# What Happens to Your Data When You Use AI with Agility

> Source: https://agilitycms.com/docs/owners-admins/ai-and-your-data

This page is for admins, security reviewers and data protection teams who need to know what data moves where when people use AI with Agility CMS. It covers each AI surface Agility documents today and what each one can read and change.

It is about data handling. For how to control who can do what with AI, and how to roll it out, see [Governing AI Access to Agility CMS](https://agilitycms.com/docs/owners-admins/governing-ai-access).

## The AI surfaces in Agility

| Surface | What it does | Reads | Writes | How it is accessed |
| --- | --- | --- | --- | --- |
| [Agility CMS MCP Server](https://agilitycms.com/docs/developers/agility-cms-mcp-server) | Lets AI assistants such as Claude, ChatGPT, GitHub Copilot and Cursor work in your instances. | Instances, models, content, pages, sitemaps and media the user can access. | Models, containers, content, pages and media, plus workflow, publish and delete, within the user's permissions. | OAuth 2.0 sign-in by each user, at `https://mcp.agilitycms.com/api/mcp`. |
| [Agility Knowledgebase MCP Server](https://agilitycms.com/docs/overview/agility-knowledgebase-mcp-server) | Lets AI assistants search and read the public Agility documentation. | Public documentation only. | Nothing. It is read-only. | No sign-in. |
| [DeepL app](https://agilitycms.com/docs/apps/deepl) | Translates content with DeepL, an AI translation service: fields an editor picks in the DeepL panel, or items and pages as they are copied into another locale. | The fields an editor selects, or the text of the items and pages being copied with Translate Content. | Panel: translated text into the editor, kept only when the editor saves. Copy: translated drafts in the target locale, in Staging. | Installed on an instance by an administrator, with your organization's own DeepL API key. |

## The Agility CMS MCP Server

### How it authenticates

- **Each person signs in with their own Agility account.** The MCP server uses OAuth 2.0 with short-lived access tokens. On first connection, the AI client opens a browser window and the person signs in through Agility's standard login ([Agility CMS MCP Server](https://agilitycms.com/docs/developers/agility-cms-mcp-server#authentication)).
- **There is no shared key.** Two people using the same AI tool get two separate connections, each limited to what their own Agility account can reach ([Governing AI Access](https://agilitycms.com/docs/owners-admins/governing-ai-access#how-authentication-works)).
- **The MCP server does not store passwords** ([Agility CMS MCP Server](https://agilitycms.com/docs/developers/agility-cms-mcp-server#authentication)).
- **Unattended jobs** use the Management API with a [Personal Access Token](https://agilitycms.com/docs/developers/personal-access-tokens) that belongs to a user and inherits that user's permissions.

### What it can read and change

The MCP server calls the Agility Management API on the user's behalf, and the Management API checks that user's permissions on every call. An AI assistant can do no more through the MCP server than the person could do in the Agility app ([Governing AI Access](https://agilitycms.com/docs/owners-admins/governing-ai-access#the-permission-model)).

| Tool area | Reads | Changes |
| --- | --- | --- |
| Discovery | The instances the user can access, the signed-in user's identity, locales and containers. | Nothing. |
| Models and schema | Content, component and page models and their fields. | Creates or updates models and containers. |
| Content | Content items and lists. | Saves content items; publishes, unpublishes, approves, declines or requests approval; deletes items. |
| Pages and sitemaps | Sitemaps, pages and page models. | Saves pages, reorders components, runs page workflow, deletes pages. |
| Media | The media library list and asset URLs. | Uploads and deletes assets. |

The current list of tools is published at [mcp.agilitycms.com/tools](https://mcp.agilitycms.com/tools).

Because permissions are checked on every call, the way to cut off what someone can do through AI is the same as in the app: change their role, or remove them from the instance in **Settings > User Access**.

### Saves land in Staging

When an AI saves content through the MCP server, the item lands in **Staging**. Saving changes to a published item creates a new Staging version while the live version stays as it is. Publishing is a separate action that needs the Publish permission, and approval workflows apply to AI-made changes the same as to changes made by hand ([Governing AI Access](https://agilitycms.com/docs/owners-admins/governing-ai-access#saves-land-in-staging-and-your-workflow-still-applies)).

Your organization chooses how much autonomy AI gets for each kind of content: **Assist** (AI saves to Staging, a person publishes), **Approve** (AI requests approval, an approver signs off) or **Autonomous** (a dedicated automation user publishes after checks). See [Levels of autonomy](https://agilitycms.com/docs/owners-admins/governing-ai-access#levels-of-autonomy).

Unpublishing and deleting are annotated as destructive, so MCP clients prompt before running them, and clients that support MCP elicitation show a confirmation form from the server. A user can turn client prompts off, so the dependable control is the user's role ([Governing AI Access](https://agilitycms.com/docs/owners-admins/governing-ai-access#confirmation-for-destructive-actions)).

### Where your content goes

- **Into the person's AI client.** Anything an Agility tool returns, such as content, field values and model definitions, becomes part of the conversation in the AI client the person is using ([Governing AI Access](https://agilitycms.com/docs/owners-admins/governing-ai-access#what-leaves-agility)). What that client and its AI provider do with the conversation is set by that provider's terms. Review the data handling terms of each AI tool you approve, as you would for any tool your team pastes content into.
- **Files do not pass through the conversation.** Media uploads use a short-lived signed URL (valid for 5 minutes), so file bytes are posted straight to Agility rather than embedded in the conversation ([Agility CMS MCP Server](https://agilitycms.com/docs/developers/agility-cms-mcp-server#working-with-media)).
- **Microsoft 365 Copilot** reaches the MCP server through Power Platform connectors, so your tenant's connector data loss prevention (DLP) policies apply to it ([Connect the Agility MCP Server to Microsoft 365 Copilot](https://agilitycms.com/docs/developers/connect-agility-mcp-server-to-microsoft-365-copilot)).

