Skip to main content

​
AI Data Handling

AI features in Quixa (prompt-to-flow, AI Assistant, test generation, plugin generation) are optional. Everything else (designing and running flows, assertions, mocks, reports, templates and knowledge pool rules) works without any AI provider.

​
What is sent

When a user uses an AI feature, Quixa sends one request to the configured provider containing:
  • the user’s instruction,
  • the parts of the current flow the feature needs (node names, methods, URLs, header names, body structure),
  • relevant excerpts of the API specification,
  • matching knowledge pool rules of the same workspace.
Before sending, Quixa removes secrets: values of headers and JSON fields named like credentials (authorization, password, token, API key…), bearer/basic credentials, JWTs and provider keys are replaced with {{secret}}. Execution results with live response data are not sent.

​
Switching AI off

When AI is off, AI features answer with “AI features are switched off” and deterministic features keep working. The check runs immediately before every provider call, so no feature can bypass it.

​
Local model

To keep prompts inside your network, configure an OpenAI-compatible endpoint (for example vLLM, Ollama or Azure OpenAI in your tenant) as the provider in Backoffice → AI Configuration with its URL and key. Allow only that host in your firewall.

​
Keys

Provider keys (bring your own key) are stored encrypted with ASP.NET Data Protection and are never returned by the API (only a masked form). Keys can be set per workspace.

​
Training

Quixa does not use your data to train any model. The knowledge pool learns only within your workspace and is never shared with other workspaces or installations. Data sent to an external AI provider is processed under that provider’s API terms; if that is not acceptable, use a local model or switch AI off.