Security between Pega Knowledge buddy and the LLM it connects to

General
, ,
1

When we query the knowledge buddy with the question on the ingested content, it retrieves the answer from the data chucks from the vector store and prepares the prompt and send that prompt to LLM(OpenAI) and format the answer and shares the response back to us. I am aware of the security of the content that’s maintained within Pega, however would like to know what’s the security mechanism that is being maintained between Pega and External LLMs?

2

@Saravanan M :warning: Below is a GenAI-powered answer.

All generated answers require validation against the provided references (which you can find yourself by searching on docs.pega.com).

Here is a comprehensive overview of the security architecture.

The security implementation operates on multiple layers:

  1. Data Encryption and Transit Security
    • All data at rest is encrypted using 256-bit AES encryption
    • HTTPS (TLS) is used for secure data transmission between systems
    • Secure TLS connectivity can be configured for external REST or SOAP services through Dev Studio
  2. Data Protection Mechanisms
    • Prompts and completions are not accessible to other Pega clients
    • No data retention in external models - the LLM models used are stateless
    • Prompts and completions are never used to improve external models
    • Role-based access control ensures only authorized users can manage, view, or use the data
  3. Knowledge Buddy Specific Security
    • Secure content ingestion practices protect data during transfer
    • REST APIs for content ingestion and querying are secured through access roles
    • Layered security approach with multiple security checkpoints:
      • Pega Knowledge articles level
      • Data sources level
      • Data chunks level
      • Knowledge Buddy cases level
  4. Authentication and Access Control
    • Robust role-based security at multiple levels
    • Access roles define who can create, view, and use data sources
    • Ask Buddy auditing cases are generated for monitoring and tracking API usage
    • Each interaction is logged for security audit purposes

For more detailed information, you can refer to the following documentation:

@JamesCarstairs if you need to add anything here, feel free to do so.