Agent Trust Privacy & Data Handling
What Agent Trust processes, where each kind of agent data lives, retention, residency, and the controls you have over personal data in agent traces.
Overview
Agent Trust observes the AI agents you build or run on Snowflake and Databricks. Agent traces can contain anything your agents and their users say, so Agent Trust keeps trace content in your environment and gives you control over who reads it, how long it is kept, and where it is processed. For the architecture and access controls behind this, see Agent Trust Security.
What Agent Trust processes
| Data | Examples | Where it lives | Who can see it in Monte Carlo |
|---|---|---|---|
| Trace content | Prompts, completions, tool inputs and outputs, conversation transcripts, span attributes, LLM-judge rationale | Your environment: the Agent Trust data platform in your cloud account, or your Snowflake or Databricks account. Monte Carlo queries it on demand. | Users whose role grants agent-observability/content |
| Span metadata | Agent and span names, timing and latency, token counts, model names, status and errors | Monte Carlo cloud service | Users with access to Agent Observability |
| Evaluation scores | LLM-as-judge and SQL evaluation results for each trace or conversation | Monte Carlo receives the scores to power monitors and dashboards. For custom agents, LLM-as-judge scores are also written back to the data platform in your account. | Users with access to Agent Observability |
| Agent definitions | Code in a repository you connect, or a Snowflake Cortex agent's configuration, semantic views, Cortex Search services, and skills | Your repository or Snowflake account. Read by Reinforcement Loop when it diagnoses an issue. | Shown in Reinforcement Loop findings |
| Application data | Agent registrations, monitor and alert configuration | Monte Carlo cloud service | Per your roles in Monte Carlo |
Trace content is customer data. Monte Carlo doesn't train or fine-tune models, and doesn't use customer data, including agent traces, to train external models. See AI Security & Governance.
Personal data in agent traces
Traces can contain personal data when your users type it into a prompt or your agents retrieve it. You control how much of it reaches Agent Trust:
- What gets captured. Your instrumentation decides what lands on spans. Instrument only the agents you want observed, and keep sensitive fields off spans where you can.
- Who can read it. Deny
agent-observability/contentto users who need agent health but not conversations. See Managing access to Agent Observability content. - Snowflake redaction. Unless you grant
READ UNREDACTED AI OBSERVABILITY EVENTS TABLE, Snowflake redacts prompts and completions from Cortex Agent traces before Monte Carlo reads them. - Databricks AI/BI Genie. The collector captures every user's conversations in each Genie space you add. If Genie chat sharing is off in your workspace, it captures each turn's question and generated SQL but not the result sample or final answer. See AI/BI Genie.
- Retention. Traces are deleted when your retention period ends. See below.
Retention
| Where traces live | Retention |
|---|---|
| Agent Trust data platform | Set by clickhouse_ttl_days, default 30 days. It covers the trace tables and the conversation-derived annotation tables and is applied cluster-wide. See the Configuration reference for AWS, Azure, or GCP. |
| Snowflake Cortex agents | Governed by Snowflake, where Cortex Agents log their traces. |
| Databricks agents | Your retention for the Unity Catalog trace table, including the genie_traces table the Genie collector creates. |
Residency
- Trace content stays in the cloud region where you deploy the data platform, or in your Snowflake or Databricks region.
- Evaluations for custom agents call your cloud's LLM service from inside your account. On AWS, the Bedrock region defaults to your deployment region and is configurable.
- Span metadata, evaluation scores, and application data are processed in the region where your Monte Carlo instance is hosted. See Hosting & Architecture Options.
Subprocessors and AI providers
For custom agents, evaluations run inside your cloud account against your own LLM service: Amazon Bedrock, Microsoft Foundry, or Vertex AI. Those calls are made under your agreement with your cloud provider, and Monte Carlo doesn't send trace content to its own AI providers to be evaluated. Monte Carlo-side processing uses the providers listed on the Subprocessors page.
Data isolation
Each customer's Agent Trust data platform is a separate deployment in that customer's own cloud account. On the Monte Carlo side, agent metadata and scores are isolated between customers like all other customer data, as described in Infrastructure Security.
Related
Updated about 8 hours ago