Company controls
PII means personally identifiable information, such as an identity number or bank account details. Redaction replaces recognised sensitive information before it is used by supported AI features. It reduces exposure, but does not make all data anonymous.
Before using chat with company information
- Ask for the record through an available tool instead of pasting an entire personnel file.
- Include only the details needed for the question. Keep passwords, access keys and unnecessary personal information out of the conversation.
- If you administer AI Settings, review redaction and enabled features before staff use them.
- Treat AI audit access as sensitive access, even when redaction is enabled.
AI Settings controls company enablement, enabled features, provider/model, token budget and PII redaction. New settings default to AI off and redaction on. Viewing settings and AI audit records requires view_ai; updating settings requires manage_ai, except the token budget: your company admins set it when your own API key runs your AI, and Arche sets it when Arche's key does. Chat separately requires use_ai_chat and the AI module licence.
The chat pipeline checks enabled settings and recorded monthly usage before its provider call. These checks describe in-app chat; the public website assistant has its own platform settings and does not expose tenant tools.
What redaction does
With company redaction enabled, ordinary chat scans the message, text history and attachment text using the configured field list. Free text is checked by two detectors: the built-in patterns below, and Google Cloud Sensitive Data Protection, which adds context-based detection of names and street addresses when a company includes the person_name and address categories in its field list. If the cloud detector is unavailable the built-in patterns still apply. Structured tool results also pass through field-name and text-pattern checks before being returned to the model. Identity and bank fields, the position recorded when someone clocked in or out, and the network address on a time entry or an audit record, are withheld from tool results before any of this runs.
The default field list is:
ssn, bank_account, id_number, tax_id
Supported text categories also include credit_card, phone, email and date_of_birth. The salary pattern is not in the list because it is always on: see Pay amounts below. These are pattern names, not a guarantee of complete detection:
| Category | Examples of detected patterns |
|---|---|
| ssn | Dashed US SSN shape |
| bank_account | An 8–17 digit number following a label such as account, acct, acc or a/c |
| tax_id | EIN shape or an A/P-prefixed Kenyan KRA PIN shape, including a PIN typed with spaces or dashes after a "PIN" label |
| id_number | Passport-style codes and labelled national/statutory identifiers. Also a 7-8 digit number after a bare "ID" or "ID No." label at the start of a line, after a comma, semicolon, bracket, "!" or "?", or after a word such as "her", "his", "my", "the" or "applicant". An ID straight after a full stop or a colon is not masked. Labels such as "Emp ID" or "Payslip ID" are left alone, because record ids stay visible |
| salary | Dollar-prefixed amounts, comma-grouped numbers of 10,000 or more (million-scale amounts are masked whole), amounts of five or more digits straight after a currency code such as KES or Ksh, and amounts immediately following explicit pay labels such as Basic salary or Net pay (always on in chat text while redaction is on) |
| credit_card | Certain grouped 15–16 digit shapes |
| phone | US-style or Kenyan mobile formats |
| Email-address pattern | |
| date_of_birth | A date written as numbers or with a month name, after a label such as DOB, D.O.B., date of birth, birth date or born |
Matches become placeholders such as [SSN REDACTED]. Unknown category names have no text detection rule. Unlabelled numbers, unusual formats, names and free-text addresses may remain; avoid supplying unnecessary sensitive information.
Structured redaction additionally masks known sensitive scalar field names, including identity numbers, bank/M-Pesa details, dates of birth and individual pay amounts.
Pay amounts
Pay amounts never reach the AI provider, whatever the redaction settings say. This is not a setting. The assistant sees no pay amounts from payroll, payslips, salary advances, compensation, employee records or payroll reports. It sees which lines a payslip has (Basic Salary, PAYE, NSSF, SHIF, Housing Levy), their dates and status, but every amount is replaced with [SALARY REDACTED]. That includes line items, statutory deductions and tax bands, because those give the gross pay back by arithmetic. The assistant can explain what each line means; it cannot quote or work out the figures.
Pay redaction does not apply to your own screen. The result card in the chat shows the real figures from the tool, the same figures the payslip page shows you under the same permission. Redaction applies to what is sent to the AI provider. Identity and bank fields, clock-in and clock-out positions and network addresses stay withheld everywhere, including the card. People who hold audit-log access still see network addresses on the Audit Log page.
