How BI tools' AI assistants handle your data: models, training, retention, and permissions in 12 tools (October 2026)

As of October 2026, 10 of the 12 BI tools we checked state that data sent to their AI assistant does not train the underlying models, and Power BI, Tableau Cloud, ThoughtSpot, Hex, Qlik, and Databricks document zero data retention at the model provider. The differences that matter are elsewhere: Sigma’s AI feature terms let Sigma train its own AI features on your inputs and outputs, Looker keeps conversations until a user deletes them, Amazon Quick Sight and Qlik’s agentic assistant can process prompts outside your home region, and ThoughtSpot, Tableau Cloud, and Qlik start with AI off while Power BI, Omni, Metabase, Hex, and Quick Sight start with it on.

This is a compiled reference, not a ranking. Every cell below comes from the vendor’s own documentation, trust page, legal terms, or pricing page, opened on October 13, 2026, and each fact card links its sources. Where a vendor is silent, the cell says “not documented”. Treat those cells as questions for the security review, not as answers.

How we compiled this

We picked 12 BI tools with a built-in AI assistant that buyers ask about most often, then read each vendor’s AI privacy and security documentation. For each tool we recorded:

1. Model provider: which LLMs power the assistant by default and where they run.
2. Training: whether prompts, data, or outputs can train any model, the vendor’s or the provider’s.
3. Retention: whether the model provider keeps prompts and responses, and how long the BI vendor stores chat history.
4. Bring your own model: whether you can route AI calls through your own API key, cloud account, or warehouse-hosted model, and on which plan.
5. Data sent: whether the model sees only metadata, sampled field values, or query result rows.
6. Permissions: whether the assistant is limited to the rows and columns the user can already see.
7. Admin controls, residency, and audit: the default state, where inference runs, and whether AI activity is logged.

We used the questions buyers actually ask: “How do LLM assistants in modern BI tools protect sensitive data while generating explanations?”, “Which AI analytics tools don’t train on customer data?”, and “Are there any GDPR compliant AI BI tools?”

Which BI tools train on your data, and which model sees it?

Two patterns stand out. Tools that explain results in prose (Basedash, ThoughtSpot Spotter 3, Omni summaries, Looker, Hex, Databricks Agent mode) send query results to the model, while Metabase’s managed service and Omni’s query generation keep result rows away from it. And “bring your own model” ranges from required (Sigma) to Enterprise-only (Omni, Hex, Basedash Cloud) to unavailable (Qlik).

Does the AI respect row-level security, and can admins turn it off?

Every tool scopes the assistant to the asking user’s permissions in some form. The gaps are in what the permission model covers: Basedash row-level security works only on Postgres, Hex enforces warehouse row-level security only through personal OAuth connections, and Omni describes permissions as topic, model, and connection access rather than row filters. For a deeper look at how these tools implement row-level security outside the AI features, see our row-level security comparison.

Fact cards

Each card lists what the vendor documents as of October 13, 2026. For SSO, SCIM, and audit logs by plan, see our BI security features by plan reference. For what each plan costs, see our BI pricing and AI cost reference.

Power BI (Copilot in Fabric)

• Best for: Microsoft 365 organizations whose security team already approved Azure OpenAI.
• Not ideal for: tenants outside the US and EU that cannot allow cross-region processing.
• AI plan (verified October 2026): Copilot needs a paid Fabric F2+ or Premium P1+ capacity; Pro or Premium Per User alone is not enough (Copilot requirements).
• Model and training: Azure OpenAI by default, and “Your data isn’t used to train models and isn’t available to other customers” (Copilot privacy).
• Retention: Microsoft removed its 30-day abuse-monitoring retention and “no longer store[s] prompt related data”. Power BI Copilot does not keep prompts after the session ends (Power BI Copilot privacy).
• Data sent: grounding data “might include a combination of dataset schema, specific data points, and other information relevant to the user’s current task”. The Fabric overview says table content is not sent unless you direct it, so ask Microsoft which applies to your workloads.
• Admin controls: enabled by default for the tenant on paid capacities, and can be limited to security groups (enable Copilot).

