Skip to content
DashboardGPT

Security

How your data is handled

A plain description of the controls in place today. We would rather be specific than reassuring.

For the complete AI-readable content index, see /llms.txt.

Security

Your data stays yours

A short, specific list of how DashboardGPT handles data and credentials — no certification badges we haven't earned.

  • Tenant isolation

    Every workspace is a separate tenant. Datasets, canvases and conversations are scoped to the workspace that created them, and queries are executed within that boundary.

  • Customer-owned AI keys

    Bring your own provider credentials. Keys are held encrypted, used only to serve your workspace's requests, and can be rotated or revoked by an administrator at any time.

  • Secure data processing

    Uploads are transferred over TLS and stored encrypted at rest. Analysis is executed by the query engine; only the aggregated result needed to answer a question is returned.

  • Access control

    Workspace roles determine who can connect data, run analysis and share canvases. Every data connection and AI credential is administered separately from ordinary membership.

DashboardGPT is an early-stage product. We describe the controls that exist today rather than claiming certifications we do not hold. If your organisation has a specific compliance requirement, talk to us before you commit — we would rather tell you plainly what is and is not in place.

Practices

The details

In transit and at rest
All traffic to DashboardGPT is served over TLS. Uploaded files and dataset metadata are stored encrypted at rest.
What leaves your workspace
Answering a question requires sending the question and a description of the relevant schema to the configured AI provider. Row-level data is not sent to the model; the query runs in the analytics layer and only aggregates are returned.
Credential handling
AI provider keys, and warehouse credentials once warehouse connections arrive, are stored encrypted, scoped to a single workspace, and never rendered back to the browser after they are saved.
The public playground
The demo on this site is anonymous and runs on a curated public dataset. It accepts no uploads and holds no account data.
Reporting a vulnerability
If you believe you have found a security issue, contact us before disclosing it publicly and we will work with you on a fix and a timeline.

Questions

Security and AI

AI

DashboardGPT is provider-agnostic. Every plan includes managed AI, which is rate-limited and slower at busy times. You can also bring your own key for OpenAI, Anthropic, Azure OpenAI, Google or any OpenAI-compatible endpoint: there are no rate limits, responses are faster, and model usage is billed to your account under your own terms. On-premise installs can also point at a local model served through an OpenAI-compatible API, such as Ollama or vLLM, so no prompt leaves your network.

No. Your data is used to answer your questions. When you bring your own provider key, requests go to that provider under the agreement you hold with them.

Security

Every workspace is a separate tenant. Datasets, canvases, conversations and credentials are scoped to the workspace that created them, and query execution happens inside that boundary.

We don't hold SOC 2 yet. We complete your security questionnaire, and the on-premise edition keeps all data inside your network.

Have a requirement we haven't covered?

Tell us what your review process needs and we'll answer it directly.

Try DashboardGPT Talk to us