This page exists so your security team can say no quickly — or yes with confidence. Plain language, and the diagram below is not decoration: it is the whole architecture.
Every customer runs on a dedicated server. There is no shared database to misconfigure and no tenant boundary to leak across. The strongest isolation is physical.
The box connects to your databases with read-only credentials you issue — over an IP allowlist, an SSH tunnel, or WireGuard, whichever your network team prefers. Nothing is installed inside your network, and no inbound access to it is required. A write-blocking query guard, per-query timeouts, and row caps sit in front of every connection: one bad question can’t hurt a production database.
Access links are scoped. A business-scoped link reaches only the curated datasets and parameterized tools you’ve approved — your raw tables are not queryable through it, by SQL or by AI. Tool parameters are bound as values, never interpolated into queries: a malicious input cannot become SQL.
Each query is logged: who asked, when, the exact SQL executed, and how many rows came back. Row caps bound the data volume of any single query, and unusually heavy extraction is flagged. “What has this account pulled in the last week?” is one view, not an investigation.
AI access is pull-only: the box never pushes your data to any AI provider, never trains anything, and answers only what it is asked. When one of your users asks a question in Claude, the rows returned for that answer transit Anthropic’s service under your organization’s own Claude agreement — the same terms you already accepted to use Claude at all. For your strictest data, keep it out of the shared scope entirely: with curated-only links, the AI can see approved aggregates while the underlying rows are never reachable.
Managed boxes run on EU infrastructure (Germany or Finland). Nightly backups leave the box client-side encrypted for separate object storage, and recovery is two-layer and documented: full-state snapshots for fast restore, plus the entire configuration as a reviewable YAML manifest — so a box can be rebuilt from code even if a snapshot is lost. We test restore-fetches routinely; a backup that has never been pulled back is a hope, not a backup.
The whole product is a single dependency-free binary. No runtime, no framework tree, no container orchestra — one file your team can hash, review, and run air-gapped if policy demands it. Configuration arrives as YAML you can read in a code review.
No trackers, no analytics, no cookies — which is why there is no cookie banner. We treat your browsing the way we treat your data.