Tableau Cloud and Tableau Server

• Best for: Salesforce customers who want PII masking before prompts reach the model.
• Not ideal for: teams that need a guarantee that inference never leaves their region.
• AI plan (verified October 2026): Tableau Agent in authoring, Prep, and Catalog requires Tableau Cloud+ or Tableau+; Tableau Server 2025.3+ supports it with your own LLM (AI settings).
• Model and training: Azure OpenAI through the Einstein Trust Layer, with “No data is used for LLM model training or product improvements” and zero data retention at the provider (Einstein Trust Layer). Tableau’s data usage page also says AI inputs “may be used to improve your services and features” (AI data usage), so ask which statement your contract follows.
• Data sent: field metadata plus up to 1,000 sampled unique string values; pattern-based PII masking before the prompt is sent.
• Residency: requests go to the Azure OpenAI instance for your Data Cloud region and are routed to the US if the model or capacity is unavailable (AI in Tableau and trust).
• Tableau Server: requests go straight to your OpenAI or Azure OpenAI account and skip the Einstein Trust Layer, including its PII masking (Tableau Server AI setup).

Looker (Gemini in Looker)

• Best for: Google Cloud teams that want the assistant bound to a governed LookML model.
• Not ideal for: compliance programs that need admin-enforced chat retention limits.
• AI plan (verified October 2026): included on Looker-hosted instances with monthly token quotas by edition; not available on customer-hosted instances (Looker pricing).
• Training: “Gemini doesn’t use your prompts or its responses as data to train its models” (Gemini data governance); the Trusted Tester setting is the exception.
• Retention: conversations are kept until a user deletes them, then purged after 30 days, and admins “cannot bulk-delete conversation history or enforce custom retention periods” (Gemini in Looker).
• Data sent: LookML metadata, up to 100 sampled values per field, and query results up to 50,000 rows (Conversational Analytics).
• Residency: inference runs on a global service; EU-localized processing is available on Looker 26.10 and later.

Amazon Quick Sight

• Best for: AWS organizations that want AI chat billed alongside the rest of their AWS account.
• Not ideal for: teams that must keep inference in a single region, since cross-region inference cannot be disabled (outbound connections).
• AI plan (verified October 2026): Professional at $20 per user per month and Enterprise at $40, each plus a $250 monthly infrastructure fee per account; dashboard and dataset authoring needs Enterprise (pricing).
• Model and training: built on Amazon Bedrock (generative BI); “Amazon Quick does not use customer data for training or improving underlying LLMs” (data protection).
• Retention: conversations kept on a rolling 30-day window, then deleted (user data handling), though the chat page describes 90 days of history.
• Admin controls: the system chat agent is available to all users by default; “Deny by Default” custom permissions stop new AI features from switching on automatically.

ThoughtSpot (Spotter)

• Best for: regulated teams that want AI off by default and enabled per data model.
• Not ideal for: buyers who need self-serve bring-your-own-LLM; it is configured through support and is experimental for Spotter 3.
• AI plan (verified October 2026): Pro from $50 per user per month, billed annually, with 25 Spotter queries per user per month; Essentials at $25 has no Spotter (pricing).
• Model and training: Azure OpenAI GPT models plus Gemini and Claude on Vertex AI; “No customer data is used for LLM training” (Spotter security).
• Retention: zero data retention with providers; Spotter 3 caches results for up to six hours, and chat history and the conversations Liveboard keep 180 days (Spotter data handling).
• Permissions: rows and columns hidden by row- or column-level security are “never sent to the Large Language Model”.
• Bring your own model: Bedrock, Azure OpenAI, Databricks, Vertex AI, Snowflake Cortex, or a custom gateway (BYOLLM).

