Security and data handling
Where credentials live, what leaves your database, and what a shared link exposes.
Credentials
Connection credentials are encrypted at rest and never returned to the client. The UI shows a redacted summary; there is no endpoint that hands back a password.
Queries are read-only
The agent only ever issues read queries. This is enforced in the product, but it
is not a substitute for a scoped database role: grant SELECT on what should
be queryable and nothing else.
What leaves your database
Query results are sent to the model to be interpreted and described. Rows that a query returns are therefore seen by the model provider for that turn. Choose your model accordingly, and consider an enterprise deployment where the model runs inside your own cloud.
Public surfaces
Two things can be made public: a shared thread and a shared dashboard. Both are snapshots or projections with connection details stripped, both are rate-limited, and both are revocable.
Offboarding
A tenant sweep removes stored artefacts on request. Uploaded files carry a TTL so abandoned uploads do not accumulate indefinitely.
A share link is unauthenticated
Anyone with the URL can read it. Revoke links you no longer need rather than relying on the URL being hard to guess.