## Key Takeaways

- **An AI employee sees less than people assume.** Viktor only reads channels he is explicitly added to, threads he is mentioned in, and DMs sent to him. Conversations between other team members are invisible to him.
- **Credentials are the strictest category.** API keys and OAuth tokens sit in an encrypted vault, and a backend gateway hands them to tools at the moment a task runs. The AI model itself never holds them.
- **Your data does not train models.** No conversation or file ever becomes training data, and the named model providers operate under no-training agreements for Viktor traffic.
- **You know where the servers are.** Data is hosted on AWS in the US by default, with EU data residency available on Enterprise contracts, and every workspace runs isolated from every other tenant.
- **Deletion is self-serve for most of it.** Admins delete conversations, skill memory, and files from the admin panel. Full account deletion is one email and completes within 7 business days.

## The question behind the question

An operations manager gets the green light to roll out an AI employee, and the first message from her CTO is not about features. It is: "before this touches our Slack, I want to know exactly what it stores, where, and how we get it back out." That is the right first question, and it deserves a concrete answer rather than a compliance-page shrug.

This post is the plain-English data map for Viktor: what he can see, what actually gets stored, where it physically lives, who can access it, and what deletion really means. Every claim here matches what is published on the live security page at viktor.com/security, so your reviewer can verify each line independently.

![The data map: what stays in your tools, what is stored in your workspace, and what sits in the credentials vault](/images/blog/where-your-data-lives-with-an-ai-employee/data-map.webp)

## What can he see in the first place?

Scope comes before storage, because the data an AI employee never sees is data you never have to worry about.

Viktor reads three things: channels he has been explicitly added to, threads where someone mentions him, and direct messages sent to him. He cannot read conversations between other team members, and he does not sit inside channels nobody invited him to. Membership is the permission system, which means your existing channel structure already expresses your data boundaries. If the #finance channel is private and Viktor is not in it, its contents do not exist for him. The mechanics of scoping him tightly are covered in [how to control where your AI employee works](https://viktor.com/blog/how-to-control-where-your-ai-employee-works).

The same explicitness applies to tools. Connecting an integration is an admin decision per tool, with OAuth scopes kept as narrow as the job allows, and access to something like a codebase only exists when you connect it and authorize it. Admins decide [what he can access](https://viktor.com/blog/how-to-control-what-your-ai-employee-can-access), and can revoke any integration in one click.

## The data map: what is stored, where, and who sees it

| Data | Where it lives | Who can see it | How it leaves |
| --- | --- | --- | --- |
| Conversations with Viktor | Encrypted at rest (AES-256) in your workspace's own environment | Your workspace members in the relevant channels; no other tenant | Admin deletes self-serve from the admin panel |
| Files you share or he produces | Encrypted at rest in your workspace's storage | Your workspace, per your channel structure | Admin deletes self-serve from the admin panel |
| Skill memory (what he has learned) | Scoped to your workspace, encrypted at rest | Your workspace only; never other customers | Exportable and deletable on request |
| Connected-tool data (HubSpot records, Google Drive files) | Stays in the source tool; accessed via the connection when a task needs it | Governed by the OAuth scopes you granted | Disconnect the integration in one click |
| API keys and OAuth tokens | Dedicated encrypted vault, access-logged and rotatable | Not even the AI model; the gateway supplies them only at task runtime | Revoke or rotate at any time |

Two rows deserve emphasis. First, connected-tool data: connecting your CRM does not copy your CRM into the AI. The records stay in HubSpot; the connection is a scoped line Viktor uses when a task requires it, and disconnecting severs it instantly. Second, credentials: the model works with tools through a gateway that holds the secrets, so your keys never appear in the model's context, its planning, or its logs. That is architecture, not policy, and it is the line worth quoting to your security reviewer.

## Does any of it train a model?

No. Nothing your team says to Viktor and nothing he produces for you is ever used as training data, by Viktor or by the model providers. Inference runs on OpenAI, Anthropic, and Google, each on the public sub-processor list with a no-training agreement covering Viktor traffic. If a vendor answer to this question is ever vague, treat that as a finding; here it is contractual and published.