Sigma

• Best for: warehouse-first teams that want AI to run inside Snowflake, Databricks, or BigQuery under their own agreements.
• Not ideal for: security reviews that require a vendor commitment never to train on AI inputs.
• AI plan (verified October 2026): Sigma Assistant is available from the View license; plan prices are not published (license types).
• Model: you configure a warehouse AI model or an external provider (OpenAI, Azure OpenAI, Gemini, Anthropic in beta, Bedrock), and with a warehouse model Sigma does “not transmit your Input Data, Prompts, Customer Data, or User Information to any additional third-party AI model” (AI notice).
• Training: “Customer agrees that Sigma may use AI Inputs and AI Outputs to train or fine-tune AI Features solely to understand and improve Customer’s use of the Service” (AI feature terms, updated August 11, 2026).
• Retention: chat history stored for 30, 60, or 90 days after inactivity, or in your own bucket (chat history).
• Residency: Gemini uses a global endpoint; Snowflake Cortex may require cross-region access (external AI). Comparing options? See our Sigma alternatives.

Omni

• Best for: teams that want query generation to see metadata only.
• Not ideal for: Canadian or Indian deployments that need in-country inference (AI inference regions).
• AI plan (verified October 2026): AI runs on credits with an included allotment and optional overage; plan prices are quote only (AI usage).
• Model and training: Bedrock on AWS or Microsoft Foundry on Azure, and data “will not be used for training” (Omni AI security).
• Data sent: “no private, relational, or result set data is shared to generate queries”; summaries send a CSV of the current results, and admins can turn off result reading (AI features).
• Retention: summary responses kept 30 days.
• Bring your own model: Anthropic, Vertex AI, OpenAI, xAI, or Databricks endpoints on the Enterprise plan (model providers).

Qlik Cloud Analytics (Qlik Answers)

• Best for: teams that want PII stripped automatically before the model sees anything.
• Not ideal for: organizations that want to use their own model or keep agentic AI in-region.
• AI plan (verified October 2026): Qlik Answers is included with Standard, Premium, and Enterprise editions (editions).
• Model and training: Claude on Amazon Bedrock; “Qlik does not use the customer’s data to train any AI model external to the customer’s tenant” (Qlik Answers).
• Data sent: user input, metadata, and tenant data, with PII and secrets removed before sending and restored in the answer.
• Residency: the agentic experience requires opting in to cross-region inference; processing is transient (cross-region processing).
• Retention: questions and responses logged in your tenant with tenant encryption; nothing retained by AWS or model providers (Answers security).

Metabase (Metabot)

• Best for: self-hosted teams that want AI with their own key and no paid plan.
• Not ideal for: EU buyers on the managed AI service, whose subprocessors are Anthropic and OpenAI in the US (subprocessors).
• AI plan (verified October 2026): Metabot works on every plan with your own provider key; the managed Metabase AI service is Cloud-only at $3.75 per 1M tokens (pricing).
• Data sent: prompts, metadata, and sampled field values; “we don’t send the results of your queries to a third-party AI provider” (AI privacy).
• Retention: AI usage and conversation tables are kept 180 days by default, adjustable from 30 days to indefinitely.
• Admin controls: Metabot is on by default; a “Disable all AI features” switch turns off everything, and per-group controls need Pro or Enterprise (AI settings).

Hex

• Best for: data teams whose AI works on notebook code and cell outputs.
• Not ideal for: governance programs that need the AI’s schema suggestions filtered to each user’s access.
• AI plan (verified October 2026): Threads on all plans with per-seat credits; Notebook Agent on paid plans; bring-your-own-key on Enterprise (AI data privacy).
• Training: “Hex’s LLM providers do not train on customer data”, but “Depending on your plan, Hex may use data from your AI sessions to improve Hex’s AI features”, with an opt-out in settings.
• Retention: zero data retention by default; some advanced models require provider retention and only run if an admin allows it.
• Data sent: project code, cell outputs, schema, and prompts (privacy FAQ).

