herbe assist · module
Privacy and anonymous mode
What an AI model sees of your data by default, what changes in anonymous mode, and what no mode can promise.
What the model sees
Three levels, from the default to anonymous mode.
Anonymous mode
Codes for names, real numbers for sums
Add a second connector at your herbe ID address followed by /mcp/anon. The apps replace the names, codes and registration numbers of customers, suppliers, contacts, employees, items and projects with codes such as CUST_P7Q2F. Amounts, quantities, dates, statuses and document numbers stay real, so the agent can still add, sort and rank.
- If you type a name yourself, the agent sees what you typed
- Apps are added to anonymous mode one by one; until an app is ready it shows no tools there
- You see codes and links
Each record comes with a link that opens the real one behind your own sign-in. Keep the link in the answer.
- Fewer tools
Only tools that can hide their data are offered. A raw database query is not.
- Your admin decides
Not offered, Person chooses or Always on. The address decides the mode, and a conversation cannot change it.
Said straight
Pseudonymised, not anonymous
herbe can map a code back to a record, so data protection law still applies, at lower risk. The AI provider does not see who is who. We say pseudonymised on purpose.
- A safety net on top
The basic filter for e-mail addresses, phone numbers and personal codes keeps running in anonymous mode.
- Other AI features are outside it
Portal message labels, service AI hints and assist's AI decisions send text to an AI provider by another route. Anonymous mode does not cover them.
- Little is kept
Logs and error reports never carry personal data. herbe ID records which tool was called, never the question or the answer.
In-app assistant
What the in-app assistant keeps
Conversations, messages and tool calls are kept for 90 days, confirmations for one year, AI decision records for 180 days and daily usage totals for two years. After 90 days the chat content is deleted and only the usage facts stay.
- A chat reaches herbe support only if you hand it over, and you can withdraw it any time
- Usage facts, such as counts, tokens and ratings, feed herbe's own dashboards
How to set it up
Pick the AI privacy mode
An organisation admin chooses Not offered, Person chooses or Always on in herbe ID.
Add the connector that fits
The plain one at /mcp, the anonymous one at /mcp/anon, each under its own name.
Keep the link in the answer
In anonymous mode, the link is how you open the real record.
Questions about privacy
Is anonymous mode really anonymous?
No. It pseudonymises: names become codes, but herbe can map them back. The AI provider does not see who is who, and data protection law still applies, at lower risk.
Do amounts stay real?
Yes. Amounts, quantities, dates, statuses and document numbers stay real, so the agent can still add, sort and rank.
What happens if my organisation sets Always on?
Then only the anonymous connector reaches its apps. The plain address leaves them out and tells the person which connector to add.
Which should I choose, plain or anonymous?
If customer and company names may go to the AI provider, the plain connector is simpler and gives the agent more tools. If they may not, use anonymous mode and accept fewer tools.
Does the plain connector hide anything?
Yes. E-mail addresses, phone numbers and personal identity codes become [removed] before the agent reads the answer. Customer and company names are not hidden there.