Agreement.

How PII is redacted before it leaves

Before any data reaches an AI provider, Go Fig automatically detects and redacts personally identifiable information. The same protections apply to AI responses before they reach you.

Input side, before sending to AI

Every data path that feeds an AI prompt is scrubbed:

• Table sample values. PII in sample data is replaced with [REDACTED].
• Table descriptions. User-written descriptions are scrubbed before embedding.
• Semantic model dimensions. Dimension sample values are scrubbed.
• Prompt context. A safety-net scrub runs on the final assembled prompt.

Output side, before showing responses

AI responses are validated before they reach you:

• PII patterns detected and redacted
• Unverified URLs removed
• Fabricated numbers flagged
• SQL mutation statements stripped from displayed code

PII types detected

Can Celeste change your data?

Not by default. Celeste is read-only by default. In its analytical role it generates SELECT queries only. INSERT, UPDATE, DELETE, DROP, and all other mutation statements are blocked at the guardrail layer.

Separately, an administrator can opt in to write-back on a per-connector basis. Where it is enabled, Celeste can act in your connected systems on your instruction:

What is logged, and for how long

Every AI interaction is logged stage by stage, on every plan. Each record holds:

• What was asked. The user's original question.
• Which model processed it. The model used at each stage.
• What data was reached. Tables and fields accessed, and the context provided.
• What was returned. The generated SQL and the response.
• Timing and confidence. Duration and confidence score for each processing stage.

The trail is read where the interaction happened: under any Celeste response, the Show work link opens the stages in order, with the tables reached, the SQL generated, and the time each stage took. An organization administrator can open any trail in their own organization. Everyone else sees only their own. Nobody can read across organizations, and a person who has left your organization is refused even on their own past conversations. Administrator here means the Admin role specifically, not any member who happens to hold elevated data permissions.

Administrators also get an organization-wide view: the AI activity page in organization settings. For any window they choose it lists interactions with when each one happened, who asked, the question, the data it reached, the models used, and the credits it consumed, and it filters to one person and to a date range. A window can span up to 400 days, measured end to end, and nothing limits how far back it starts. One request returns at most the 500 most recent interactions in that window and the page shows 25 rows at a time, so a busy window is a page rather than the whole record. The page says so on screen when the window holds more than one request returns, and it reports the true total either way. Every row carries a Decision trail column: Show work opens that interaction's stage-by-stage trail without leaving the page.

Question text is readable for 90 days, counted from when the conversation was opened rather than from the individual question. A question asked today inside a conversation opened more than 90 days ago is already withheld. Decision trails run on their own clock, counted from the interaction itself. Past 90 days that content is withheld at read time, ahead of the jobs that delete it, so nothing older is readable even in the days before a cleanup job runs. A trail withheld on the conversation clock is not blank: the stages that ran, their timing and confidence, and the tables reached are still shown, and only the written detail and the generated SQL are withheld. Once the interaction itself is past 90 days its trail records are deleted, and there is nothing left to show. Attribution outlives the content window: an administrator looking back a year still sees who asked, when, which models ran, and what it cost, without the question text or the written detail of the trail.

Usage metering records are separate and are retained for seven years on a tax and accounting basis. They record what was consumed, not what was said: model, token counts, cost, and credits per request, associated with your organization. They contain no query text, no results, and no content from your data. The link to the individual user is removed after 90 days, so only organization-level metering persists beyond that.

How your data stays separate from other organizations

Isolation is enforced twice over, on two different subsystems. Both sets of layers are always on.

Cross-organization access attempts raise an error and are logged.

What every plan gets, and what is plan-gated

The protections on this page are not an upsell. Every organization, on every plan, gets all six:

• No-training AI providers. What we send, and to whom
• PII redaction on the way out and the way back. PII redaction
• Tenant isolation, eight layers across two subsystems. Tenant isolation
• Read-only by default. Read-only and write-back
• A full AI interaction audit log. Audit trail and retention
• An organization-level switch to turn AI off entirely. With it off, no data from your organization reaches any AI provider under any code path.

What varies by plan is the depth of access control, which models are reachable, and how we evidence our security posture:

On plans below Enterprise we provide a summary of our security posture and written answers to specific security questions in place of the report itself. Request either at [email protected]. The commitment is written down in section 3.6 of the Terms of Service and section 9 of the Data Processing Agreement.