Hi @Balakrishna_ABK ,
For Now Assist, it helps to separate runtime inference from optional data sharing/model improvement.
For normal Now Assist processing, ServiceNow documentation says AI workloads are sent from the customer instance to ServiceNow AI compute hubs using TLS 1.2. The prompt data is processed to generate the response, then deleted from the compute hub after the response is generated. ServiceNow also states that the input/output is transient, not cached or stored on the compute hub, and is not commingled with other customer data. Domain-separated data is also not commingled.
There is also a separate data sharing program used to improve ServiceNow AI products. If a customer does not want to participate, they should opt out in Now Assist Admin > Settings > Data sharing and processing > Data sharing. This is per instance and requires the sn_generative_ai.data_steward role. ServiceNow docs say opt-out can take up to five business days. For GCC/self-hosted instances, ServiceNow states data sharing is not available, so it is not enabled.
For sensitive data, use Data Privacy for Now Assist. It can de-identify PII/sensitive values before prompts are sent to the LLM. ServiceNow describes this as two-way masking: placeholder/anonymized values are sent to the LLM, then replaced with the original values after the response is received. Important limitation: this masking is regex/data-pattern based, not contextual AI-based, and it must be configured. It does not automatically clean sensitive data already stored in records.
For access control, Now Assist does not mean “all instance data goes to the LLM.” For RAG-type features like AI Search, ServiceNow says only content the requester can access is passed into the prompt. However, admins still need to be careful with use cases like case summarization: if an agent with broad access generates a summary and pastes it into work notes/comments, that summary may become visible to others who can access the record.
Also review the selected model provider. Now LLM Service is the default, but ServiceNow supports model provider choice for some Now Assist skills, including supported third-party models such as Azure OpenAI, Google Gemini, and AWS Claude depending on product, region, and feature support. If using BYO/third-party provider configurations, validate the customer’s contractual and regional data-processing requirements separately.
My recommendation for a customer privacy response:
- Confirm which Now Assist products/skills are enabled.
- Confirm which LLM provider is being used: Now LLM Service or third-party/BYO.
- Review data sharing status and opt out if required.
- Configure Data Privacy for Now Assist for PII/sensitive fields.
- Review data overflow processing if the customer has strict data residency requirements.
- Validate ACLs, user criteria, knowledge permissions, and summary-sharing processes.
- For regulated customers, confirm availability and terms through ServiceNow Support/Account team.
Thank you,
Vikram Karety
ServiceNow Architect
Octigo Solutions INC
