The value of an AI agent comes from what it can read; the risk comes from the same place. Every serious deployment ends up answering the same five questions from the data-protection team. Here they are, with the control that answers each one and how Harmona implements it.
1. Who can the agent read on behalf of?
The wrong answer is "a service account with access to everything". An agent should read with the rights of the person asking, so a sales rep's question never surfaces an HR document. In Harmona every read happens with the asking person's permissions; personal accounts (your Gmail, your Drive) are usable only by their owner, or by whoever they explicitly share with. Org admins see that an asset exists, not its contents, until someone shares it.
2. Where is the data processed, and what stays behind?
When you connect a database, a drive or a documentation site, something is stored to make search fast: vectors for retrieval, file states for freshness. That store should be yours, in a known region. Harmona processes sources into your own workspace's store, in the EU region on cloud plans; Enterprise plans run in a private cloud or on your own servers.
3. Is our data used to train models?
It should not be, and the answer should be in writing. Harmona trains no models on customer data; the model providers used and their terms are listed on request, and Enterprise plans include a data-processing agreement under GDPR and KVKK.
4. What happens when we delete a connection?
Everything built on it should go with it: sources, vectors, file states. If deletion is a ticket to support, it isn't deletion. In Harmona, deleting a connection removes what was built on it, and the tiles that depended on it say so instead of showing stale numbers.
5. Can the agent act on the outside world without a person?
Reading is one risk class; sending is another. Anything outbound, an e-mail, a ticket update, a CRM record change, should wait for a person, and the approval should show exactly what will happen. Harmona renders every outbound action as an approval card; unattended tasks keep to the permission list granted at creation and report what they declined.
Three more controls worth asking about
- Private data redaction before the model. E-mail addresses, phone numbers, card numbers, national IDs and API keys are masked before a prompt reaches a model. In Harmona this is on for every new agent, along with advice restriction (medical, legal, financial) and content restriction; turning one off is a deliberate act.
- Credentials never in chat. A builder that accepts a password or a connection string in a chat message is a builder that will leak one. Harmona's Agent Mode links you to the resource's own page for secrets and has no delete tools at all.
- An audit trail you can read. Each tool call should render as a fixed record in the conversation, not a transient "thinking" state: what was read, what was built, what was shared.