Admin tab: Trusted targets (PII egress)

Admin

The PII shield replaces personal data with placeholders before sending — by default every external target sees [NAME_1], not Max Mustermann. That is CompanyWizard’s hard trust boundary.

Trusted targets open that boundary deliberately, per target: a target marked as trusted receives the original values. This is an intentional, security-relevant PII egress — and the only place where pseudonymization can be lifted selectively.

The default: nothing changes

Every target starts untrusted. Existing installations behave exactly as before after an update — no target receives re-identified values until someone ticks a box. There is no master switch: trust is granted individually, per target.

One exception up front: the knowledge-base indexing run sends document text to the embedding provider in the original by default — without any checkbox. Only PII pseudonymization for embeddings changes that. So “no checkbox” does not mean “nothing leaves in clear text”.

The three target types

The checkbox lives in each target’s own editor — in the MCP, Tools and Models tabs.

Target type	Where	Effect when enabled
MCP server	Administration → MCP servers → server editor	Tool arguments sent to this server are re-identified
Configured tool	Administration → Configured tools → tool editor	Call arguments sent to the tool’s target are re-identified
Model provider	Administration → Models → provider editor	Only on the active embedding provider’s row: vector search embeds the original query text; with scrub before embed enabled, indexing also embeds the original document text

MCP servers

The server editor (External tools (MCP)) offers the checkbox “Trusted server — receives original PII values”. Take the warning next to it literally:

PII egress: tool calls to this server are re-identified — detected personal data (names, e-mail addresses, …) is sent to the server in clear text. Enable only for servers on trusted, ideally on-premises infrastructure. Paired clients inherit this decision at first-time setup: the server row travels in the pairing bundle. A later refresh leaves a checkbox set on the client untouched — a client reaches the same server from a different network position and decides for itself.

In the server list, marked servers carry the “PII trusted” badge — so it is visible at a glance which server gets clear text. Servers that are not marked continue to receive placeholders only.

Configured tools

In the tool editor (Configured tools) the checkbox reads “Trusted target — receives original PII values”. It applies uniformly across all tool kinds — SQL, mailbox, directory, calendar, contacts and HTTP API — and both in chat and in agents.

Model providers — only the active embedding provider

In the provider editor (AI models / providers) the checkbox reads “Trusted embedding provider — receives original PII values”. It takes effect only while this row is the active embedding provider — the row whose model is set as the default embedding model (System settings).

On every other provider row the checkbox has no effect — including a chat-only, OCR or image provider. For connections (Confluence, X articles) the editor does not show it at all: a connection carries no models and can never become the embedding provider.

For the active embedding provider the checkbox acts on two legs with different conditions:

Leg	Condition	Effect when ticked
Query — knowledge-base vector search	always	The search query is embedded in the original instead of pseudonymized. Benefit: real names match real names instead of placeholders matching placeholders.
Index — embedding the documents	only while scrub before embed is enabled	Indexing embeds the original document text instead of type-only placeholders.

Without scrub before embed, indexing sends original text for every provider anyway — on that leg the checkbox then changes nothing.

Not affected are chat prompt, RAG context, reranking, OCR and image generation. Those paths stay pseudonymized, whichever row carries the checkbox.

Warning — toggling can rebuild the vector index. While scrub before embed is enabled, ticking or clearing the checkbox changes what gets embedded. CompanyWizard treats that like a model change: the vector index is wiped completely and rebuilt. On large knowledge bases this takes hours — don’t toggle just to try it out.

Paired clients inherit the decision. The provider row travels in the pairing bundle and overwrites the client’s value on the next refresh. A checkbox ticked on the server therefore lets clear text go to this provider from every paired desktop as well. → Export, import and pairing

No provider row: embeddings via configuration. If embeddings do not run through a model created under Models but through the configuration (Embeddings:*), there is no row and therefore no checkbox. The “Presidio (PII Detection)” section of the system settings then shows “Embedding configuration (Embeddings:*) is trusted (local/on-prem)” instead. This switch applies only while that holds — as soon as a provider row with an embedding model is active, its own checkbox decides alone. Here too, toggling while scrub before embed is enabled triggers the rebuild; the page asks first.

