why we don’t see your prompts
If you’ve been around AI vendor sales pitches in the last twelve months, you’ve heard a lot about “responsible AI” and
“data privacy.” Most of it is marketing. Some of it is real. The honest version of the conversation is short: when a SaaS
company runs an AI feature, your data flows through their account with the AI provider. They see your prompts. They
see the responses. The provider sees both, too.
For a compliance tool used by finance teams, that’s a problem worth solving. So we did.
What BYOK actually means
BYOK stands for “bring your own key.” In our case, it means you give GlobalResolve your own Gemini API key
(Google’s generative AI service) instead of using ours. When you click “Generate guidance” on the Reports page, the
request goes to your Gemini account using your key. The prompt and response flow through your contract with
Google.
We don’t see it. We don’t log it. We don’t cache it on our infrastructure. The only thing that touches our servers is the
rendered text that comes back, briefly, on its way to your browser.
Why this is worth doing
Three reasons.
First, data residency. Some finance teams operate under contractual or regulatory requirements about where their
data is processed. With our shared key, that’s our problem to solve (which we do; our key is on Google’s standard
infrastructure in the US). With your own key, it’s your decision. You pick the Google Cloud region, the data residency
policy, and the contractual terms.
Second, rate limits. Our shared Gemini key has a daily request cap. Once we cross a certain number of paying
organizations all generating insights on the same key, we’ll start hitting that cap on busy days. With your own key,
your usage is bounded by your own Google Cloud quota, which you control.
Third, honest pricing. We charge for AI insights as part of our metered pricing model (5 per month free, 50 on Team,
300 on Business). If you’re a Business or Enterprise org generating hundreds of insights per month, you might prefer
to pay Google directly at their unit cost (currently around $0.0007 per Flash insight, $0.02 per Pro insight) rather than
pay us our markup. BYOK lets you do that.
What we don’t do
A few things to be clear about, because they get muddled in vendor pitches.
We do not store your AI key in a way that we can read it ourselves. The key is encrypted at rest in our database and
decrypted only inside the backend process that makes the Gemini call. No employee account on our side has a path
to “read all the keys in the database.” We don’t have a customer-key-rotation policy because we don’t operate the
keys.
We do not analyze your prompts to “improve our service.” This is a common pattern at large AI platforms: the
provider trains on user prompts unless the user explicitly opts out. With BYOK, we’re not the AI provider; Google is.
You configure Google’s policy directly. Last time we checked, Google’s Gemini API doesn’t train on API calls by
default. Your contract with Google is your reference.
We do not cache your AI responses on our servers beyond the immediate session. The Common Problems &
Prevention card caches its response in your browser’s localStorage for 24 hours (so reloading the same filter doesn’t
burn a fresh AI call). That cache lives on your device. Not ours.
The catch
Two of them, in the spirit of honest trade-offs.
First, BYOK requires a Google Cloud account with billing enabled. That’s a 10-minute setup for someone who hasn’t
done it before, but it’s a setup. We don’t hide that.
Second, BYOK is available on Business and Enterprise plans. The shared key (with our metered AI insight allowance) is
the default on Free and Team plans. If you’re on a smaller plan and you want BYOK, you’ll need to upgrade. We
thought about adding BYOK to all plans, but the support burden of helping every free-tier user configure Google
Cloud isn’t sustainable. Business-and-up is the line we drew.
How to set it up
Settings → Organization → AI Insights → “Bring your own Gemini key.” Paste your key, pick the model (Flash 2.5
default, Pro 2.5 optional), save. The next time you generate an AI insight, it routes through your key.
A small chip appears on every AI-generated output telling you which key answered (yours or ours). If you ever want
to revert, clear the key from settings and the shared key takes over again.
Closing thought
The phrase “respecting your data” is overused in AI marketing. We tried to make it mean something concrete here: a
configurable on / off switch that, when on, removes our infrastructure from the path your prompts take. It’s not the
only thing we do about data privacy, but it’s the one most worth writing about.