Skill memory deserves its own sentence because it sounds like training and is not. When Viktor learns that your team reports net revenue excluding services invoices, that becomes stored, workspace-scoped memory: encrypted, invisible to every other customer, exportable, and deletable. No model weights change. Unlearning is deletion, not retraining.

## Where the servers are, and who your neighbors are not

Hosting is on AWS in the US (us-east-1) by default. EU data residency is available on Enterprise contracts, which matters if your DPA or your customers require data to stay in the region.

Isolation is per workspace: every workspace runs in its own sandboxed environment, with no path to another tenant's data at either the infrastructure or the application layer. What Viktor learns, connects, and remembers in your workspace stays sealed inside it, so nothing from your company informs anyone else's. Everything moves over TLS 1.2+ in transit and sits under AES-256 at rest.

For the paperwork your reviewer will ask about: SOC 2 Type 1 is certified with Type II in progress, GDPR alignment comes with a DPA available on request, CCPA is covered, CASA Tier 3 is certified, and ISO 27001 is in progress. The full document pack, including the sub-processor list and security architecture overview, is available under NDA via security@viktor.com. If you are running a formal vendor review, [how to run security due diligence on an AI employee](https://viktor.com/blog/how-to-run-security-due-diligence-on-an-ai-employee) turns this into a question list.

## How deletion actually works

Deletion promises are where data pages usually go quiet, so here is the concrete version.

Day to day, workspace admins delete conversations, skill memory, and files themselves, directly from the admin panel. No ticket, no waiting on support. That covers the common cases: a channel that discussed something sensitive, a learned behavior you want reset, files that should not persist.

Offboarding entirely is one email to support@viktor.com requesting full account deletion, completed within 7 business days. Combined with self-serve export of skill memory, the exit path is: export what you want to keep, disconnect integrations (one click each), send the deletion email. Your data in connected tools was never copied out of them, so there is nothing to claw back from the AI side.

It is worth asking any vendor, this one included, to walk you through that sequence before you sign anything. A vendor who cannot describe their own offboarding crisply is telling you something.

## The audit you can run this afternoon

You do not have to take the map on faith. Ask your AI employee to show you his own footprint:

```prompt
@Viktor list every integration currently connected in this workspace,
who connected each one, and what access level it has (read or write).
Then list the channels you are a member of. Post it here so we can
prune anything we no longer use.
```

Ten minutes later you have a live access inventory to compare against what you intended. Most teams find at least one integration nobody remembers connecting and at least one channel he no longer needs. Prune both, put the audit on a monthly schedule, and your data surface stays as small as your actual workload requires.

## Frequently Asked Questions

### Where is my data stored when I use an AI employee?

Viktor hosts data on AWS in the US (us-east-1) by default, with EU data residency available on Enterprise contracts. Everything is encrypted with TLS 1.2+ in transit and AES-256 at rest, and each workspace runs in its own sandboxed environment with no cross-tenant access.

### Can the AI read all of our Slack messages?

No. Viktor only sees channels he has been explicitly added to, threads he is mentioned in, and direct messages sent to him. Conversations between other team members are not visible to him, so your existing channel membership already defines his boundaries.

### Is our company data used to train AI models?

No. Nothing from your workspace becomes training data, for Viktor or for the model providers. Inference runs on OpenAI, Anthropic, and Google under no-training agreements, and all three appear on the public sub-processor list.

### How do we delete our data if we leave?

Admins delete conversations, skill memory, and files self-serve from the admin panel at any time. Full account deletion is a single email to support@viktor.com and completes within 7 business days. Skill memory is also exportable first, so you can keep what the team learned.

### Does connecting a tool copy that tool's data into the AI?

No. Connected-tool data stays in the source system, and Viktor accesses it through the scoped connection only when a task requires it. Disconnecting the integration, which an admin can do in one click, severs that access immediately with nothing to claw back.

### Can the AI see our API keys and passwords?

No. Keys and tokens are stored in a dedicated encrypted vault, access-logged and rotatable, and the backend gateway supplies them to tools only at the moment a task runs. Your secrets never appear in the model's context, planning, or logs.

---

**Viktor is an AI employee that lives in Slack, connects to 3,200+ integrations, and does real work for your team.** [Add Viktor to your workspace -- free to start →](https://viktor.com/?utm_source=blog&utm_medium=cta&utm_campaign=where-your-data-lives-with-an-ai-employee)