Where your data goes
AI Workflow Automation is built so you can keep everything on your own server, or opt in to cloud features one workflow at a time. This page explains exactly what is stored, what stays local, and what Cloud mode sends.
What stays on your site
Your workflows, node settings, run history, custom tables, and API keys all live in your WordPress database. They are never copied to our platform.
API provider keys, connected-app tokens, and other credentials are encrypted at rest using AES-256-GCM, keyed to your site’s own WordPress security salt. See Security and privacy for the encryption details.
Local (BYOK) mode
When a workflow runs in Local mode, AI calls go directly from your server to the provider you configured (for example OpenAI, Anthropic, or OpenRouter), using your own key. You pay that provider directly for usage.
In Local mode with your own key, no account is required and no data is sent to our platform. Your key is used only for that direct call and never leaves WordPress.
Keyless credits
If you would rather not manage a provider key, you can connect a free account and use keyless AI. In that case your prompt and inputs are sent through our hosted proxy, which calls the AI provider with our keys and meters the run in credits. See BYOK keys vs keyless credits.
Cloud execution
When you switch a whole workflow to Cloud, the data each step needs is sent to our hosted engine so it can run there: no PHP timeouts, server-side scheduling, and our keys. Callbacks from the engine back to your site are signed and verified. See Local vs Cloud execution.
External services
Some features rely on third-party services. Each is contacted only when you add the matching node, or when you opt in to the cloud service. This mirrors the External Services disclosure shipped with the plugin on WordPress.org.
| Service | Used for | When it is contacted |
|---|---|---|
| OpenAI, Anthropic, OpenRouter | AI text generation | Whenever an AI node runs. Direct from your server in Local mode; via our proxy in keyless or Cloud mode. |
| Our cloud platform | Hosted execution, keyless AI, connected account, credits | Only when you connect an account and use Cloud, keyless AI, or a connected app. |
| Perplexity | AI Research node | Only when a Research node runs (cloud, credit-based). |
| Firecrawl | Web scraping and crawling | Only when a Web Scraper (Firecrawl) node runs. |
| Fal.ai | Image, video, and audio generation | Only when a Media Generator node runs. |
| Unsplash | Stock image search | Only when an Unsplash node runs. |
| LlamaParse | Parsing uploaded PDF, DOCX, and TXT documents | Only when you ingest documents into a Knowledge Base or use the Document Parser. |
| Gotenberg (via our cloud) | Generating PDFs | Only when a Generate PDF node runs (cloud-only). |
| Composio | Securely storing the account link for Connect an App | Only when you connect an app and run a Connect an App node. |
| Paddle | Payments for credit top-ups and subscriptions | Only when you buy credits or subscribe. |
If you never use any of these features, none of these services are contacted.
Deleting your data
Because everything lives in your WordPress database, removing a workflow, a custom table, or your API keys from the builder and settings removes that data. If you disconnect a connected app, its stored link is revoked.