Databricks AI/BI (Genie)

• Best for: lakehouse teams that already govern data with Unity Catalog.
• Not ideal for: teams outside Databricks, or buyers who want to bring their own model to Genie.
• AI plan (verified October 2026): Genie Agents need a pro or serverless SQL warehouse; user usage is free until January 31, 2027 (Genie costs).
• Training and retention: data is not used to train foundation models Databricks offers to third parties, and partners “do not retain data you submit through these features, even for abuse monitoring” (Databricks AI trust).
• Permissions: “all data sent to AI assistive feature models respect Unity Catalog permissions”.
• Admin controls: the partner-powered AI setting is on by default without a compliance security profile, and Genie needs it. Databricks is removing the toggle: workspaces keep their current value, and after November 1, 2026, changes go through your account team (partner-powered AI).

Basedash

• Best for: teams that want an AI data analyst on live SQL databases, with a self-hosted option when model routing and residency are non-negotiable.
• Not ideal for: teams that need row-level security on warehouses other than Postgres, regional hosting on the managed cloud, or an AI-off mode in the cloud product.
• AI plan (verified October 2026): Startup $1,000 per month with up to 25 users and $1,000 in monthly AI credits on OpenAI models; Enterprise adds custom AI models, SSO, SCIM, audit logs, and self-hosting; 14-day trial with no card (pricing, pricing docs).
• Data sent and training: table and column names plus SQL query results go to the AI provider, and data “is not used for training purposes by either Basedash or AI model providers” (security docs). SOC 2 Type II, with the report on request (security).
• Permissions: Postgres row-level security through a basedash.groups session variable set on every Postgres query (row-level security); data source grants enforced in AI chat (access control); hidden tables, schemas, and columns are unavailable to the AI (data visibility).
• Bring your own model: self-hosted deployments use OpenAI, Anthropic, Azure OpenAI, Amazon Bedrock, xAI, OpenRouter, or an internal OpenAI-compatible gateway, or run without an AI provider (self-hosting configuration, self-hosting).
• Residency and retention: managed cloud servers are in San Francisco; provider-side retention is not documented, and custom retention is handled with support or by self-hosting.

Which BI tool fits your AI data policy?

• Your policy forbids any training on AI inputs: Power BI, Tableau Cloud, Looker (with Trusted Tester off), Amazon Quick Sight, ThoughtSpot, Omni, Qlik, and Basedash state no training. In Hex, opt out in settings. In Sigma, negotiate the AI feature terms.
• You need AI processing to stay in the EU: ThoughtSpot (region-specific models), Power BI (capacity geography with cross-region off), Looker 26.10+, and Omni on AWS EU document it. Amazon Quick Sight keeps inference within a geography but cannot pin a region, and Qlik’s agentic assistant requires cross-region opt-in.
• You must route AI through your own cloud account: Sigma requires it, Omni and Hex offer it on Enterprise, ThoughtSpot offers it through support, Metabase offers it on every plan, and Basedash supports it on Enterprise and in self-hosted deployments. Qlik does not offer it.
• You want AI off until you enable it: ThoughtSpot, Tableau Cloud, and Qlik’s agentic permissions start off; Sigma stays inactive until a provider is connected. Power BI, Omni, Metabase, Hex, and Amazon Quick Sight start on.
• You cannot send result rows to an LLM: Metabase’s managed service and Omni’s query generation send metadata and samples only. Tools that write prose answers from data (Basedash, Looker, ThoughtSpot Spotter 3, Hex, Databricks Agent mode) need results to do it.
• You need the AI to respect row-level security: Databricks (Unity Catalog), ThoughtSpot, Looker (LookML), Power BI, Sigma, Qlik (Section Access), and Amazon Quick Sight Enterprise document it in their own security models; Basedash enforces database policies on Postgres; Hex enforces warehouse permissions only through personal OAuth connections.

