Security and AI
Where your data goes and what the AI can do.
This page is for your IT office. It tells where Geotastic keeps your data, how long it keeps it, what the AI model receives and how AI-written code runs.
Where your data goes
Your organization
ArcGIS
ArcGIS Online, ArcGIS Location Platform or ArcGIS Enterprise. Your layers stay here.
Layers that the person can see, under their own sign-in
AWS us-east-2, Ohio, USA
Geotastic server
- ArcGIS tokens
- A copy of each layer, for one question
- The sandbox that runs the AI-written code
- The answers
The question, each dataset's description, column names and types, one sample value for each column, and what the program prints
The plan and the Python code
The brains of the operation
AI model
An LLM that has an OpenAI-compatible API.
Not sent to the AI model: your layer files, ArcGIS tokens and passwords. What the program prints can contain values from your data, such as the figures in the answer.
Sign-in and access
- People sign in on your organization's own ArcGIS page, through OAuth 2.0 with PKCE. Geotastic never sees ArcGIS passwords.
- Your single sign-on and multi-factor rules apply, because ArcGIS does the sign-in.
- Nobody can use Geotastic until an administrator approves the account.
- Each person sees only their own data, questions and servers.
- Tokens stay on the Geotastic server. Geotastic sends them to ArcGIS only in the body of POST requests. When a person signs out of their last session, Geotastic deletes their tokens and revokes them at ArcGIS.
- Servers of other organizations give public layers only and never get your token.
- Geotastic can also use Google sign-in. It stays off until an administrator turns it on. People who sign in with Google see public ArcGIS layers only.
How long Geotastic keeps data
| Data | How long Geotastic keeps it |
|---|---|
| Layers that Geotastic downloads for a question | Until the question is complete. Your layers stay in ArcGIS. |
| The full data of each step | 7 days. After that, Geotastic keeps a summary, the first rows and a small copy for the map. |
| Map layers for Shapefile export | 30 days |
| The answer: results, maps, charts, code and log | Until a person deletes the question. You can keep it as a record. |
| Backup copies in Amazon S3 | 30 days |
| Server images in AWS Backup | 7 days |
When a person deletes their account, their data leaves the backups in 30 days or less.
Where Geotastic runs
- Geotastic runs on one server in AWS, in the us-east-2 Region (Ohio, USA).
- All traffic to Geotastic uses HTTPS.
- The database accepts connections only from the server itself.
- Geotastic encrypts its backups and keeps earlier versions of each file. The backups stay in the same Region. A break-in on the server cannot destroy them.
The sandbox for AI-written code
- Each program runs as a separate user that cannot read the files of Geotastic.
- The program has no network.
- It reads only its own question's data and writes only to its own question's folders.
- Limits: 2 GB of memory, one CPU, 20 minutes and a system-call filter.
Our AI commitments
- People make the decisions. The AI does not.
- Each answer shows its plan, the code of each step, the data between the steps and each run of the program.
- The AI can make mistakes. Check each answer before you use it.
- Geotastic is a tool for staff. Residents do not use it.
- Your organization chooses the AI model. Geotastic sends AI requests to an LLM that has an OpenAI-compatible API.
- Geotastic does not train AI models on your data. The data policy of the model provider applies to what Geotastic sends. Ask us which provider and which policy apply to your pilot.
Compliance
- We will complete your security questionnaire.
- We will complete the GovAI Coalition AI FactSheet when you ask for it.