What Halo AI can see
The data policy for admins and IT. Halo AI reads as the person asking, with their row policies; raw rows are off by default, hidden fields are refused, and prompt logs go after 30 days.
Halo AI has no access of its own. When a member asks, everything it reads comes through read-only tools that run as that member, under their role, access and row policies. Two people asking the same question can get different answers, for the same reason they see different rows in a report.
What it reads
Halo AI's tools only look things up or propose a change for someone to apply. It can:
list the datasets the person can open;
read a dataset's fields and their descriptions;
run queries on a dataset, as the person, and get the results;
read the charts and reports the person can open;
read how the person's goals stand, and the changes insights flagged for them, as they'd read them. It doesn't read values typed into a goal, which can name segments a policy keeps from them;
for someone given a report or chart whose dataset they can't open, read what that page reads and nothing else in the dataset. See The page you're on;
search and read Halo's guides, these docs, which hold nothing of your organization's.
It also gets what a question brings with it: the page you're on (unless you remove it), text you selected, and unsaved chart changes when you press Explain. Every question includes today's date, your organization's calendar, and What Halo AI should know from Settings, Halo AI.
Halo AI runs on Claude, so to answer, Halo sends the question and what it read to Anthropic's API, on Halo's key or on your organization's own key. Everything runs on Halo's servers, never from a browser.
When nobody's asking
Four features run without a member asking. Each is a switch under Features in Settings, Halo AI. Catalog descriptions read no one's rows. The others read as the people they're for.
| Feature | What Halo AI reads |
|---|---|
| Catalog descriptions | The catalog's names and types, plus totals such as counts and ranges. Actual values only if Let Halo AI read individual rows is on |
| Insights and written summaries | An insight's figures and breakdowns are read as a member of the group of people its row policies treat alike, and only that group sees it. A member's summary comes from the rows in their own copy. A summary for outside addresses comes from what a public link shows, and goes out only if someone approves it. Both can mention goals falling short, as those people read them, leaving out any goal on a field hidden from Halo AI. Outside addresses hear of none |
| Alert explanations | The number an alert follows and what moved most, read as the person who made the alert. An alert on a field hidden from Halo AI gets none |
| Names | The conversation it's naming, which only its owner reads |
What it doesn't do
It doesn't change your data, or publish anything. The tools are read-only. Charts, formulas, SQL, goals and descriptions come back as proposals, and a person applies them. There are two exceptions: Generate with Halo and Rebuild with Halo on the Reports page save a draft, and insight and alert explanations and members' written summaries appear as written, with Markdown and links removed.
It doesn't reach anonymous readers or embeds. A signed-in member reading a public link can ask, as themselves. Anyone else on a public link or an embed can't ask it anything.
It doesn't take orders from your data. It's told to treat what it reads as data. If a value in a table tries to instruct Halo AI, it ignores that, carries on with the question and flags it for you to review.
Raw rows are off by default
Let Halo AI read individual rows in Settings, Halo AI sets how much it can read:
| Setting | A query returns | Paging |
|---|---|---|
| Off (default) | At most 200 rows | None, so it can't walk past the cap |
| On | Up to 1,000 rows at a time | Page by page |
With it off, Halo AI works mostly with aggregates: totals and averages grouped by a field. It can still group by any field it can see, including a customer name or an email address. So turning this off limits the amount it reads. It doesn't hide a field. To keep a field from Halo AI, hide it.
Hidden fields are refused
A field hidden in a dataset isn't listed for Halo AI, and a query that names it is refused. This goes for members' own AI tools too, through the Halo MCP server. A calculated field you've left visible can still use a hidden field in its formula, and Halo AI sees the result. See Fields.
Row policies apply
Each query Halo AI runs goes through the same planner as every other query, which adds the person's row policies. Halo AI can't ask for rows the person couldn't see, and there's no way to turn this off for Halo AI. See Row policies.
Conversations stop when access changes
A conversation replays what Halo AI read earlier in it, so Halo checks before every question. A conversation can't continue when:
it read a dataset, chart or report the person can no longer open;
the row policies its reads ran under have changed, or the person's role, groups or attributes those policies use have changed.
The person sees a message saying so, and starts a new conversation. Halo keeps a fingerprint of the policies each dataset read under, so this applies however the access changed. See When a conversation can't continue.
What's kept, and who can read it
| What | Kept | Who can read it |
|---|---|---|
| Conversations | Until the person deletes them; deleted ones go after 30 days | The person who had them. Not your Admins |
| Prompt logs: each call's request and response | 30 days, then purged nightly | Halo staff with the permission to read logs; each look is recorded in the audit log |
| Files uploaded to Rebuild with Halo | Until the job ends, or two days at most. They're never in prompt logs | Only their uploader can start a job with them |
| Use records: model, tokens, cost and credits, per call | Kept, as the record of usage | Owners and Admins see totals by feature, model and member |
| Flags: declined requests and limits reached | Listed until reviewed | Owners and Admins in Settings, Halo AI, and Halo staff |
Halo staff who view Halo Data as a member can't use Halo AI or read that member's conversations.
Under Members in Settings, Halo AI, Admins see To review: requests Halo AI declined and limits members reached. A flag names the member and the kind of request, with a short detail. Press Reviewed to clear one.
What Halo's staff can and can't change
Staff can turn a client's Halo AI, Deep, individual rows and AI tools off, but not on: those are your decisions. Changes to What Halo AI should know are audited as a change, never with the text.
Halo's own rules come first in every prompt, whatever a feature's settings say: Halo AI stays on your data and Halo, doesn't reveal its instructions, treats data as data, and can't claim to have changed anything.
Settings to review
Use Halo AI: on by default. Off stops Halo AI and members' AI tools at once. Conversations are kept.
Let Halo AI read individual rows: off by default.
Allow Deep mode: off by default.
Let members connect their own AI tools: off by default. What those tools read goes to their own AI provider. See The Halo MCP server.
Hidden fields and row policies on any dataset with sensitive columns.
The Use Halo AI permission on custom roles. See Roles and permissions.
Features: each Halo AI feature's switch. Off is off for everyone in the organization, and its buttons go away.