Skip to content

Data flow

This page explains what happens when you send a request, which components are involved, and where your data is stored. It is written for administrators and security reviewers deciding how to deploy XTM One. For what leaves the platform to reach an AI model, see AI governance.

How the pieces connect

At a high level, everything goes through the platform. It is the only component that talks to the AI provider (for example OpenAI, Anthropic, Google Gemini, or a local Ollama model), your knowledge bases and integrations, and the trace store — nothing else reaches the AI provider directly.

flowchart LR
    U[You] <--> P[Platform]
    P <--> AI[AI provider]
    P <--> KB[(Knowledge bases)]
    P <--> INT[Integrations]
    P --> TR[(Traces)]
  • Platform — the XTM One application itself (API and UI). It authenticates you, builds prompts, runs tools, and streams answers back.
  • AI provider — the service hosting the language model the agent uses. See Configuration.
  • Knowledge bases — your vectorized document collections. Agents search them to ground answers in your own content.
  • Integrations — connections to external services (email, messaging, ticketing, and more) that agents act on through tools.
  • Traces — the recorded history of each AI interaction (prompts, tool calls, tokens, timing, errors), used for observability. See Monitoring.

The request lifecycle

A chat message or an assignment run follows the same broad path across the platform services:

  1. Your request reaches the platform (API + UI), which authenticates you and loads the target agent's configuration.
  2. The platform assembles a prompt: the agent persona and instructions, relevant context, and the list of tools the agent is allowed to use.
  3. The platform sends the prompt — and the tool list — to the configured AI provider.
  4. The model reads the request and either answers directly or asks the platform to run a tool. It cannot run anything itself; it only sends back the name of a tool and the arguments to use.
  5. When the model asks for a tool, the platform executes it — searching a knowledge base, calling an integration, running a sub-agent — and sends the result back to the model. The model can then ask for another tool or write its answer. This repeats until the model is done.
  6. The final answer is streamed back to you and recorded as a trace.
sequenceDiagram
    actor You
    participant Platform
    participant AI as AI provider
    participant Tools as Tools (e.g. search a KB, call an integration, run a sub-agent)

    You->>Platform: Send a request
    Platform->>Platform: Build prompt + tool list
    Platform->>AI: Prompt + available tools
    loop Until the model has an answer
        AI->>Platform: Ask to run a tool
        Platform->>Tools: Run the tool
        Tools-->>Platform: Result
        Platform->>AI: Tool result
    end
    AI->>Platform: Final answer
    Platform->>You: Stream the answer
    Platform->>Platform: Record a trace

What is a tool?

A tool is a function that lives on the platform, such as "search this knowledge base" or "send a Slack message". The AI provider is given a description of each available tool but never touches your systems directly: it can only request a tool call, and the platform decides whether and how to run it. This is why credentials and full data sources never need to be sent to the model — see AI governance.

Assignments follow the same loop without a live user: a trigger (schedule, webhook, or event) starts the run, and the worker carries out any delayed or background work.

Where data is stored

All data stays in the backing services you deploy:

Data Where it lives
Agents, assignments, users, configuration PostgreSQL
Knowledge base documents and embeddings PostgreSQL (pgvector)
Uploaded files and attachments Object storage (MinIO / S3)
Task queue, caching, short-term memory Redis
LLM traces PostgreSQL, or ClickHouse if configured (see Monitoring)

All integration and channel credentials are encrypted before being written to the database. See Configuration for the keys that protect them.

Next step

Continue with AI governance to understand what is shared with AI providers and how to control it.