Your data stays where it is.
iDash connects read-only, encrypts credentials field by field, and resolves every access decision from the session that made the request.
Connecting a source
A connection is proven before it is stored. Four steps run in order, and a failure at any of them leaves nothing behind.
- A single probe query runs first, in a read-only session under a statement timeout.
- Introspection reads tables, columns, primary keys and foreign keys. It reads no rows of your data.
- Any failure rolls the whole attempt back, so a half-connected source is never persisted.
- iDash refuses to connect to the application database that runs iDash itself.
- Nothing requires production. A read replica gives the same schema, the same keys and the same answers.
Every query is a read
Read-only is enforced by the database, not requested politely by the client. A guard sits in front of that, and a timeout sits around it.
- Database connections are enforced read-only at the server level.
- Every statement runs under a timeout and is cancelled rather than left to run long.
- There is no write path to disable, because no write path is built.
Credentials and sessions
Connection details are encrypted before storage and decrypted only when establishing an authorized connection.
- Decryption happens inside the API, only at the moment a connection is opened.
- Credentials never appear in a prompt, a tool result, a chart spec or an export.
Tenancy and roles
Every workspace-scoped request resolves the caller's membership before it does anything else. Roles are ranked, and the ranking is checked at the boundary rather than in the interface.
- Membership is resolved first on every workspace and project route.
- Roles rank owner, admin, member, viewer, and a workspace can never be left without an owner.
- Data sources belong to the project they were connected in, and are reachable only from it.
- Access attributes are resolved from the authenticated session, never from model output.
The code sandbox
Advanced calculations run in an isolated environment with access only to temporary results and no database credentials.
- The only host path mounted is that chat session's own workspace, which is destroyed with the session.
- Networking is off unless it is explicitly enabled.
- CPU, memory, wall clock and output size are all capped.
- Query results enter as a file. Connection details never enter at all.
Report a security issue
Send it to the team directly. Include what you found and how to reproduce it, and you will get a human reply.
idash@thegatewaycorp.comConnect a replica and inspect it.
A read-only credential is all iDash asks for, and all it can use.