Pega GenAI: Where Innovation Meets Data Security
In the age of generative AI, one question stands out for every business leader: Is my customer data safe?
With Pega GenAI, the answer is a confident yes. Pega has designed its GenAI architecture to meet enterprise-grade security and compliance standards — ensuring that client data never leaves their control. Here’s how this powerful framework keeps your information secure.
1. Tenant Data Isolation
Every customer operates within their own private environment, or “tenant.” Their data, cases, and AI interactions are completely segregated from others.
Think of it like an apartment building — while multiple tenants share the same infrastructure, each lives behind their own locked door.
For example:
- A bank using Pega GenAI for loan inquiries can’t access healthcare case summaries used by another client.
- Each tenant’s environment remains fully isolated and protected.
2. Pega GenAI Gateway: The Intelligent Gatekeeper
Whether you’re opening a case or navigating between screens, the routing table ensures the right handler calls the right API to fetch the right data—instantly updating the UI through React, with no full-page refresh.
Here is a clear, step-by-step explanation of the routing flow in Pega Constellation, suitable for sharing as content:
The result: the AI generates useful insights — without ever seeing confidential data.
3. Tenant-Specific Encryption Keys
Each customer’s data is protected with a unique encryption key. That means:
- Client A’s encryption key can’t open Client B’s data.
- All prompts, logs, and AI outputs are cryptographically separated.
Even if encrypted data were exposed, it would remain unreadable without the corresponding key.
4. External LLM Security: Trusted Processing, No Retention
When Pega interacts with external large language models like Azure OpenAI, your data is never stored or used for training. These providers process information momentarily and then delete it. It’s like asking a quick question — they answer, then forget immediately. Nothing is ever saved or reused.
5. Data Residency and Governance
Compliance rules vary across industries and countries. Pega gives customers full control over where their data resides. Banks can ensure data stays within India to meet RBI norms, while healthcare organizations retain patient information within U.S. borders to comply with HIPAA.
6. Customer-Hosted Model: Private and Fully Controlled
- A global bank processing sensitive loan data can deploy models like Llama 3 locally.
- A healthcare provider can host a private Azure OpenAI instance within their own tenant.
Built to Earn Trust
Behind every GenAI interaction, Pega provides full auditability and monitoring. Each prompt and response is logged (securely encrypted and tenant-isolated), enabling transparency, accountability, and compliance reporting.
