AI features allow you to generate, rewrite, and improve text directly within text blocks in Engage Home and Pages.
Bring Your Own AI (BYO-AI)
Tresorit does not provide or resell AI models. To use AI features, you must connect your own AI provider account.
Your provider's terms, pricing, data retention policies, and model availability apply to all AI actions. Usage is billed directly by your provider to your account.
Technical & security considerations
Tresorit has no server in the AI request path: client devices send requests directly to your provider endpoint, meaning Tresorit never processes, logs, or stores your prompts and responses. As a result, enabling this feature carries the following key considerations:
- The key is shared and extractable: Authorized users can extract the API key via network traffic or browser developer tools and call your provider directly, bypassing the app and its interface. If enabled for non-subscription users, this includes individuals outside your organization.
- Removing a user does not revoke the key: Removing someone in Tresorit does not invalidate an API key they have already accessed. The key remains active until you rotate it directly at your provider.
- No per-user attribution: Because Tresorit does not send user identities with API requests, all activity appears under your shared provider credential. Requests cannot be attributed to specific users within your organization in your provider's usage logs.
Data privacy & execution
Access limits are enforced at the client application level and cannot be widened or extended under any circumstance:
- When a user explicitly triggers an AI action, the app sends the full text of the active page being edited along with the specific instruction for the requested action.
- The AI integration has no access to:
- Files, attachments, or media
- Workspace users, groups, permissions, or profile data
- Other pages or content outside the selected block
- Any other part of your Engage environment
- Data is sent to your AI provider exclusively when a user triggers an action. There is no background crawling, indexing, scheduled analysis, pre-generation, or automated content processing.
Security best practices
To control off-app usage, mitigate key exposure risks, and protect sensitive data:
- Use dedicated credentials: Create a dedicated project, workspace, or resource key specifically for Engage. Never reuse keys across systems, as exposure in one environment compromises all connected systems.
- Keep the model blank: Ensure your connected provider account contains no custom instructions, stored memory, uploaded files, or attached context. Anyone with access to the AI connection – including authorized users or external parties – can retrieve information stored within the model environment.
- Set usage caps and quotas: Configure strict rate and spend limits directly in your provider's console. This is the only way to bound costs from potential off-app key usage.
- Monitor usage dashboards: Periodically check your provider's dashboard. Unrecognized request volume is the primary indicator of off-app API key usage.
-
Establish key rotation schedules: Rotate your API key periodically (e.g. every 90 days) and immediately when:
- A user with AI access leaves your organization or has their access revoked.
- You disable AI for non-subscription users or narrow access permissions.
- Provider usage looks unexpected.
- Enable Advanced Control: Advanced Control signs your connection settings so the app can verify their authenticity. Without signing, an attacker on an untrusted network could replace your endpoint with a malicious one, capturing both your API key and all text prompts sent by your users.
Configuration requirements
End-user subscriptions (such as ChatGPT Plus, Claude Pro, or Microsoft 365 Copilot) do not issue API credentials. You must use a dedicated API platform account.
To configure a connection, obtain three items from your AI provider:
| Endpoint / Base URL | The destination address for API requests. |
| API key | Credentials for authentication and billing. |
| Model | The exact model ID (or Azure deployment name). |
ℹ️ Copy your API key immediately upon creation. Most providers display the full key only once. If lost, delete the key and generate a new one.
Example providers
ℹ️ Console layouts change over time. Use the locations below as a general guide.
- OpenAI
- Anthropic
- Microsoft Azure OpenAI
- Google Gemini
Endpoint: https://api.openai.com/v1
API key: OpenAI Platform → Settings → API Keys
Model: Model ID from OpenAI documentation
Note: Scope the key to a project rather than a user, and restrict its permissions to what the app needs.
Endpoint: https://api.anthropic.com/v1
API key: Claude Console → Settings → API keys
Model: Model ID from Anthropic documentation
Note: Use workspaces to separate keys and spending per use case.
Endpoint: Resource hostname (e.g. https://<your-resource>.openai.azure.com/openai/v1/)
API key: Azure Portal / Azure AI Foundry → Resource → Keys and Endpoint
Model: Deployment name
Note: The key must belong to the same Azure resource as the endpoint.
Endpoint: https://generativelanguage.googleapis.com/v1beta
API key: Google AI Studio → Get API key
Model: Gemini model ID
Note: Restrict the key to the Generative Language API in Google Cloud Console and set quota limits.
Setup in Tresorit
- Go to AI in Engage in your Admin Center.
- Turn on the feature, then select Set up connection.
- Enter your Endpoint, API key, and Model.
- Tresorit runs an automated connection test. Once verified, connection settings are saved and greyed out.
ℹ️ To extend AI access beyond subscription members, toggle Allow non-subscription users to use AI in Engage.
AI connection thumbprint
Select Show thumbprint to view your public connection code. Users can compare their local thumbprint with yours to confirm the connection is genuine. If the codes do not match, the connection may be intercepted, and users should stop using AI features immediately.