Skip to content

Security posture

datarelix.ai is built so that "we sent your data to an LLM" is never a true statement.

The LLM never executes tools directly.

It produces a structured plan (Intermediate Representation). The orchestrator validates and executes — so a hallucinated function call cannot reach your database or your network.

SQL is parsed and validated before execution.

We use sqlglot to parse every generated query into an AST. Statements outside an allow-list (read-only SELECT) are rejected. Automatic LIMIT enforcement.

The Python sandbox has no network.

Analysis runs in an isolated runtime with strict CPU and memory caps and zero network egress. The sandbox cannot exfiltrate data even if compromised.

Database credentials never reach the LLM.

Connections are encrypted at rest. The LLM sees schema metadata only. The MCP tier holds credentials and runs queries on the orchestrator’s behalf.

Every action is auditable.

Every run is a step-by-step trace: who asked, what plan the LLM produced, what the orchestrator actually executed, what came back. Exportable.

What flows where

  1. 01

    Question

    Sent to the LLM along with schema metadata only — never your data.

  2. 02

    Plan

    Structured IR returned by the LLM. Validated against the IR contract.

  3. 03

    Execution

    Orchestrator dispatches each step to MCP (for SQL/KQL) or Sandbox (for Python).

  4. 04

    Result

    Artifacts (tables, charts) returned to the user. Stored alongside the run trace.

Authentication

Sign in with Google Workspace, Microsoft Entra (Azure AD), or GitHub. For Azure SQL/Synapse, Databricks, and Kusto, we support per-user On-Behalf-Of so a connection inherits the signed-in user’s database permissions instead of running as a shared service principal.

Compliance

datarelix.ai is a fully managed service operated by datarelix.ai. Reach out via the contact page for our security questionnaire, SOC 2 status, and DPA.