DQaaSSecurity
What DQaaS does to protect your data, and where those protections stop.
Controls
| Control | What it does |
|---|---|
| Tenant isolation | Every query is scoped to your organisation. Project-scoped tokens are supported. IDs from another organisation return not found. |
| Role-based access | Viewer, editor, admin and owner roles with a minimum role per route. Nobody can mint a token above their own role. |
| Token storage | Access tokens are stored only as hashes, shown once, revocable and can expire. |
| Credential encryption | Stored source credentials are encrypted per organisation and are never returned by the API. |
| SSRF protection | Remote sources must be HTTPS without embedded credentials. Hosts are resolved once and pinned, every redirect hop is re-validated, and loopback, private, link-local and similar addresses are blocked. |
| Read-only sources | Files are only read, databases are attached read-only and object stores are read. |
| Check sandbox | Custom SQL and expressions must be a single SELECT and run in a locked-down job with file and network access disabled. |
| Resource limits | Memory, threads, job time, upload size and scanned-row caps apply. Row caps use sampling, and sampled results are flagged. |
| Sensitive data | Sensitive columns store no top values, redact min/max and failing examples, and keep no hash sketches. Strict privacy mode stores no sample values at all. |
| Transient source data | Job working data is deleted at the end of the job. Uploads are deleted unless you retain them, and stale uploads are purged hourly. |
| Browser-submitted metadata | Treated as untrusted: shape validated, redaction re-applied, scores recomputed and stamped as not verified. |
| Audit log | Append-only and hash-chained per organisation, with a verify endpoint. |
| Retention and erasure | Per-organisation retention windows. Deleting an organisation removes its rows, search entries and retained files. |
| Report safety | HTML reports escape all data, contain no scripts and are served with a restrictive content policy. |
Limits
- This is not a certification. No SOC 2, GDPR, HIPAA or data-sovereignty compliance is claimed.
- Sensitive-data detection is heuristic and labelled inferred. A miss means values for that column may be stored; use strict privacy mode if that is unacceptable.
- The metadata store is not encrypted at rest by the application. Use disk or volume encryption.
- The check sandbox keyword filter is a second layer. The boundary is the locked-down job environment.
- There is no application-level rate limiting on the general API and no web application firewall.
- TLS termination, secrets management and backups depend on how the service is deployed.