Security
Sovarium answers questions from your own data warehouse. Here is how it connects, what its AI sees, where your data goes and who can reach it. The full detail is in our privacy policy.
How we reach your warehouse
Credentials you create
You connect Sovarium with a database user you create and control, and we ask you to make it read-only. You can change the credentials in the app, or revoke them in your warehouse, at any time.
Fixed IP addresses
Our servers connect from fixed IP addresses, shown when you add a warehouse, so your warehouse can refuse connections from anywhere else. Every Sovarium customer connects from the same addresses, so an allowlist keeps out the wider internet but not other Sovarium accounts: your credentials are what limit access.
Every query is checked before it runs
Before a query the AI writes reaches your warehouse, our SQL validator checks it, and only a single read query passes. The saved queries behind alerts and dashboard cards are checked again before every run.
Read-only sessions where the warehouse supports them
For PostgreSQL, MySQL and ClickHouse we also open the session in read-only mode. For Snowflake, BigQuery, Redshift, Databricks and SQL Server, read-only access depends on the credentials you provide, which is why we ask you to connect with a read-only user.
What the AI sees
Your schema and your Context Layer
Table and column names, data types, and the Context Layer our data experts write for your business.
Your question and the conversation so far
What you asked, and what was said before it in the same conversation.
The results of the queries it runs
Up to the first 100 rows of each result, plus summary statistics for its numeric columns. These can include individual records, and any personal data in the columns queried.
The data behind its charts and cards
When it draws a chart or builds a dashboard card, it also receives the rows prepared for it, which can be more than 100.
The full list
Everything our AI models receive is listed in our privacy policy.
Where your data is processed and stored
Hosted in London
Our application servers (Fly.io), our database (Supabase), and our sessions and job queues (Redis Cloud) run in London, United Kingdom.
Queries run in your warehouse
We send SQL to your warehouse and receive the results on our servers in London, where they are turned into answers and charts. We keep what an answer, chart, dashboard card or opportunity needs, which can include individual rows: a chart keeps the rows it plots.
AI processing with zero data retention
We reach AI models through OpenRouter, configured to route requests only to model providers with zero data retention, which do not store your data or use it for training. We do not use your data to train AI models, and we test our AI with synthetic data, not yours.
Service providers
Some providers, such as AI model providers and email delivery, may process data in other countries, under Standard Contractual Clauses. The full list of the companies that process data for us is in our privacy policy.
Who can get in
Invite only
There is no public sign-up. Every account belongs to an organisation we set up, and people join it by invitation.
Password or Google sign-in, with two-factor authentication
Anyone can add an authenticator app (TOTP) as a second factor, and your organisation can require it for every member: ask us to switch it on.
Roles, and each organisation kept apart
Roles decide what each member can do, and each organisation’s data is isolated at the database level. Sessions are bound to the browser and IP address they started on, and expire after 7 days of inactivity and after 30 days at most.
Staff access is restricted and logged
Only Sovarium employees can reach customer data, and every access is recorded: who, what, when, and from which IP address and browser.
Encryption
Credentials encrypted at rest
Your warehouse credentials, and the tokens for a Slack workspace you connect, are encrypted with AES-256-GCM before they are stored.
Encrypted in transit
Everything between your browser and Sovarium travels over TLS (HTTPS).
How long we keep data
Retention
How long we keep each kind of data, from chat answers to sessions, is set out in our privacy policy under data retention.
Deletion and your rights
To have your organisation’s data deleted, or to exercise your rights under GDPR, email privacy@sovarium.com.
Reporting a vulnerability
Tell us first
If you think you have found a security vulnerability in Sovarium, email security@sovarium.com with what you found and how to reproduce it. Please give us time to fix it before you disclose it, and don’t access or change data that isn’t yours while you test.
security.txt
The same contact is published at /.well-known/security.txt.
Instant Clarity
See the signal beneath the noise, understand what's driving performance, and direct the outcome.