A summary of the controls a security reviewer needs. The core principle: the AI authors SQL but never executes anything unchecked — every query is validated and row-level-security-filtered before it runs.
SELECT/CTE only; INSERT/UPDATE/DELETE/DROP/ALTER/CREATE/TRUNCATE/EXEC blocked; multi-statement rejected.
Every company is a separate organization; every row carries an org ID. Reads filter by org, writes stamp it — one tenant can never see another's data. Enforced in code and guarded by an automated isolation test suite in CI.
Within a tenant, application-layer per-user/role WHERE filters injected at query time; column masking for sensitive fields. (Application-level, not database-native RLS policies.)
5 roles, 21 granular permissions, fully editable; UI driven purely by permission checks. Users can belong to multiple groups within their org.
Admins control which groups may access each AI agent (chat & autonomous). Default is open to the org; restrict an agent to specific groups and access is enforced everywhere it's used, with a per-user access report.
Insert-only record of sensitive actions (no update/delete endpoints): actor, action, resource, IP, timestamp.
JWT + bcrypt; timing-safe comparison; refresh-token rotation; SSO via Google/Microsoft/OIDC; optional MFA (TOTP, standard authenticator apps) with single-use recovery codes.
15-minute idle auto-logout, cross-tab sign-out; single-use, 1-hour, anti-enumeration password resets.
password, api_key, secret, token, ssn, credit_card auto-stripped from all results.
30 req/min per IP + 60/min per user on chat; HTML/JS stripped, input capped.
Config via environment variables only; connector credentials encrypted & masked; CORS locked to configured origin.
0 known vulnerabilities across server & client; daily npm audit snapshots monitored in-app.
Point-in-time database restore verified end-to-end against production (not just "backups run") — daily snapshots retained 14 days.
Connectors query live over pooled connections; results aren't warehoused by the platform.
Model calls use your provider keys; you control the AI vendor relationship and data-processing terms.
The hosted MCP server (Claude Desktop / Cursor / Kiro) authenticates each connection with a revocable per-user token — never a shared database connection string. Because the session resolves to a specific user, the same governance as the web application applies: organization isolation, plan entitlements, agent access rules, row-level filters and column masking, read-only validated SQL, and audit-log entries for every call. AI-powered tools run on the customer's own AI key (BYOAK). Each MCP tool can also be toggled on or off in Governance. (The raw-dataset AI tools are limited to the local operator mode; hosted tenants use the governed query_agent path.)