The former global switch no longer exists. “Embedding provider is trusted (local/on-prem)” has been removed; there is no second source that releases clear text next to the checkbox. If it was set before the update, the value was carried over once — onto the active embedding provider’s row, or into the configuration switch. If an older system-settings export still carries the old switch, the import ignores it and reports a warning.

PII exemption vs. PII trusted — don’t mix them up

Two switches, two directions. This is the most common confusion:

	PII exemption (exempt)	PII trusted (trusted)
Direction	inbound — from the target back to the model	outbound — from CompanyWizard to the target
What happens	the tool’s results stay unredacted instead of being pseudonymized	the call’s arguments are re-identified before being sent
Example	the SQL query returns real customer names to the model	the tool call searches for `Max Mustermann` instead of `[NAME_1]`

The two are independent and can be set separately. A tool may receive original arguments while its results still pass through the shield — and vice versa. → PII exemption for SQL data sources

Audit list: who gets clear text?

The “Presidio (PII Detection)” section of the system settings lists all trusted targets read-only under “Trusted targets (PII egress)” — each entry with its kind (MCP server, Tool or Embedding provider) and name. If embeddings run via the configuration and that is marked trusted, an embedding-provider entry “Embedding configuration (Embeddings:*, no provider row)” appears there:

These targets receive original PII values instead of pseudonym placeholders. Configure per target on the MCP, Tools and Models tabs.

If nothing is marked, it reads: “No trusted targets configured — every external target receives placeholders only.”

The list is the audit checkpoint: one place that fully answers “where does clear-text PII flow in our installation?”. Trust is still granted in the respective tab — the list only displays it.

When is “trusted” defensible?

The rule of thumb from the UI warning: only for trusted, ideally on-premises infrastructure. The question is not “do I trust the vendor?” but “do the data leave my area of responsibility?”.

Defensible:

On-premises MCP servers on your own network, under your own control
A local embedding model (e.g. Ollama/LM Studio) — the data never leave the machine anyway → Keeping data local
An internal company HTTP API or database that already holds the data

Not defensible — when in doubt, leave it off:

Any third-party cloud service, however reputable
Targets outside the EU or without a solid legal basis → GDPR & DPA
Targets whose logging/retention you don’t know — clear-text PII in someone else’s logs is a data leak, even without bad intent

A target is not a category. Trust applies to this specific server, this specific tool. A second MCP server from the same vendor starts untrusted again — by design.

Export, import and pairing

What happens to a checkbox depends on the route:

Route	Provider row	MCP server
JSON export (Models or MCP tab)	checkbox not included	checkbox not included
Import, new row	starts untrusted	starts untrusted
Import with “overwrite” of an existing row	previous checkbox stays	previous checkbox stays
Pairing and every later refresh (Connections)	server’s value — overwrites the client’s value	a new server row adopts the server’s value; an existing one keeps its checkbox

Configured tools travel neither in an export nor in pairing — you tick their checkbox on each station yourself. The configuration switch for embeddings (see above) is not transferred either.

Why providers and MCP servers are treated differently:

Providers: the server decides. Which embedding provider receives clear text is organisation policy. A paired client follows it; a diverging value on a row taken over from the server is overwritten on the next refresh. If a client genuinely needs to decide differently, create a separate provider row there.
MCP servers: the client has a say. Trust in an MCP server is a statement about network position — a roaming desktop may reach the same server over a very different route than the server inside the company network.

After an import or pairing: check the audit list. New rows start untrusted, overwritten rows keep their previous state, and provider rows taken over from the server carry its decision — any of the three can come as a surprise.

Limits & notes

Admin-only. Users see no difference — apart from better tool matches.
Trust is not encryption. A trusted target receives clear text; what happens there (logs, backups, onward transfer) is outside CompanyWizard’s control.
Detection remains pattern recognition. Trusted/untrusted does not change what is detected as PII. → Limits of the PII shield
When in doubt, off. Untrusted costs you match quality at worst; trusted may cost you personal data.

The PII shield · Keeping data local
PII pseudonymization for embeddings (scrub before embed) — the checkbox on the active embedding provider lifts this protection
External tools (MCP) · Configured tools · AI models / providers
System settings · GDPR & DPA