You control what AI does with your data.

Performance Hub provides prepaid access to hundreds of AI models through one endpoint, one balance, and one set of limits. Every request passes through a governed pipeline:

1. Authentication against your facility's key.
2. A prepaid credit and budget check.
3. Spend and rate limits (per facility, per key, per agent).
4. Guardrails, including PII masking, secret redaction and a prompt-injection shield.
5. Routing to an appropriate model.
6. Inference and metering.

The result is that AI usage is attributable, budgeted and bounded, not an open pipe.

The same router can also route to on-premise inference for enterprise deployments, including configured Station-class and Rack-scale inference, so requests can be served on your own hardware rather than a public endpoint. Detail is in the private-inference section below.

Your facility's administrators control which models are enabled for the agent, and can apply tighter per-agent restrictions to individual agents. Model selection, routing and usage are under your control, not decided silently by us.

This matters in practice: if your organisation's policy is to use only the model providers whose API agreements give you the level of protection you require, you can restrict routing to exactly those providers and disable the rest. That control is a first-class feature of the platform.

• The content the agent sends a provider is for processing your request only.
• It is metered and governed by your facility's AI Models & Access account.
• Performance Hub does not use your prompts or responses to train any models.
• When we call a third-party model on your behalf, we opt out of provider training wherever the provider offers that control, and we send requests through API and enterprise channels that are not used to train the provider's models by default.
• Prompt and response content is never stored by the router; request logging records operational metadata (which model, token usage, cost, latency, status), not the content.

Router guardrails such as secret redaction help reduce accidental leakage of secrets in prompts sent through the Model Router. That is distinct from secrets, credentials or other confidential material your organisation places on an AI Agent - including in scripts, skills or workspace files. Those remain under your control. Performance Hub encrypts and securely stores agent backups; exposure introduced by customer-configured agent behaviour is your responsibility. See Shared responsibility.

For information too sensitive to leave your facility or an approved private environment, the appropriate mitigation is private inference. Performance Hub can support a private inference path through the router, with the model hosted within your environment or an approved private cloud, rather than a shared public endpoint. In that configuration, your prompts do not leave your environment to be processed.

Performance Hub also offers a managed on-premise inference option: a cluster of inference nodes running open-weight models inside your building, so even the model compute stays within your four walls.

This means you can have the benefit of an AI worker while keeping even your most sensitive material inside your own environment.

• Metering and visibility. Model usage against your facility's key is metered, so you can see spend and usage at any time.
• Content guardrails. A content-policy and prompt-injection shield screens requests; violations are rejected.
• Attribution. Interactive actions carry the signed-in user's identity. Agent-initiated (agentic) requests are attributed to the agent itself, so activity that an agent runs on its own is traceable in the logs back to that agent rather than to an interactive user.
• Agent access via a service account. An agent reaches Performance Hub APIs over MCP using a service-account access configured on the agent device, separate from any individual user's roles - so its access is stable when a user is changed or removed. Per-user MCP access, tied to a personal account, is also available for connecting third-party agents such as Claude or Cursor. The mechanics are on Integrations, partners & data sharing.
• Human-confirmed actions. Where the agent can take actions that change data, it confirms significant actions in conversation before taking them.
• Attenuated control. No one can grant the agent more scope than they themselves hold.