Your data stays in one place. Here is exactly who and what can touch it.

A paid plan gets a dedicated virtual machine (Firecracker on Fly.io, Virginia), its own database for bookkeeping, and its own prefix in object storage. No process, database or file is shared with another customer. The free plan shares a machine but still gets its own database and its own storage prefix.

Machines and storage are in Virginia. Models run inside Amazon Bedrock in US regions. Nothing leaves AWS to reach a model maker.

TLS everywhere. Storage, database volumes and backups are encrypted at rest by the providers. Nightly backups go to a second provider.

Every version of every table is kept. A dropped table is hidden for a week before anything is removed, so a mistake, yours or an agent's, is a restore, not a loss.

Add-only, read, or read-write, per dataset. A key can be given masked access, which replaces names, emails, phones and addresses with stable stand-ins before the query runs. Revoke a key in one click.

Every statement, from a person or an agent, goes through a guard before it runs: it may read only the datasets the key can read, write only where the key is read-write, and never attach, install, export or change settings. There is no superuser path for the agent.

One switch under Settings. Off means the chat, the source builder and automatic fixes stop; syncs, queries, the inbox and exports keep working. Scoping the agent per person is by key today, not by a switch.

A live link is a secret URL that returns a query's current result as a file, so a spreadsheet can pull it. Anyone with the URL can fetch it. It reads with the access of the person who made it, every fetch is counted, and an admin or its maker can revoke it at once. The app says this where the link is made.

Who, when, the SQL or the tool, rows, time, and for a model call the model and its cost. Failed runs and quiet sources become cards you review; a fix runs only when you say so.

There is no admin screen that opens a customer's data. Operations run through provisioning commands and logs. A two-person rule for any hands-on access is on the list below, not yet built.

Models run inside Amazon Bedrock with retention set to none and invocation logging off. Bedrock's terms forbid the model makers from training on or storing what passes through. Anthropic, DeepSeek and the others never receive it directly.

A script runs in an empty network of its own, with one door: a proxy that allows only the hosts listed on that source. Anything else gets a refusal, and the run log shows every host it talked to. Private and internal addresses are refused everywhere, at save time and at every connection.

The script runs as an unprivileged user with only its own secrets in its environment, none of ours. It is stopped at your plan's time limit. What it landed before that stays landed.

A script cannot write a table directly. It hands rows to us and they are appended, raw, to a table only your key controls. It can never touch our bookkeeping.

We will do these when a customer needs them. Ask and we will tell you where we are.

Today sign-in is through Clerk with email or a social account.

The model layer can take a customer's own provider key, but there is no screen for it yet. Ask.

Written into our own rules; the tooling that enforces it is not built.

It is all in your warehouse today, queryable; a one-click export is not built.

Encryption at rest today uses the providers' keys.

Deleting a customer removes the machine, database and files after the retention window; the procedure exists as a command, not yet as a document you can read.