Frequently asked questions

How do LLM assistants in BI tools protect sensitive data when they generate explanations?

Most BI assistants protect sensitive data in three layers. First, they run queries as the asking user, so row-level and column-level security filter the data before any of it reaches the model; ThoughtSpot, Databricks, Sigma, and Looker document this explicitly. Second, they limit what is sent: Metabase’s managed service sends metadata and sampled values but never query results, while Tableau Cloud and Qlik mask PII before the prompt leaves. Third, contracts with model providers forbid training and, in most tools, retention. Explanations that summarize results still require sending those results, so check which tier your tool uses.

Which AI analytics tools don’t train on customer data?

As of October 2026, Power BI Copilot, Tableau Cloud, Amazon Quick Sight, ThoughtSpot, Omni, Qlik, and Basedash all state that customer data is not used to train models. Looker’s Gemini features say the same unless an admin opts in to the Trusted Tester program. Hex’s model providers never train on customer data, but Hex itself may use AI sessions to improve its features depending on plan, with an opt-out. Sigma’s AI feature terms permit Sigma to train or fine-tune its AI features on your inputs and outputs. Databricks rules out training foundation models it offers to third parties.

Are there any GDPR compliant AI BI tools?

GDPR compliance depends on your setup, not on a vendor badge, but several tools give you the controls it needs. ThoughtSpot uses EU-based models for EU customers, Power BI keeps Copilot processing in the capacity’s geography unless an admin allows otherwise, Looker offers EU-localized processing from version 26.10, and Omni’s EU deployments infer in the EU. Self-hosted options such as Basedash and Metabase with your own provider let you choose the region outright. Watch for defaults that cross borders: Hex lists Anthropic processing in the US, and Qlik’s agentic assistant requires cross-region inference.

Are there any HIPAA compliant AI BI tools?

No BI tool is HIPAA compliant by itself; compliance comes from a signed business associate agreement plus your own controls. Before sending protected health information through an AI assistant, confirm the agreement covers the AI feature and its model subprocessor, not just the core BI product. Tools that run models inside your own cloud account (Sigma with a warehouse model, ThoughtSpot or Omni with your own provider) or fully self-hosted options keep the model under agreements you control. Basedash recommends self-hosting for HIPAA workloads and supports bringing your own AI provider or none.

What should I ask a BI vendor about its AI assistant before signing?

Ask six questions and get the answers in writing. Which model provider and region process prompts, and can that change without notice? Can prompts, data, or outputs train any model, including the vendor’s own features? How long do the provider and the vendor keep prompts, responses, and chat history, and can admins shorten it? Does the model see metadata only, sampled values, or full query results? Does the assistant run queries under the user’s row-level and column-level security? Can admins disable AI by group, and are prompts and responses audit-logged?

How do executives use AI in self-service BI without weakening data governance?

Executives should get the same permission model as every other user, not a broader one. Give the assistant governed definitions to work from, such as a LookML model, Omni topics, or Basedash models, so answers use approved metrics. Hide sensitive tables and columns from the AI entirely where the tool supports it: Basedash does at the organization level, and ThoughtSpot lets you enable AI only for specific models or columns. Turn on AI audit logging where available (Metabase transcripts, Omni prompts, Qlik events) so you can review what was asked.

Do BI AI assistants send my query results to OpenAI or Anthropic?

It depends on the tool and the feature. Metabase’s managed AI service sends prompts, metadata, and sampled field values but not query results. Omni sends only metadata to write queries, then a CSV of results when you ask for a summary. Basedash, Looker, Hex, ThoughtSpot Spotter 3, and Databricks Agent mode send result data so the model can explain it. Power BI routes through Azure OpenAI, not the public OpenAI API, unless an admin opts in to OpenAI as a Microsoft subprocessor. Qlik and Omni run Claude on Amazon Bedrock rather than calling Anthropic directly.

For how AI assistants get numbers wrong and how to catch it, see our guide to hallucinations in AI BI tools.