Reference
Security and your data
What DataBelta can and cannot do to your database, where your data actually sits, and the answers your own IT team will ask for.
Read-only, and not as a promise
Belta can only read. It has no ability to insert, update, delete, drop or alter anything, and this is not an instruction the assistant has been given and could be talked out of. The tools it is allowed to call only run read commands, and anything else is refused before it reaches your database.
Connect with a read-only database account as well. Then the limit is enforced by your own database independently of us, which is the version of this answer a security review will accept.
Your data stays in your database
We do not copy, mirror or warehouse your data. A question runs a query, the rows that answer it come back, they are used to write the answer, and that is the end of it. There is no synchronised copy of your database sitting on our servers.
The exception is a file you upload. That one you deliberately gave us, and it is stored so it can be queried. You can replace or delete it at any time.
Credentials are encrypted and never readable
A database password is encrypted with AES-256 the moment you save it, with a fresh initialization vector for every secret. It is never shown on a screen, never returned by an API, and cannot be read back by anyone, including us.
This is why editing a saved connection asks you to type the password again. There is nothing to prefill.
How workspaces are separated
- Every record belongs to a workspace, and every query is scoped to yours. There is no path from one workspace to another.
- A person belongs to exactly one workspace, so there is no switching and no cross-account view.
- Our own platform administrators are never members of a customer workspace and have no bypass that would let them read your data.
Account security
- Passwords need at least eight characters with an uppercase letter, a lowercase letter and a digit.
- Five failed sign-in attempts lock the account.
- Email confirmation is required before an account can be used.
- Two-factor authentication is available by email or authenticator app, with single-use recovery codes.
- Sessions are held in your browser and are cleared when you sign out.
Payments
Paddle is the merchant of record. Card details are entered into Paddle's form and never touch DataBelta. We hold no card numbers, so there are none to lose.
Databases we cannot reach
If your database is not exposed to the internet, it can be connected through an on-premise agent that runs inside your own network. The agent makes an outbound connection to us, so no inbound port is opened on your network and nothing is published to the internet.
Controlling what can be asked about
The most effective control is the one you already have, in your own database.
- Give the DataBelta account access only to the tables the business asks about. What the account cannot see, Belta cannot see.
- Keep payroll, personal data and anything else out of scope by leaving it out of that account's permissions.
- Use a member's credit limit to cap what any one person can spend, and roles to control who can add connections at all.
Retention and deletion
Generated files are deleted twenty-four hours after they are created unless you save them. Saved items stay until you delete them. Removing a connection retires it: it leaves your workspace and can no longer be queried, and its credentials stay encrypted and unreadable exactly as they were.
If you want a workspace deleted entirely, ask us and it is purged rather than hidden. The privacy policy on this site has the full detail.