Appearance
Data, limits and records
This page answers three questions: what can leave the gateway when Iris is on, what Nexus keeps about it, and how much it can cost. It is the page to read before you switch a feature on, and the one to show whoever signs off on it.
What can be sent
Only Nexus talks to a model, and only after a person asks, an agent runs or a script calls. Nothing is sent to Raylux. What goes to your model depends on the feature:
| Feature | What a prompt can contain |
|---|---|
| Designer assistant | Your messages; scripts, expressions and SQL you share or have open; screen and component JSON; tag paths, descriptions and live values it looks up; alarm text it looks up |
| Subsystem summaries | Tag values and quality; active and recent alarm text; short tag history; device connection status; recent audit entries; screen text and tag bindings |
| Operator chat | The operator's messages; tag values and quality on the screens they can see; alarm text; screen text |
| Agents | Tag values; alarm text and history; log lines; audit entries; the agent's own instructions |
| Gateway scripts | The prompt a script writes, and whatever data it passes in (up to 32 KB) |
| AI clients over MCP | Whatever the client's tools read. The client sends it to its model, not yours |
These are ceilings, not promises: the tools return only what the signed-in person's role could already read, so a prompt for an operator carries less than one for an administrator. Security › Iris AI shows this table live, per feature, beside the model that will receive it.
What is never sent
API keys, passwords, tokens and connection strings; Raylux license keys; and the model provider's own key, which stays in the gateway's secrets store. Before any text is sent, Nexus removes:
- the literal value of every secret the gateway holds;
- anything shaped like a secret: bearer tokens, JWTs, Iris API keys (
rlx_…), common model-provider keys,password=…and"token": "…"pairs, credentials in a URL, and any unbroken run of 256 or more key-like characters.
This is a net, not a promise that no sensitive plant information can reach a model. A tag called Boiler/SecretRecipeTemp is just a tag name. If a piece of data must not reach a model, use a model that is on your own network.
Where it goes
Each provider carries the Where it runs setting you gave it:
| Setting | Data goes |
|---|---|
| Local | To a model on this machine or your network. |
| Private | To an endpoint your organization controls. |
| Cloud | To a third party, outside your network. |
Choose Cloud for OpenAI, Anthropic (Claude) and Azure OpenAI, which are third parties. Pick Local with Ollama, vLLM or LM Studio when the plant must stay air-gapped. Whether a small local model is good enough is a decision to make by trying it.
What Nexus keeps
| Record | Contents | Kept |
|---|---|---|
| Audit log | One row per call: who, which feature, which model, tokens, which tools, how it ended. AI_CHAT, AI_ASSIST, AI_SUMMARY, AI_TOOL_CALL, AI_AGENT_RUN, AI_SCRIPT_ASK, AI_PROPOSAL_*, AI_PROVIDER_*, AI_SETTINGS_UPDATE, AI_TRANSCRIPT_*, and MCP_* for keys. Tool arguments are redacted and cut to 300 characters. | With the audit log |
| Transcripts | The conversation as it was sent to the model (after redaction) and the reply, with the tool calls. | 30 days by default; Security › Iris AI › Transcripts sets it, 0 keeps none |
| Usage | Tokens per day, provider, person and feature, for the budgets. | 400 days |
| Agent runs and proposals | The run history and the decided proposals. | As long as transcripts. A pending proposal is never deleted for age |
From Transcripts an administrator can export or purge them; both are audited. A transcript can hold plant data, so treat it as you treat the audit log. The audit log and the transcripts never hold a provider key or an MCP key.
Backups
Iris's files are in the data directory: raylux_ai.json (settings, no key), raylux_ai.db (usage, transcripts, runs, proposals) and raylux_mcp_keys.json (MCP keys, as hashes). A data-directory backup carries all three. A configuration backup carries the Iris settings, for someone with Iris administration, and nothing else of Iris's. See Backup and restore.
What it can cost
Cloud models charge by token. Iris keeps this in your hands:
- Limits per person (and per MCP key): daily and monthly tokens and a request rate. A person or key can have its own limit.
- Per provider: the same, for everyone together.
- Per operator session: a rate and a token limit for each browser tab or Lens window.
- Per agent run: a token cap, and a limit on runs per hour; and a gateway-wide cap on runs started by triggers.
- Per gateway script identity: its own rate and token limit.
When a limit is reached the call is refused cleanly, naming the limit and when it clears. Nothing else is affected. A call that crosses a limit can overshoot it by its own size, because the cost is known only after the model answers. Usage shows today and this month against each limit.
The cost to the gateway itself is small. In a load test on the Pi profile (400 tags scanned once a second, alarm storms, and six people chatting at once) the tag scan and notification timings with Iris busy were within a few milliseconds of Iris idle.