Security, and what we’re honest about.

Tenant isolation

One enforced boundary, tested from the outside.

Every read of your data passes through a single, fail-closed checkpoint that refuses any query reaching outside the authenticated client. Beneath it, the database engine applies a per-tenant policy as a second layer, and data is physically ordered by tenant, so one client’s query only ever touches its own storage, rather than filtering others’ out after the fact.

• Adversarially red-teamed against the live system, probing for a cross-tenant read from every angle. None was achievable.
• Covered by tests that assert refusal, not just that the happy path works.
• The natural-language assistant was held to the same bar, red-teamed with a second tenant holding values the first could never see. No cross-tenant match was achievable, and any column can be excluded from matching, which erases what was already indexed.

Least privilege

A small blast radius, verified.

The application reaches the warehouse through narrowly-scoped database identities (read-only, ingest-only, and owner), each stripped of the ability to read external sources, reach the engine’s internal tables, or run destructive statements. We confirmed those denials live: every such attempt is refused by the engine.

Data handling & privacy

Encryption, backups, and your data on your terms.

• All traffic over HTTPS/TLS; off-site backups encrypted at rest, with backup freshness monitored, a missing backup raises an alert, not a silent gap.
• Your analytics data is exportable on request and on exit; an acceptable-use policy keeps payment-card and special-category data off the platform.
• A Data Processing Agreement (GDPR Art. 28) is published; a current sub-processor list is available on request. Hosted in the United States.

Availability

Monitored, with the status public.

Every service is monitored by an independent uptime console with a public status page, and failures raise alerts rather than being discovered after the fact. Deploys are gated on a health check that round-trips the whole stack before traffic is switched.