Frequently Asked Questions: SolarWinds Avior Data Compliance
Introduction
SolarWinds® Avior™ is a standalone, multi-tenant SaaS application for goal-oriented agentic AI. It connects to customer environments through governed connectors and uses agents, skills, and tools to pursue operational outcomes.
Avior is not an unrestricted autonomous administrator. It is designed to operate within tenant, user, connector, tool, and goal boundaries. Read-only analysis can run without an environment change. Where action-capable workflows are enabled, proposed changes are authorized and routed through configured autonomy and human-in-the-loop controls. Low-risk actions may be eligible for automatic execution; higher-risk actions require review or explicit approval, and action execution is recorded for traceability.
The product is being delivered in stages. SolarWinds Observability Self-Hosted connectivity is the initial validated focus, while broader SolarWinds SaaS, additional portfolio products, third-party systems, and expanded automation are only for potential rollout or roadmap items unless the applicable release documentation confirms availability.
Product and deployment basics
What is Avior?
SolarWinds Avior is a standalone agentic AI application and cross-product control plane for IT Operations. Customers define or instantiate an operational goal, and Avior uses curated agents, skills, tools, and connected data to investigate conditions, explain findings, measure progress, recommend next steps, and—where the workflow permits—take governed actions.
The central primitive is the goal. A goal defines the desired operational outcome, success criteria, guardrails, scope, and autonomy boundary. Examples include reducing alert noise, preventing capacity incidents, accelerating incident investigation, improving compliance evidence, and guiding service restoration.
It leverages agentic AI to help define goals that drive outcomes in customer environments, and helps customers find answers and insights, and act in their environment. Over time, SolarWinds intends that Avior will be able to connect to all SolarWinds products and an increasing number of third-party products in customer environments.
How is Avior enabled?
For SolarWinds Observability Self-Hosted, an administrator enables Avior at the tenant level by configuring Platform Connect, which is opt-in for administrators, and installing the connector.
Data flow and data minimization
What data does Avior send to an external language model?
Avior processes the minimum relevant context needed for a request or goal, which may include metrics, alerts, configurations, events, findings, tickets, or knowledge context, depending on the connected system and workflow. The agent is restricted to retrieving data through approved tools and scopes.
Avior is not intended to copy an entire customer environment into a language model. Data access is request-and goal-scoped, and connector access is governed by authorization and tool policy.
Only data that the requesting user is already entitled to access is available as input. Limited sensitive content may be included when it is necessary to answer the request.
Does customer data leave the customer environment?
Relevant context may leave the connected customer environment to reach the Avior service – and, for inference, a managed model provider. The design goal is to send only the context necessary for the request or goal, over protected connections, under the applicable dataflow and authorization controls.
What kinds of data are in the intended use case?
Typically, operational IT data, such as device metrics, alerts, network-device configurations, and related observability data are in scope.
PHI, HR data, financial data, and individual personal data are not in scope for the intended use case. Customers remain responsible for the data they place in their environment and the requests their users submit.
Models, providers, and customer data
Is customer data used to train or fine-tune the models
No. Customer data is not used to train third-party language models; model-provider interactions are designed to be stateless at the LLM layer; and customer data is not shared with or made accessible to other customers for model training.
How is access to Avior controlled?
Avior inherits the existing user, role, and permission model of the SolarWinds product. Users should see only data and actions they are already entitled to access.
Does Avior bypass existing Role Based Access Control (RBAC) to obtain a better answer?
No, Avior is designed to operate under the authenticated user’s identity and permissions. Tool access is intended to be least-privilege and scoped to the user’s tenant and product instance.
Is customer data isolated between tenants?
Tenant-scoped access and isolation are at the core of Avior. The user’s permissions and product-instance scope are enforced at multiple layers.
Can administrators disable Avior?
Yes, administrators can disable Avior at the tenant level by disabling the connector to the product.
Security controls and threat mitigation
Is Avior traffic encrypted?
Yes. Data exchanged between SolarWinds products, the SolarWinds platform, and external model providers is encrypted in transit and at rest.
Data residency, privacy, and deletion
Where is Avior ai-related data stored?
The AI-related data retained by SolarWinds, prompts, context, outputs, and logs is stored in the same region or regions as the customer’s Platform Connect instance once Avior reaches GA. The retention follows SolarWinds privacy and retention policies. During early access, this data is stored in AWS US-East-1.
What privacy laws may apply?
Applicable obligations depend on the customer, geography, data, product, and purpose. This includes GDPR in Europe and CCPA and other applicable state privacy laws in the United States. For more information kindly refer to our Privacy Policy at https://www.solarwinds.com/legal/privacy
What contractual documents govern use of Avior?
The (1) SolarWinds End User License Agreement and SaaS Supplemental Terms and/or (2) Software as a Services Agreement are applicable.