- Overview
- Quickstart
- Trust and compliance
- Security overview
- Data security and compliance
- Governance
- Features
- Cartographer
- Delegate for Testing
- Reference
- Troubleshooting
Delegate's redaction layer, data handling, network requirements, and compliance certifications.
This page covers the data-handling, network, and compliance detail behind the claims in Security overview. It is written for security and compliance reviewers evaluating Delegate before deployment.
Delegate runs on UiPath Automation Cloud and inherits its platform-wide security posture, including the AI Trust Layer. This page covers the essentials; for the full platform-level detail — infrastructure, sub-processors, data residency, and certifications — see Data security and compliance in the Automation Cloud admin guide.
Preventing accidental data leakage
Independent of every other control, Delegate runs an always-on redaction layer so that sensitive data does not leak by accident.
- Secrets and personal data are removed from tool output before the model sees it. Every tool's output is checked against more than 560 patterns and redacted. This covers API keys and tokens (AWS, Azure, GCP, OpenAI, GitHub, Stripe, Slack, and many more), private keys and certificates, database connection strings, and personal data such as national identifiers, credit cards, bank and routing numbers, passports, medical identifiers, emails, phone numbers, and IP addresses.
- Telemetry and logs are cleaned of user paths and emails before anything leaves the device.
- Diagnostics and settings exports are redacted, including tokens, secrets, and credentials.
This runs on the device and is on by default, so secrets are stripped before tool output is sent to the model.
This is separate from, and in addition to, the AI Trust Layer's own in-flight PII masking described below.
Where your data goes
| Question | Answer |
|---|---|
| Does my screen or data reach a large language model? | Yes. The content a task needs, including screenshots, is processed by a model. Delegate does not call a model vendor directly — every request passes through the UiPath AI Trust Layer over an encrypted, service-to-service-authenticated connection, under a contractual ban on training with your data. |
| Which models process my data? | The model you select processes your request — see Choosing the LLM model. It reasons about your request and interprets what it sees on screen. Requests route through the AI Trust Layer, or your own model if you bring one. |
| Can we use our own model? | Yes. You can bring your own model, including one hosted locally or on-premises. In that case, the entire data flow stays within your environment and under your control. |
| Is my data used to train AI models? | No. Training on customer data is contractually prohibited. Model providers also don't retain your data beyond short-lived, in-memory processing used to serve the request — typically cleared within minutes, and at most 24 hours depending on the provider. |
| Is it encrypted? | Yes. TLS 1.2+ in transit, including the connection to the model gateway, and AES-256 at rest. |
| Where are my conversations stored? | By default, conversation history is stored in UiPath Automation Cloud. A local-only mode keeps that history on your machine. Either way, the content a task needs is still processed by the model — local-only changes where history is stored, not whether data is processed. |
| How is my data deleted? | Deleting a conversation yourself triggers a permanent hard delete. Your organization can also request an organization-wide deletion — for example, under GDPR Article 17 — handled server-to-server. |
| Who can see my login? | Your existing UiPath identity (OIDC). Tokens are encrypted in the operating-system keystore — Windows DPAPI or macOS Keychain. |
| Who at UiPath can see my data? | UiPath support staff only, with your explicit approval, and every access is tracked and logged. Your data is never aggregated or used to build profiles. |
| Can content Delegate reads take it over, through prompt injection? | Delegate is layered against this: the model itself resists treating instructions found in a webpage, document, or email as commands; independent of the model, your authorization and restriction rules — blocked paths and apps, the scripting sandbox, per-operation Allow/Ask/Block — still gate any consequential action even if the model is fooled; and the AI Trust Layer can add a further, configurable prompt-injection detection layer. |
| Is personal data masked before it reaches the model? | The AI Trust Layer applies configurable PII masking to requests at the gateway, pseudonymizing common personal identifiers before the model sees them. This is separate from the on-device redaction layer described above, which strips secrets and personal data from tool output before it is even sent. Gateway-level masking does not classify clinical or health-record content as a distinct category, and it does not visually redact screenshots before they reach the model. |
Models and inference
| Question | Answer |
|---|---|
| Which LLM powers Delegate, which provider hosts it, in which region does inference run? | Delegate is powered by the models available through the AI Trust Layer. Available providers, their hosting regions, and routing are documented in AI features and model routing. Routing is configured per tenant, product, and feature — see Configuring LLMs. |
| What models handle Computer Use / screen interpretation, and where are they hosted? | The frontier model you have selected interprets what it sees on screen, the same model that handles the rest of your request. A UiPath-hosted location-grounding API works alongside it to pinpoint exact screen coordinates from the locator description the model generates. |
| Can admins restrict which models are available to Delegate users? | Yes. The Delegate policy in Automation Ops controls which models are available, alongside other security settings — see Governance with Automation Ops. |
Network and deployment
- Outbound HTTPS only, to UiPath domains for authentication, APIs, and AI inference. No inbound connections are required.
- Telemetry carries operational signals only — errors, timings, feature usage. It never includes conversation content, tool output, or screenshots.
- Delegate honors your system proxy and enterprise root certificates.
- See Installation for supported operating systems and hardware.
Compliance and certifications
Delegate inherits the compliance posture of UiPath Automation Cloud, published at the UiPath Trust Center: SOC 1 and SOC 2 Type 2, ISO/IEC 27001, 27017, and 27018, ISO/IEC 42001 (AI management), HIPAA, HITRUST, C5, IRAP, and Cyber Essentials Plus, together with GDPR commitments and a published sub-processor list. See the Automation Cloud data security and compliance guide for the underlying detail on each certification and the sub-processor list.
Delegate falls under your organization's existing Automation Cloud Data Processing Addendum (DPA) — no separate or amended agreement is needed to use it.
Shared responsibility
UiPath owns the platform: the redaction layer, encryption, access controls, and the security of the AI Trust Layer itself. Your organization owns how Delegate is configured for your environment — approval modes, tool permissions, blocked paths and apps — and reviewing what Delegate produces before acting on it.