Security

How datajoi limits what agents and queries can do, and what is recorded.

#Agents cannot act alone

Every consequential change is a proposal a person approves. Always-human action types (such as the schema contract that decides what enters your lake) never auto-apply, and earned trust can be revoked.

#SQL is guarded

Agent-written and hand-written SQL both pass the same guard: a single SELECT only, tables limited to your workspace's allowlist, no file or network functions, and a row cap. The connection itself is read-only and locked down at the engine level, as a second, independent layer.

#Tenancy

Data, proposals, settings and audit entries are scoped to a tenant and workspace on every query. Each customer instance has its own container and storage bucket.

#Secrets and PII

Source credentials are stored as named variables and referenced by name. Columns flagged as PII are marked in the contract and across the catalog.

#Audit

Every proposal decision and every data read is recorded. A data read stores a hash of the SQL and the tables touched, never the rows.

#Your data location

Data lives as Parquet in a bucket in your instance's Cloudflare R2, in open formats. Contact [email protected] for questions about data residency, penetration-test reports or a security review.