A total stays visible to the assistant only when it states how many employees it covers and that number is two or more, such as a pay run's totals or a payroll report row that includes an employee count. A total that covers one employee is that person's pay and is masked. Totals that do not state a head count, such as the monthly payroll cost trend and statutory return totals, are masked too. A generated bank file is never sent to the provider; the assistant only learns that a file was made and how many lines it has.
Amounts you type into the chat are masked by the salary pattern while redaction is on. An earlier assistant answer that quoted pay is masked before it is sent back to the provider, with redaction on or off.
UUID record identifiers are preserved so follow-up tools can address the record. Dates remain usable timestamps. Preserving an identifier is not anonymisation: an identifier linked to a person can still be personal data.
Different feature paths
Files in chat
File uploads default to off. An administrator with manage_ai can enable them in AI Settings
after reviewing the provider disclosure. PII protection must stay on. Chat accepts PDF, Word
(.docx), Excel (.xlsx), CSV and text files, up to three per message. Photos, scanned PDFs and
old Excel (.xls) files cannot be read yet.
The file chip says how much Arche read and which private details it hid. Only that checked text is sent to your AI provider. Names are hidden only when Person name is selected and the name detector is available. Files stay with the chat for 90 days; unsent uploads expire after 24 hours. You can open your original through the authenticated chat download. Your company's administrators can include originals in a full company export.
Earlier files may be withheld when uploads are switched off, their content expires, or privacy settings become stricter. Attach the file again when the assistant needs it. The AI audit keeps file names and read counts, not file contents.
- Document ingestion applies a fixed identifier-pattern scrub before chunking and embedding, independently of the chat redaction toggle. It is still pattern-based.
- Knowledge Base documents are shown only to the group chosen for each one: everyone who can use the AI Assistant, or people who hold one permission, such as seeing payroll. Published HR policies follow access to the HR policies page. This holds for chat answers and for the test search.
- Public website chat applies a fixed redaction list and uses product metadata, not authenticated tenant records.
- The pay run anomaly check is not an AI feature. The payroll engine runs fixed checks on the pay run page: pay changes against the last completed run, new or returning employees, overtime, missing NSSF, SHIF or Housing Levy, dropped deductions, PAYE shifts, large new earnings, and two people paid to one bank account or M-Pesa number. When the assistant runs the same check, it gets the findings with every figure masked.
Company redaction can be disabled. That changes which raw inputs reach the provider and can be recorded. Pay amounts in tool results stay masked either way. Provider keys configured through the settings services are encrypted and masked on read; company credentials can fall back to platform keys.
Audit records
AI audit records include feature, provider/model, prompt and response information, token counts, latency, status and detected redaction categories. The status enum includes success, error, rate_limited, budget_exceeded and pii_blocked; an enum value does not imply every rejection path produces a row.
A streamed chat reply that ends early, because the user pressed Stop, closed the page or lost the connection, or because the provider failed part-way, is still recorded. Its status is error and it stores no response text; an abandoned reply is also marked aborted in the metadata. Its token counts include an estimate for any part the provider had not yet reported, and such a row is marked usageEstimated. The same holds for a non-streamed reply, and for research the assistant delegates to a specialist, when the provider fails after some of its steps have run: the error row counts the steps already charged.
The logged prompt is not a complete provider transcript. Ordinary successful chat logs the processed user message, while the budget-exceeded branch records no message text at all: it stores the fixed string "[Request rejected: monthly token budget exceeded]". Responses and analytical data can also be sensitive. Audit access must therefore be treated as access to sensitive records, even when the company's redaction toggle is on.
Actions and access
Why can a name or number still appear? Redaction recognises particular formats and field names. A name, an unusual number format or text outside those fields may remain. Do not interpret an unmasked result as approval to share it more widely.
Does turning off Tools remove company documents? No. Chat can still receive retrieved policy excerpts. The Tools switch controls live tool calls, not every source of context.
Tools execute with caller permissions and tenant context. General writes use agentic mode. Writes on your own records (the self-service tools, such as a leave request) work without it, and each one waits for your approval every time.
See Using the AI Assistant for controls and Security Overview for authentication, encryption and audit boundaries.