### Who is recorded as making the change

Because the MCP server acts as the signed-in user, a change made through an AI assistant is recorded against that person in the item's version history, the same as a change they made by hand ([Governing AI Access](https://agilitycms.com/docs/owners-admins/governing-ai-access#audit-trail-and-logging)). Run the read-only `get_current_user` tool to confirm which user an AI client is acting as.

## The Agility Knowledgebase MCP Server

The Knowledgebase MCP server searches and reads the public Agility documentation. It needs no sign-in and has no access to your instances or content. It is deployed on Vercel. Its search runs on Azure AI Search, and falls back to the same Algolia index that powers the search bar on this documentation site ([Agility Knowledgebase MCP Server](https://agilitycms.com/docs/overview/agility-knowledgebase-mcp-server#technical-details)).

The only data you send it is what your AI assistant puts in a search query or document request. Avoid putting confidential information in those queries.

## The DeepL app

The DeepL app translates text with DeepL using your organization's own DeepL API key, so DeepL processes the text under your DeepL account and the terms of your DeepL plan ([DeepL](https://agilitycms.com/docs/apps/deepl)).

- **What is sent.** With the DeepL panel, the fields an editor selects. When content or pages are copied into another locale with **Translate Content**, the text, rich text and custom fields of each item, and each page's title, menu text and meta description. Images, dates, numbers, dropdown selections and linked-content references are not sent, and values that look like IDs, URLs or slugs are kept as they are ([Translating Content with DeepL](https://agilitycms.com/docs/editors/translating-content-with-deepl)).
- **The route it takes.** Text goes from Agility to the DeepL app, which Agility hosts, and from there to DeepL. The app doesn't store the text it translates.
- **What is written back.** The panel fills the fields in the editor, and nothing is saved until the editor saves. A copy writes translated drafts to the target locale in **Staging**, and nothing is published until someone publishes it ([Copying and Translating Content Across Locales](https://agilitycms.com/docs/editors/copying-and-translating-content)).
- **How DeepL handles the text depends on your DeepL plan.** DeepL's terms for its API Pro plan limit how long it keeps text to what's needed to translate it; its free plan doesn't make the same commitment. Read [DeepL's data security page](https://www.deepl.com/en/pro-data-security) and [DeepL's terms](https://www.deepl.com/en/pro-license), and use API Pro for content that matters.

## Controls you have today

- **Choose the AI clients you allow,** and review each provider's data terms. Treat any "Agility MCP" package or server that Agility does not publish as untrusted.
- **Start read-only.** Users with the **Reader** role can explore through AI, but every write is denied at the API.
- **Keep Publish and Delete deliberate.** Give them only to people, or automation users, who need them, and turn on approvals where a person should sign off.
- **Remove access the usual way.** Permissions are checked on every call, so removing a user from an instance or changing their role in **Settings > User Access** also limits what they can do through AI.
- **For Microsoft 365 Copilot,** require end-user authentication rather than maker-provided credentials, and check your DLP policy.
- **Log what happens.** Forward publish, unpublish and delete webhooks to your log store or SIEM, especially for automated publishing.

The full rollout guidance is in [Governing AI Access to Agility CMS](https://agilitycms.com/docs/owners-admins/governing-ai-access#recommended-rollout-policy).

## Questions this page does not cover

For anything else your review needs, such as token lifetimes, MCP hosting and logging, subprocessors, whether content is used to train AI models, or whether MCP can be turned off for your organization, contact your account team or [support@agilitycms.com](mailto:support@agilitycms.com). For the AI client your team chooses, such as Claude or ChatGPT, training use is set by that provider's terms.

## Related articles

- [Governing AI Access to Agility CMS](https://agilitycms.com/docs/owners-admins/governing-ai-access)
- [Agility CMS MCP Server](https://agilitycms.com/docs/developers/agility-cms-mcp-server)
- [Connect the Agility MCP Server to Microsoft 365 Copilot](https://agilitycms.com/docs/developers/connect-agility-mcp-server-to-microsoft-365-copilot)
- [Using AI Assistants with Agility CMS](https://agilitycms.com/docs/editors/using-ai-assistants-with-agility)
- [The Agility Shared Responsibility Model](https://agilitycms.com/docs/owners-admins/shared-responsibility-model)
- [Security Review Pack](https://agilitycms.com/docs/owners-admins/security-review-pack)

---

## Related pages

- [The Agility Shared Responsibility Model](https://agilitycms.com/docs/owners-admins/shared-responsibility-model.md)
- [Security Review Pack: Answering Your Vendor Questionnaire](https://agilitycms.com/docs/owners-admins/security-review-pack.md)
- [Admin Go-Live Checklist](https://agilitycms.com/docs/owners-admins/admin-go-live-checklist.md)
- [User Lifecycle at Scale: Provisioning, Offboarding and Access Reviews](https://agilitycms.com/docs/owners-admins/user-lifecycle-at-scale.md)

Index of every docs page: https://agilitycms.com/docs/llms.txt