1.2kGet started
Datus Security

Security & Privacy

Protecting credentials, managing conversation history, and keeping the boundaries of data access clear.

Visit Trust CenterContact the Datus Team

Applies to Datus Studio · Private deployment differences below

AI & Data Use

Your Models. Your Conversations.

Choose your model service and manage the conversation messages you save.

Your Model. Your Provider.

Configure your own LLM connection. Choose the model service that fits your business needs and data policies.

About Models and Data Use

What a Model May Receive

Depending on the task you initiate, context may include natural-language questions, schemas and metadata, SQL, code, and query results returned by tools. Review your provider's terms to decide which content is appropriate for model inference.

Provider Data Policies

Whether a provider retains inputs and outputs, uses them for training, or processes them in a particular region depends on the service, account settings, and agreements you choose. Check that these policies meet your organization's requirements when configuring a model.

Manage Your Conversation History.

Datus Studio saves intermediate conversation messages during tasks. You can delete the saved messages yourself.

About Conversation History

You manage your conversation history.

You can delete conversation messages saved in Datus. Deleting them in Datus does not delete copies a model provider may retain; those are governed by that provider's policies and agreements.

Managing Different Data Types

Conversation messages, project files, published reports, and audit records serve different purposes and are managed separately. You can delete saved conversation messages. Contact the Datus team about deletion scope or requests involving other data.

Model context may include questions, schemas, SQL, code, and query results. Review your chosen provider's data use and retention policies.

Security Controls

Protecting Each Step of Data Access

Security measures across your connections, task execution, and shared work.

Credential & Transport Protection

Sensitive data source credentials and model API keys are encrypted for storage. Public access uses HTTPS.

View Controls

Protection in Transit

Datus Studio uses HTTPS to protect public-network traffic between your browser and the service. Use secure connections to your data sources and model services, and keep certificate verification enabled.

Credential Encryption

Sensitive data source credentials and model API keys are encrypted before storage. The encryption service supports AWS KMS; private deployments can also use a local key configured by the operator. Key configuration and access management are responsibilities of the corresponding deployment environment.

Identity & Resource Permissions

Manage resource access with users, groups, and roles. Connect OIDC SSO where configured for your deployment.

View Controls

Authentication and Enterprise Identity

Datus supports OIDC SSO when configured for the deployment. With SSO, your identity provider can apply its MFA and other authentication policies. Manage API keys for their intended purpose and revoke them when they are no longer needed.

Data Access and Least Privilege

Use data source accounts with only the permissions required for a task. Where project and plugin prerequisites are met, SQL row-filter policies can restrict data in supported read paths according to the caller's attributes.

Sharing & Publication Controls

Manage authorized access and anonymous links separately. Static reports show the content fixed at publication.

View Controls

Public links

Anyone holding a valid link may be able to access its content without signing in. Managers can turn off sharing or revoke the link.

Static reports

Report content is fixed when published and is not filtered again for each viewer. Review the data in a report before publishing it.

Live queries

Dashboard and Chatbot query permissions depend on the viewer's identity, project configuration, and applicable data policies.

Audits & Vulnerability Management

Code, dependency, and image scans identify risks. Audit events track key platform actions.

View Controls

Finding and Addressing Vulnerabilities

Datus uses static code analysis, dependency checks, and container image scanning to identify potential risks. Scans cover code changes and scheduled checks. Findings are assessed, tracked, and addressed according to their severity.

We have conducted third-party penetration testing. The initial assessment in September 2026 covered Datus Studio's external, unauthenticated attack surface. Contact the Datus team for details about subsequent testing scope and available materials.

Audit Logging

The platform records audit events for actions such as permission changes, connection configuration, and sharing management, tracking the actor, resource, time, and outcome. Enterprise deployments can configure audit event forwarding to their own OpenTelemetry logging infrastructure.

Reporting Security Issues

If you discover a suspected vulnerability, exposed credential, or unusual access, contact us below with the impact, reproduction steps, and relevant environment details. Avoid sending passwords, API keys, or complete customer datasets by email.

SQL Policy requires project and plugin prerequisites, covers supported execution paths, and currently does not provide column-level permissions or data masking.

Deployment Options

The Right Boundary for Your Data

Choose Datus Studio, BYOC, or private deployment to fit your data environment.

Datus Studio

Runs on AWS infrastructure. Agent runtime sandboxes are allocated per workspace, with access controlled through identity and resource permissions.

Runtime isolation and data-storage isolation are separate controls. This does not mean each customer has a dedicated database or an entirely dedicated infrastructure stack.

BYOC and Private Deployment

Deploy in your own cloud or infrastructure. Network boundaries, storage, keys, backups, and operational settings depend on the deployment plan and agreed responsibilities.

For private deployments, review the configured model services and external integrations to confirm that their data flows meet your organization's policies.

Datus maintains the product's security capabilities. Customers choose their model providers, manage data source accounts and member permissions, and configure sharing. Private deployment operators also maintain the security configuration of their runtime environment.

Continuous Improvement

Transparency as We Progress

SOC 2 readiness in progress

Datus is working toward a SOC 2 examination with Vanta, strengthening security controls and supporting evidence. This page describes current practices and does not represent an issued SOC 2 report.

Visit the Datus Trust Center

Security Resources

Datus Trust Center

Explore compliance progress and available security resources.

Visit Trust Center

Deployment & Security Boundaries

Discuss BYOC, private deployment, and your team's security requirements.

Explore Enterprise Deployment

Report a Security Issue

Tell us about suspected vulnerabilities, credential exposure, or unusual access.

Contact the Datus Team

Frequently Asked Questions

Who chooses the model provider?

You do. Users enter their own LLM connection settings, including the model, service URL, and credentials. Before connecting, confirm that the provider's data use, training, retention, and processing-region policies meet your organization's requirements.

What conversation history does Datus save, and can I delete it?

Datus Studio saves intermediate conversation messages during task execution. You can delete these messages yourself. Any inputs and outputs retained by your model provider are governed by its own policies and agreements; deleting history in Datus does not automatically delete the provider's copies.

Can a private deployment use an internal model service?

You can configure a compatible model service or internal gateway for your deployment environment. Whether data processing stays entirely internal also depends on model service URLs, external integrations, and network configuration. Review actual data flows against your deployment plan.

Discuss Your Security Requirements

Contact the Datus team for a vendor security assessment, clarification of deployment boundaries, or to report a potential security issue.

contact@datus.ai
Updated Back to Top