Security first
Your credentials encrypted. Your data untouched.
The moment you save a database password it is encrypted with AES-256, with a fresh initialization vector for every secret, and can never be read back. No screen shows it, no API returns it, no person can view it. Not your team. Not ours.
- AES-256 encrypted credentials: no API can ever return them
- Strictly read-only: the AI can only run SELECT, enforced at every layer
- Your data stays in your database: we never copy or mirror it
Encryption vault
Encrypted the moment you save it, never readable again.
Read-only gate
- SELECT revenue FROM ordersallowed
- UPDATE orders SET status = …blocked
- DELETE FROM orders WHERE …blocked
The AI holds no write tool. SELECT is all it can do.
SELECT only, ever
Read-only enforced at every layer
AES-256
Credentials encrypted at rest
2FA
Email or authenticator app
Isolated workspaces
Every client fully separated
Read-only by design
It can read your data, never change it
Read-only is not a policy you have to take on trust. It is built into the product at three separate layers.
No write tool
The AI's tool set contains no tool that can insert, update or delete. There is simply no path to write.
SELECT only
The query tool rejects any statement that does not start with SELECT, at every request.
Uploads too
The file engine allows only SELECT, PRAGMA and WITH, and blocks every write.
Credentials
Encrypted, and never readable again
The moment you save a database password, it is locked away and cannot be retrieved by anyone.
Encrypted with AES-256-CBC, using a fresh initialization vector for every secret.
The encryption key lives in server configuration, never beside the data.
No API response ever returns a password.
Once saved, nobody can view it again, including DataBelta staff.
Your data
We never copy or mirror it
Your database stays where it is. Every query runs live against your source at the moment you ask.
Nothing is copied out: DataBelta never duplicates or syncs your database.
Queries run live, on your source, only when you ask a question.
What we store is your chat history, which may include rows you explicitly asked for, so you can revisit past answers.
Accounts
Locked down at the front door
Beyond strictly read-only access, every account is protected by standard, proven controls.
Two-factor authentication
A one-time code by email, or an authenticator app.
Email confirmation
Required before the first sign-in.
Hashed passwords
Stored with industry-standard PBKDF2.
Lockout
Five failed sign-ins lock the account.
Sessions
Last up to 30 days before you sign in again.
Isolation & lifecycle
Separated, and yours to delete
Your workspace is walled off from everyone else's, and you stay in control of your data.
Isolated workspaces
Every client is fully separated. Chats, connections, uploads and files are scoped to your workspace, and you control who is invited.
One AI provider
Questions and answers are processed by Moonshot AI. The full list of subprocessors is in our privacy policy.
Account deletion
A 7-day grace period, then everything is permanently and irreversibly deleted.
Short-lived files
Generated files are automatically deleted after 24 hours, unless you save one.
Book a demo
Let's put your data to work.
Want to see it working before you start your trial? Tell us a little about your data, and we'll set up a live session where we'll connect a sample database and let you interrogate it yourself.
- · A 30-minute walkthrough with a real database
- · Pricing and plans covered
- · No commitment, no credit card
Or reach us directly