Language model
The AI Assistant describes project data in natural language, and it does so using a language model. Q247 does not require a single provider: the model can come from the Client or be delivered together with the service. This page describes three variants of this deployment and the scope of data passed to the model.
The integration mechanism is the same in every variant: the Q247 backend calls one configured address, passing a prompt with project data and an access token. The difference is where that address is located and who manages it.
These settings are not in the Configuration panel. They are configured by the Q247 deployment team based on the data provided by the Client.
Client model in the cloud
The Client uses its own model hosted in a public cloud, for example with Azure OpenAI, AWS Bedrock, or Anthropic. Access can be direct or through the Client's own AI gateway (Kong AI Gateway, Azure API Management, Cloudflare AI Gateway), which exposes one fixed address and decides on its own which model to route the request to.
- What the Client provides: the endpoint address, either direct or the gateway's, and an access token.
- What Q247 does: configures the integration based on this data.
- Changes to the Client's network: usually none, because the connection goes out from Q247 to a publicly available address. If the Client restricts access to its API by IP address, Q247 provides its backend addresses to be added to the allowlist.
- Who it is for: organizations that want to keep control over the choice and cost of the model.
Client model on-premise
The model runs in the Client's private network and is not publicly available.
- What the Client provides: the internal API address of the model, an access token, and a network configuration allowing connections from Q247.
- What Q247 does: provides the IP addresses to be added to the allowlist and configures the integration.
- Changes to the Client's network: required. Because the connection is always initiated by the Q247 backend, this variant requires opening inbound traffic in the Client's firewall.
- Who it is for: organizations whose security requirements do not allow exposing the model publicly.
Q247 infrastructure
Q247 provides and maintains the AI engine, including its availability, cost, and security. The models used are Claude Sonnet 4.6 and OpenAI GPT-5.
- What the Client provides: consent for the AI solution delivered as part of the service to process project data.
- Changes to the Client's network: none. No firewall rules, no API keys.
- Who it is for: the simplest variant and the most common choice when the Client has no specific requirements regarding the model provider.
The other two variants rely on the Client's own model and licenses, so the cost of using the model is borne by the Client directly with its provider.
Network traffic
| Connection | Direction | Required |
|---|---|---|
| Q247 backend → model in the Client's cloud | outbound from Q247 | yes, in the cloud variant |
| Q247 backend → model in the Client's network | outbound from Q247, inbound to the Client | yes, in the on-premise variant |
| Model → Q247 backend | none | no |
| User's browser → model | none | no |
The connection is always initiated by the Q247 backend, and the response returns over the same connection. The user's browser never connects to the model directly.
Security and data scope
Prompts and aggregated project data from the last four weeks, needed to generate the response, are passed to the model. The scope covers information on team activity (Calories, Increments, Lines, the code retention score), performance metrics, trends, and data identifying team members: first name, last name, and email address.
The source code of repositories is not passed to the model.
Other properties:
- Communication with the model takes place over an encrypted connection, with authentication and authorization.
- Responses are tied to a specific account and project. A user sees only the analyses of projects they have permissions for in Q247, in accordance with Permissions.
- In the Q247 infrastructure variant, the data passed to the models is not used to train them. Retention rules follow the terms of service applicable to the selected model.
- The scope of personal data processing is defined by the data processing agreement (DPA) applicable to the chosen deployment variant.
See also
- AI Assistant: the panel that uses this integration
- AI tool logs: the second AI integration, supplying telemetry to AI Adoption
- Permissions: who sees the analysis of which project