How does Merlin AI use my data?

Details on how Merlin AI features process and retain your data.

Merlin Native AI Connectors

A set of connectors that make infusing Composite AI on Tray simple and fast. Sentiment analysis, PII tokenization, and text summarization are some of the operations available. Read more in our docs.

The Merlin connector family currently includes Merlin Text Analysis (sentiment analysis and classification), Merlin Text Generation (text generation and summarization), Merlin Guardian (reversible PII tokenization — mask data before sending it to a third-party AI service, then de-tokenize the response — and masking), Merlin Extract, and Merlin Intelligent Document Processing (IDP) for PDFs, images, and multi-page documents. The hosting, retention, internal-usage, and opt-out terms below apply to all of them.

Hosting: Runs within Tray's cloud infrastructure.
Data retention: Inputs and outputs are only stored in customer's workflow logs and follow the existing retention period of these logs. See Debug logs for more details.
Merlin IDP documents: Documents are processed in your Tray instance's region and are not retained after processing completes. See Intelligent Document Processing for details.
Internal usage: Tray will not use this data for any other purpose other than providing the service or technical support if the customer grants this access.
Feature opt-out: Admins may disable this feature from within the App. The connectors disappear immediately, but active workflows may take up to 10 minutes to stop using them.

Merlin AI Workflow Summaries

Text summaries of your workflows to make collaboration easier and reduce the burden of manual documentation of automations and integrations. Read more about the release.

Hosting: Runs within Tray's cloud infrastructure.
Data retention: Until the workflow is deleted.
Internal usage: Tray may use the output of this service to personalize and improve the customer experience.
Feature opt-out: Admins may disable this feature from within the App.

Merlin Agent Builder

Build agents that use AI to reason over requests and take actions powered by workflows. Read more in our docs.

Hosting: Runs within Tray's cloud infrastructure.
Data retention: Conversation inputs and outputs are stored in customer's workflow logs and follow the existing retention period of these logs. See Debug logs for more details.
Knowledge sources: If you connect data sources (Google Drive, Gmail, Confluence, SharePoint, or custom integrations), pre-built sync workflows are initialised within your account and use your authentications to sync the selected content into a vector table in your account, where it is stored as embeddings and searchable text. This data remains in your account and is retained until you remove the data source or delete it. See Data sources.
Internal usage: Tray will not use this data for any other purpose other than providing the service or technical support if the customer grants this access.
Feature opt-out: Admins may disable this feature from within the App.

Agent Gateway and MCP

Agent Gateway lets you expose Tray workflows and connector operations as tools that external AI agents and assistants can call over MCP (Model Context Protocol). Read more in our docs.

Agent Gateway is different from the Merlin features above in one important way: Tray does not host or operate the AI model. You choose the MCP client — Claude, an OpenAI-based assistant, or your own agent framework — and any data returned by a tool call is sent to that client and processed by its model under your agreement with that provider, not Tray's model agreements. The assurances in the "AI Model Training & Data Sets" section below do not extend to models you connect via MCP.

Hosting: The gateway runs within Tray's cloud infrastructure, in the same region as your Tray workspace (US, EU, or APAC). MCP requests are served from region-pinned endpoints and are not routed cross-region.
Data flow: Tool descriptions, tool-call inputs, and tool-call results are exchanged with the MCP client you connect. Data your workflows return to an agent leaves Tray and is processed by your chosen model provider.
Identity and permissions: Agents act with the identity and permissions of the authentication used to connect — an agent can do what you can do. With dynamic (user-provided) authentication, each user's actions execute with their individual permissions and are traceable back to that person.
Data retention: Tool calls execute Tray workflows and connector operations, so inputs and outputs are stored in your workflow logs and follow the existing retention period of those logs. See Debug logs for more details. The gateway itself does not separately store tool-call content.
Internal usage: Tray will not use this data for any other purpose other than providing the service or technical support if the customer grants this access.
Governance and opt-out: Agent Gateway must be enabled at the organization level. MCP servers are configured per workspace: admins control which workflows and which individual connector operations are exposed as tools (for example, exposing read-only operations while blocking create, update, and delete), and only users explicitly granted access can invoke tools — workspace membership alone is not sufficient. See Authentication and access.

Tray Headless

Tray Headless is not an AI feature — no Tray-hosted model is involved. It is included here because customers typically connect their own AI clients to it and ask how their data is handled. Read more in our docs.

