Data Protection in AI Scenarios

In SAP Business AI, data protection is applied across the full AI request and processing flow, from the moment a request is created to the response returned to the user.

Unlike traditional applications, AI scenarios may involve multiple processing steps, such as:

• sending a request from an application
• processing data in AI services
• retrieving additional context (for example, through Retrieval-Augmented Generation)
• generating and returning a response

Because of this, SAP applies security controls at each stage of the process, helping ensure that data remains protected as it moves across different components.

A fundamental part of data protection is encryption. SAP applies encryption in two key ways:

Data in transit

Communication between applications, SAP BTP services, and AI components is protected using secure protocols such as TLS 1.2 or higher. This helps prevent data from being intercepted or altered during transmission.

Data at rest

Data stored within SAP-managed systems is protected using encryption mechanisms (for example, in SAP HANA Cloud and AI Core–managed environments, such as configuration and deployment metadata, using standards like AES-256).

These measures help ensure that data is protected both during transmission and while stored within SAP-managed environments.

In SAP-managed AI scenarios, applications typically do not connect directly to AI models or external providers. Instead, requests are routed through SAP-managed services that enforce security controls.

For example:

• Applications connect to AI services using secure service-to-service authentication (such as OAuth-based mechanisms)
• Requests are routed through SAP-managed layers such as SAP AI Core and the SAP Generative AI Hub
• Communication between services is protected through encrypted channels

This approach helps ensure that access to AI services is controlled, credentials are protected, and data is transmitted securely across system boundaries.

SAP’s approach to AI security is based on controlled data flows and clearly defined trust boundaries.

AI requests are processed through defined application contexts and SAP-managed services, where security and governance controls are consistently applied. Rather than relying on a single control, SAP applies multiple safeguards across the full request lifecycle:

• Authentication and authorization controls before processing requests
• Policy-based controls and routing mechanisms to govern how AI services are accessed
• Controls to protect sensitive data during processing
• Audit logging and traceability, enabling monitoring and compliance

This ensures that data handling is not only secured technically, but also governed and traceable throughout the process.

Data protection in SAP Business AI is applied across the full AI request and processing flow. SAP supports this through:

• Encryption of data in transit and at rest
• Secure communication between applications and AI services
• Controlled data flows across defined architectural patterns
• Governance mechanisms such as authentication, authorization, and auditability

Together, these measures help ensure that enterprise data is protected, controlled, and traceable throughout AI processing.