Control 01
Database role
The setup guides you to a read-only login. The role itself cannot perform writes. If a bug or a compromise tried, the database would refuse it.
Security
The cloud holds the documentation. Your network holds everything else.
Compliance teams ask three questions: where do credentials live, what crosses the network boundary, and who can do what. This page answers all three.
01 · Trust boundary
Two networks. One workspace.
The agent runs on a host inside your network. It opens TLS connections outbound to the control plane. Nothing inbound. The cloud receives the catalog, the run state, and the column values you leave enabled. It never receives the password, and it handles row results only when a user explicitly runs a query or schedule.
02 · Sealed credentials
The browser does the sealing. The agent does the opening.
When you set up a connection, the browser fetches the agent public key, seals the connection string and posts the envelope. The cloud stores that envelope and nothing else, and the agent opens it locally, which is why compromising the cloud database does not hand anyone your credentials.
In the browser
Seal
libsodium crypto_box_seal with the agent public key. The plaintext credentials never leave the browser process.
In the cloud
Store
Only the sealed envelope is persisted. There is no key in the cloud capable of opening it. Backups, snapshots, and exports remain useless to anyone who is not the paired agent.
In the agent
Open
The agent reads its keypair from local disk, opens the envelope, opens the database connection, and discards the plaintext.
03 · Read-oriented guardrails
Controls before the database sees the SQL.
Taavik is built for documentation, diagnostics, and operational exports. It validates statements before dispatch, enforces execution caps, and expects every connection to use a read-only database role.
Control 02
Statement validation
The classifier rejects multi-statement input and write-oriented operations before the request is dispatched to the agent.
Control 03
Timeouts and caps
Statement timeout, row cap, byte cap, and concurrency caps are enforced before or during execution so one request cannot dominate the agent or the database.
04 · What the agent reads
The catalog always. Your tables only in two cases.
PostgreSQL and Redshift
- information_schema.tables, columns, table_constraints
- pg_catalog.pg_class, pg_attribute, pg_index, pg_trigger
- pg_views, pg_proc, pg_namespace
SQL Server
- sys.tables, columns, indexes, foreign_keys
- sys.views, sys.objects, sys.parameters
- information_schema.columns, routines
MySQL
- information_schema.tables, columns, statistics
- information_schema.views, routines, triggers
- information_schema.key_column_usage
Your tables
The agent reads from your tables in two cases. Queries you wrote and ran yourself, whose results are encrypted inside your network before they leave it, so we cannot read them. And, while the setting is on, counting which values a short column such as status or type actually contains, so answers use your real values instead of guessing. It keeps the list of values, never the rows they came from. You can switch it off for each database, and switching it off deletes what was already collected.
05 · Audit and access
Every run, every alert, every login.
Audit is not a separate add-on. It is the storage model. Every snapshot, every alert delivery, every query run is a row with a timestamp and a user.
Snapshot history
Immutable, one row per scan, with diffs stored rather than recomputed and retention set by the plan.
Alert deliveries
Every dispatch attempt logged with channel, status, attempts, and last error. Retries do not lose history.
Query runs
Rendered SQL, variable values, who, when, on which connection, row count, truncation flag, duration.
Roles and seats
Two roles, company admin and member, with concurrency and daily caps applied per user. On the free plan only admins can execute.
Transport
All cloud traffic is TLS 1.2 or higher. Agent connections are outbound only.
DPA
Data Processing Agreement available on request for any plan that needs one. Standard contractual clauses for cross-border transfers.
Security review
Send the document to your compliance team.
We answer security questionnaires, sign DPAs, and do not require special procurement to start. Most teams pass the first review in a week.