--- title: "Data protection: data flows, GDPR documents and the public-office preset · intentic docs" description: "See every way data can leave a sandbox, check its protections, download a record of processing, an impact assessment and the measures list filled in from its setup, and switch on stricter settings for a public office." url: "https://intentic.dev/docs/data-protection/" updated: "2026-10-13" --- Run a sandbox # Data protection · protections, data flows and GDPR documents Before a sandbox handles anyone's personal data, a data protection officer needs to know where that data can go and what protects it. The Data protection page answers both from the sandbox's live setup, and drafts the documents they file. **On this page (4 sections)** - [Where it is](#where-it-is) - [1. Protections](#1-protections) - [2. Where data goes](#2-where-data-goes) - [3. Documents](#3-documents) ## Where it is Open **Sandbox ▸ Data protection**. Owners and maintainers see it; everyone else does not. The page is three steps, in the order they are done: **Protections**, **Where data goes** and **Documents**. Each step's tile says how it stands before you open it: how many protections are on and how many recommended changes are left, how many places data goes and how many are outside the European Economic Area, and whether the documents would be better downloaded later. Reading the page changes nothing. Only the Apply button in the first step changes settings, and only the owner can press it. ## 1. Protections Every technical and organisational measure the sandbox offers: the privacy shield, local models, roles and areas, guest isolation, sign-in, approvals before the agent sends anything, approval of work started from outside, the command judge, credential gates, deletion periods, the audit trail, encryption at rest and in transit, product analytics, the AI notice for staff and the visitor chat's AI disclosure. They are sorted by what you can do about each one. - **Recommended**: what an office working under GDPR, Poland's KRI rules and the AI Act usually wants, where this sandbox is not set that way yet. Each change is listed under the protection it switches, with its value now beside the value proposed, and starts ticked. - **More you can switch on**: optional protections, each with a link to where it is set. - **Already in place**: folded away, and opened on asking. Intentic's defaults suit developers and individuals. The recommended settings are: - the privacy shield on, with images masked and names found by the local model where it is installed; - conversations deleted after 90 days, restore points, converted documents and full command output after 30, and the shield's memory after 90; - the audit trail kept for two years, and recording who opened what; - product analytics off, and the AI notice shown to staff; - every message, reaction and mail the agent sends, and every further agent it starts, waiting for a person's approval; - work started by a webhook, a chat message, a website visitor or a bug report waiting for approval; - the command judge on. Untick what you do not want, then press Apply; you see the list once more before anything changes. The recommendations never loosen a setting that is already stricter, and each one can be changed back later where it is set. Backups happen outside the sandbox, so the page leaves them for your office to describe. ## 2. Where data goes Every place the sandbox sends data to as it is set up right now: the AI model providers and endpoints you connected, mail, team-chat bots, the visitor chat, connected services, cloud voices, web search and the agent's browser, your Intentic account, the access point people reach the sandbox through, update checks, model downloads and the editor's product analytics. For each one it says what the place receives, whether that can be personal data, what the privacy shield does on the way, and where the data is processed, marking a place outside the European Economic Area, since a transfer to a third country needs a legal basis of its own. A place not in use is listed apart, because one switch would open it. Some things the sandbox cannot see, such as which data centre region Intentic's access point runs in, or whether your office reaches the sandbox through its own reverse proxy. Those come first in the step, as the questions only your office can answer. ## 3. Documents Three drafts, in Polish or English, as a Word document or Markdown: - **Record of processing activities** (GDPR Art. 30): the entry for this system, with its recipients, transfers outside the EEA and deletion periods. - **Data protection impact assessment** (Art. 35): the system and its data flows, prompts for necessity and proportionality, and the main risks of using AI with the protections actually switched on. It ends with a note on the AI Act: helping to draft letters is not high-risk in itself, while deciding who gets public benefits would be (Annex III, point 5(a)). - **Technical and organisational measures** (Art. 32): every measure, whether it is on, and where it is changed. Each is written from the sandbox's settings at the moment you download it, which is why it is the last step: while recommended changes are left unapplied, the step says so, with the way back to the first. Everything the sandbox knows is filled in. What only your office knows, such as who the controller is, the purpose and legal basis, whose data is processed and the officer's contact details, is left as a marked blank (✎). The drafts are a starting point for your officer, not legal advice. More in Run a sandbox [Previous ← Access & sharing](https://intentic.dev/docs/access/)[Next Troubleshooting →](https://intentic.dev/docs/troubleshooting/)