Ask AI
Skip to main content

AI and MCP data flows

Co-Dex.eu bv provides the NoCode-X platform and Breezebot, a service built on it. Customers can create full web apps, actions, workflows, processes and storage. They choose which AI capabilities to use and which information those capabilities need. This guide explains where information goes and which party is responsible.

Choose the route that fits your application​

RouteWho selects and contracts for AIWhat can leave NoCode-X
External AI client calls NoCode-X MCPThe customer chooses the client, model and accountResults of authorised tool calls returned to that client
BYOK for embedded AI or connectorsThe customer supplies its own provider account and API keyInputs and context selected by the configured workflow; responses return through that route
Built-in AI connectorsCo-Dex provides the interface; current providers are OpenAI and GroqInputs and context selected for the invoked feature, processed by the chosen managed provider
NoCode-X or Breezebot calls an external MCP serviceThe customer chooses the connection and workflow; the operator depends on the serviceTool arguments, selected records and results needed for that call

Customers may select compatible Mistral, OpenAI, Anthropic, Groq or other hosted or self-hosted models through available API or MCP interfaces. These are examples of choices, not a promise that every model or protocol feature is supported. Check the capabilities and settings of the chosen interface. A model developer and the party hosting that model may be different organisations.

BYOK means Bring Your Own Key. It does not imply local processing, zero retention, that information bypasses NoCode-X, or that the provider has no separate responsibilities. Using built-in connectors puts the AI usage on the Co-Dex invoice; the applicable data protection obligations still apply.

External AI calls NoCode-X​

The external client can process the instructions the user supplies and the results it receives. It may retain conversation history under its own product, account and contract settings. A read-only tool can still disclose personal data through its result. Authorise only the applications, resources and actions required for the task.

NoCode-X retains build instructions and results necessary to facilitate the application. It does not independently forward production records or personal data to an external AI provider. This does not prevent a customer from configuring a workflow that sends such data or authorising a tool call that returns it. Instructions, examples, schemas, error messages and tool results can contain personal data if the user includes it.

AI or MCP calls from a customer workflow​

Only the selected route is involved. If an optional integration runtime such as Composio is enabled, that runtime is an additional recipient of the parameters, authentication context and results needed for execution. See the supply chain. Self-hosting the NoCode-X platform does not make an external model or connector local.

Responsibilities​

The customer normally determines the purposes of processing in its applications and acts as controller. Co-Dex processes that data on its behalf under the DPA. Where the customer is itself a processor, the instruction chain must cover Co-Dex as sub-processor. Co-Dex acts as controller for its own purposes, as described in the privacy policy.

For providers engaged by Co-Dex to process customer data, Co-Dex is responsible for the applicable sub-processing arrangements. Customers manage services they contract directly, including BYOK accounts and external AI clients. Neither model choice nor API-key ownership alone determines a provider's legal role. Co-Dex remains responsible for its own processing, credential handling and connection functionality.

An OAuth or connector authorisation grants technical access. It is not automatically consent from everyone whose data is accessible. Customers must have a lawful purpose, inform affected people where required, and select only the necessary data. Do not include personal data or secrets in build prompts when synthetic examples suffice.

Platform measures and customer configuration​

NoCode-X provides tenant isolation, permission checks on MCP requests, protected credential storage, logging and confirmation of risk-sensitive actions. Customers must still assign appropriate permissions and configure the data and destinations used by their apps. A connected AI model does not receive additional rights merely because it is AI. Support access remains subject to the access arrangements described in Data Residency.

Before enabling a workflow, check which provider receives each input and result, which account and contract apply, and whether the selected feature permits the intended data. Review storage, feedback/training settings and geographic processing for that specific service. A provider's no-training setting does not mean no storage. See hosting and external processing and the current managed-provider list.

Documents, embeddings and deletion​

An embedding is a numerical representation used for tasks such as semantic search. A knowledge feature can process source documents, text fragments, vectors, metadata and the context retrieved for an AI call. These records can contain or remain linked to personal data; converting text into vectors does not establish anonymity.

Apply the appropriate access rules and retention instructions to the source and derived records. Deleting a source file should be considered together with its index and cached copies in the deletion request. Separate copies held in an independently contracted AI client or provider must be handled through that service. Disconnecting a tool stops future authorised access; it does not automatically recall information already returned.

See Auditability for platform logs, Opting out for the service closure process and DPA section 13 for return and deletion obligations.