When you connect an AI client to the Tray Headless MCP server:

Data flow: Data returned by Headless calls is sent to the AI client you connected and processed by its model under your agreement with that provider. Tray-side, Headless requests are handled like normal platform API traffic, served from the regional endpoint you connect to.
Identity and permissions: The client acts with the permissions of the authentication you supply — every call is made as you, in the workspace you select during the OAuth2 sign-in. The packaged plugin experiences surface destructive actions for confirmation; a raw MCP client applies only the guardrails you configure in it. See Tray Headless MCP.
Data retention: Workflow executions triggered through Headless appear in your workflow logs and follow the existing retention period of these logs. See Debug logs for more details.
Internal usage: Tray will not use this data for any other purpose other than providing the service or technical support if the customer grants this access.

Merlin Chat and Build

Merlin is Tray's chat based AI that performs automation tasks and builds workflows for you, powered by OpenAI. It is enabled on a per-organization basis — if you do not see it, contact your account team. Read more in our docs. By default, OpenAI does not receive personal data from the APIs you ask Merlin to interact with. However, you can opt-in to additional features that may send OpenAI your data. When asking Merlin "Who are my top 10 leads?", OpenAI is used to understand the question, then suggest a Tray connector and confirm which operation to use, like "Find records on Salesforce". When you're ready to execute the actual query, this happens entirely from within Tray. If you ask follow up questions, like "Email me a summary", OpenAI will be sent the structure of the data. Some APIs may include personal data in these structures.

Data retention: Until the session is complete.
Processing region: OpenAI processes these requests in the United States, regardless of your Tray region.
Internal usage: Tray may only use fully anonymized inputs and outputs of this service, and any feedback you submit (such as thumbs-up/down ratings), for product improvement purposes.
Feature opt-out: Admins may disable this feature from within the App.
OpenAI opt-out: OpenAI is an opt-in sub-processor and is only sent the data that is required to assist you in building your automations. Under our agreement with OpenAI, it is not permitted to use your data for training purposes and does not retain data after processing it.

Cross-Region AI Processing

Merlin AI features utilize AWS Bedrock's cross-region inference capabilities to provide optimal performance and availability. This means that AI processing requests may be distributed across multiple AWS regions for load balancing purposes. This applies to Merlin features that use Tray-hosted models; requests processed by OpenAI (Merlin Chat and Build) and by models you connect yourself are governed by those providers and are not part of Bedrock cross-region inference. Processing Locations:

US Customers: Within United States only
EU Customers: Germany, Sweden, Italy, Spain, Ireland, France
APAC Customers: Japan, South Korea, India, Singapore, Australia For the most up-to-date list of regions, refer to the AWS documentation for cross-region inference profiles. Alternatives: If you prefer not to use cross-region processing, you have alternatives:
Merlin Agent Builder: This only applies to the "Tray Native" models, which are models with AWS Bedrock provided by Tray. You can connect to your own models using your own authentications to avoid cross-region processing.
Native AI Connectors: This functionality can be recreated using Tray's standard connectors by connecting to your own model with your own authentications.

AI Model Training & Data Sets

The following applies to Merlin features that use Tray-hosted models: the Native AI Connectors, Workflow Summaries, and Merlin Agent Builder's Tray Native model. Merlin Chat and Build uses OpenAI (see that section above), and models you connect yourself — Agent Builder's bring-your-own-model options (currently AWS Bedrock, OpenAI, Azure AI, and Google Gemini) and any client connected via Agent Gateway or Tray Headless MCP — are governed by your own agreements with those providers.

Tray's AI features use foundation models hosted on AWS Bedrock from reputable providers such as Anthropic and Amazon. These vendors independently ensure the quality, accuracy, and representativeness of their training data through a combination of publicly available and licensed datasets, along with filtering, deduplication, and alignment techniques. While Tray does not control the training data, we rely on providers who are known for their ethical and rigorous AI development practices. AWS Bedrock does not store or use customer data to train models, ensuring privacy and data separation regardless of the provider. Additionally, AWS Bedrock and the AI models do not retain any customer data after processing, and model providers do not have access to your data during inference. Customers often have full control over the prompts sent to AI systems in their Merlin AI workflows, for example when using Merlin Agent Builder and the Native AI Connectors, allowing them to implement their own content filtering and safety measures as needed. Additionally, many Merlin AI features allow customers to connect and use their own models on the Tray platform.

What Merlin AI never sees

Connector credentials: Authentication tokens and connector credentials are never included in prompts or sent to any model. Credentials are encrypted with AWS KMS and only decrypted server-side at workflow execution time; MCP tool calls reference an authentication ID, never the credential itself.
Human review: Tray staff do not review your prompts or outputs. Staff can access workflow data only to provide technical support where the customer grants this access — access is provisioned by the Security team, time-bound, and logged, and support access events appear in your streamable logs.
Log masking: AI inputs and outputs stored in workflow logs can be hidden with step-level log masking where configured — reveals are admin-only and audited.