Overview

Azure Storage Accounts

• data at rest is secured with soft delete for 30 days

Azure OpenAI Deployments

• prompts are filtered using Azure content filtering

• prompts and responses are not stored or reviewed by Microsoft (Azure abuse monitoring)

SSO

• SSO can be configured to connect to customer IDP using Entra, OIDC, SAML, and other methods supported by Zitadel

Comparison with Single Tenant Deployment Model

On the multi-tenant (SaaS) chat deployment model the most notable differences from the Single Tenant deployment model are:

• data at rest is mostly encrypted with Microsoft / platform-managed encryption keys

• data at rest is stored in shared storage accounts with other customers

• data at rest is always stored in Switzerland (Switzerland-north)

• data is processed on the same backend service instances with other customers

• users are logging in on the same zitadel instance with other customers