AI models and providers
Windmill uses a mix of leading closed models and open-source models to power Windy, our AI agent, across feedback collection, 1:1 preparation, performance review drafting, and more.How Windmill chooses a model
Windmill routes each AI request to the model and provider that best fit the task. Quick conversational replies go to the fastest option, and complex, multi-step work goes to the most capable model. If a provider is slow or unavailable, Windmill automatically fails over to another approved provider, so Windy stays fast and reliable.Model providers
Zero data retention
Windmill has zero data retention enabled across all AI model providers. This means:- Your data is not stored by our AI providers after processing
- API calls are processed and immediately discarded
- No logs or caches of your data are retained by our AI providers
HIPAA
Windmill has a Business Associate Agreement (BAA) with every AI model provider listed above, covering HIPAA and zero data retention. Customers that require HIPAA compliance can sign a BAA with Windmill.Zero data retention ensures that your company’s data never becomes part of AI provider training datasets or storage systems. In the future, if we choose to use other model providers, we only use providers that support zero data retention policies.
AI security controls
AI features follow the same access controls as the rest of Windmill. Windy cannot retrieve or use content that the requesting member cannot access. Windmill application services enforce these permissions; permission decisions are never delegated to AI models. Company isolation Search indexes and embeddings are isolated by company. Windmill checks resource-level permissions when it retrieves content. Embeddings are encrypted at rest and deleted with their linked source data. Controlled actions Windy uses defined tools with validated inputs. Model-generated requests remain subject to the same permissions as the member making the request. Windy does not execute model-generated code, browse the internet, or modify external systems. Output handling Windmill validates tool inputs and sanitizes AI-generated web content before it is displayed or used in an action.Data retention
Windmill keeps customer data while a customer has an active engagement with Windmill. When an engagement ends, Windmill deletes all of the customer’s data 60 days after the account closes. See Data retention for the full process.Telemetry
Zero data retention applies to our AI model providers. Windmill records AI inputs, outputs, and tool activity as product telemetry. Access is limited to authorized personnel and is protected by audit logs. Customers can request AI interaction and tool activity logs for their Windmill environment for audit or export. Admins can turn this off with Allow AI telemetry under Data controls in Settings > Security.Without telemetry, the team has limited ability to investigate issues you report with AI output quality. Windmill may not be able to see what caused an issue or confirm that a fix works.
Model training
Our AI model providers do not train on your data. They operate under zero data retention.- Windmill does not build or train general-purpose AI models from customer data
- Windmill may use anonymized customer data to improve its own models. Before use, we remove all information that could identify a customer, individual, or situation
- These models are used only to operate and improve Windmill. We never offer them as a service to other parties
- You can opt out at any time, unless your Windmill contract sets this control. Admins can turn this off with Allow model training under Data controls in Settings > Security
Your data stays your data. Anonymized data never contains information that could identify a customer, individual, or situation.
Prompt improvement
Windmill updates its prompts and models over time to improve the quality, accuracy, and relevancy of AI-generated content.- Windmill does not use your data to directly improve its AI outputs Windmill uses your data only to respond to requests or issues reported by your company. It may use the themes and issues present in those cases to build anonymized evaluations to measure improvements.
- Access to AI logs is limited. When the team needs to look at a specific AI interaction, such as to investigate an issue you reported, the telemetry access controls apply. Only authorized personnel have access, and audit logs record each access.
- Improvements from your data follow the model training rules. Windmill removes identifying information first, and you can opt out at any time. Learn more about model training.