Automad does not use your data for training AI models or any other external processing. All AI features are optional and data is only sent to external services in case you use them. When using external AI services, the respective providers' terms of service and data policies apply.
AI Assistant
Requests to the configured AI provider are only sent when you submit a prompt using the AI Assistant. They are sent directly from your server to the API of the provider and contain the following data:
- Automad's built-in instructions together with your custom system instructions.
- Your prompt.
- The selected text or the selected blocks.
- The rendered content of all block fields that you are currently editing as context.
Other page data, like the title, the page settings or attached files, is not sent. Automad doesn't store your prompts or the generated responses. The only thing that is saved is the provider that you used last, so that it is preselected next time.
MCP Server
The MCP server doesn't send any data to external services on its own. Instead, MCP clients request data from your site. Note that the content that an agent reads is processed by the AI model that runs your client, so the terms of the provider of that client apply.
- Without authentication, any client can read the published content of your site, as long as the server is enabled.
- With an access token, a client can also read drafts and private pages as well as templates and snippets.
Stored Secrets
The API keys of AI providers and the hashes of MCP access tokens are stored on your server as PHP files in the config directory and are never sent to the browser. As an optional, additional layer of protection, those files can be encrypted with your own key. Learn more about encrypting secrets.