> ## Documentation Index
> Fetch the complete documentation index at: https://wisty.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# How Wisty uses your data

> What goes to the AI, what stays in Salesforce, and how apps access records.

Wisty uses your org's metadata to build your project. When you open the preview or a published app, it reads live records using your Salesforce permissions.

## What the AI receives

The generating AI receives your instructions, relevant attachments, project code, and Salesforce metadata. Metadata describes your org: objects, fields, relationships, picklist values, and layouts.

Wisty doesn't retrieve Salesforce records for generation context. The AI can discover fields and check queries against the org's schema without receiving the records those queries would return.

<Note>
  Text and images you put in chat are generation inputs. If you paste a customer
  record or attach a screenshot containing personal data, you're supplying that
  content to the AI. Use fictional examples when the actual values aren't
  needed.
</Note>

Project context includes your instructions, relevant attachments, and project code. The app accesses live records only when it runs.

<div className="docs-diagram">
  ```mermaid actions={false} theme={null}
  ---
  config:
    theme: base
    themeVariables:
      fontFamily: inherit
      fontSize: 15px
      lineColor: "#8C817A"
      edgeLabelBackground: "#FFFFFF"
    flowchart:
      nodeSpacing: 20
      rankSpacing: 32
      padding: 8
      curve: basis
  ---
  flowchart TB
      accTitle: How Wisty builds and runs an app
      accDescr: Salesforce metadata and project context go to the generating AI, which produces app code. A signed-in user opens the preview or published app. The running app accesses Salesforce records through Wisty with that user's permissions.

      M["Salesforce<br/>metadata"]:::input
      I["Project<br/>context"]:::input
      G("Generating AI"):::process
      C["App code"]:::artifact
      U["Signed-in<br/>user"]:::input
      A("Preview or<br/>published app"):::app
      R[("Salesforce<br/>records")]:::data

      M --> G
      I --> G
      G --> C
      C --> A
      U --> A
      A <-->|"Through Wisty<br/>User's permissions"| R

      classDef input fill:#F5F3F0,stroke:#D6CFC8,color:#51463F,stroke-width:1px;
      classDef process fill:#FFF1E8,stroke:#D94400,color:#8A2C0D,stroke-width:1.5px;
      classDef artifact fill:#FFFFFF,stroke:#B9ADA3,color:#51463F,stroke-width:1px;
      classDef app fill:#FFF1E8,stroke:#D94400,color:#8A2C0D,stroke-width:2px;
      classDef data fill:#EFF6F1,stroke:#8AA995,color:#315640,stroke-width:1px;
      linkStyle default stroke:#8C817A,stroke-width:1.5px;
  ```
</div>

Wisty uses Anthropic and OpenAI models for code generation through Vercel's AI Gateway. When the AI generates an image, it sends a text description to Google's image model. That description can reflect your instructions; the image request doesn't include the full conversation or your uploaded files.

## What an app can read

The running app reads Salesforce through Wisty's controlled proxy. Each request uses the signed-in user's Salesforce access, so object permissions, field-level security, and sharing rules still apply.

Your project also has its own [Salesforce access settings](/docs/building/salesforce-access). These limit the kinds of requests the app may make. Enabling a category in Wisty doesn't grant Salesforce permissions the user lacks.

Record data passes through Wisty while the app runs. Wisty doesn't store, cache, or log those record values.

## What an app can change

Record writes are off by default. You can allow a project to create and update records, and separately allow it to delete records.

A proposed change goes through Wisty's approval controls and runs as the current Salesforce user. You'll be asked to approve it unless you've enabled auto-approval for that app. Existing Salesforce validation rules and automation still apply.

Follow [Update Salesforce records](/docs/building/record-writes) to enable writes, review changes, and manage auto-approval. Wisty has no path for generated apps to create or change objects, fields, Apex, or Flows.

## Credentials and stored content

Salesforce OAuth credentials stay on Wisty's servers, encrypted with keys held separately in AWS KMS. Wisty uses them to make Salesforce requests; it doesn't give them to the generating AI or generated app code.

Wisty stores your projects, chats, generated code, attachments, and cached org metadata. Generation diagnostics can include instructions, metadata, and code. For processing locations, retention, deletion, and AI-provider terms, see the [security page](https://wisty.ai/security).

Generated code can send requests only to Wisty's Salesforce endpoints. [Where apps run](/docs/security/where-apps-run) explains the boundary around previews and published apps.