Connecting your data should feel safe.
Live data is our differentiator, so security is over-engineered from day one — read-only access, encrypted secrets, parameterized queries, and an audit log of everything the bot touches.
Security built into every layer
From the connection string to the model, safeguards at each step.
Read-only by design
Database connections run in a read-only transaction with a statement timeout. DELETE, UPDATE, DROP, TRUNCATE, and multi-statement queries are rejected before they reach your database.
Encrypted credentials
Database and API credentials are encrypted at rest with AES-256-GCM in a dedicated vault. They're decrypted only in-memory at query time, never exposed to the browser.
Full audit trail
Every SQL query and API call the bot triggers is logged — inputs, latency, success, and a result summary — so you always know what your assistant did and when.
Parameterized only
The model fills parameters into saved queries you wrote; it never assembles raw SQL, unless you explicitly opt into guarded text-to-SQL for a connection.
Your data isn't training data
We run open-weight models via Together AI under our control. Your content is used solely to answer your users' questions — never to train models.
Tenant isolation
Every record is scoped to your organization and enforced on every query. Enterprise plans add a path to VPC / self-hosted inference.
Compliance posture
The bot always discloses it's an AI, cites its sources, and keeps exportable logs — supporting transparency obligations like the EU AI Act. SOC 2 groundwork is in place, and an external security review is part of our roadmap. Need a DPA, a security questionnaire, or a VPC/self-hosted deployment?
Talk to usData you can connect with confidence.
Start free and see the audit log fill in as your bot answers.