Self-hosted in your account
Sageivo runs inside your AWS, Google Cloud or Azure account, or on your own servers. It is a single containerized application with its own app database.
- Home
- Security
Secure by architecture, not by promise.
The safest place for your data is where it already lives. Sageivo is deployed inside your cloud, uses your identities and your models, and inherits your warehouse's own access controls.
Deployment you control
Your network boundary
Deploy in a private VPC/VNet with private service endpoints. Nothing needs to be exposed publicly beyond what you choose.
No shared multi-tenant cloud
Your business data is never copied to a Sageivo-operated server. Each customer gets a dedicated deployment.
Data access
Runs as the person asking
Every question executes with the requesting user's own warehouse identity, so native project, dataset, table, column and row policies are enforced by the warehouse itself.
Admins don't get extra data
The Sageivo admin role manages the app; it does not grant access to confidential data the person can't already read.
Shared dashboards, not shared privileges
Dashboards refresh under each viewer's permissions. Sharing a dashboard shares its definition, not the creator's access.
Query safety
Read-only SQL
Generated SQL is validated for structure and referenced objects and executed read-only.
Cost and size limits
Dry runs and cost estimates where the warehouse supports them, plus time, bytes and row limits on every query.
Full provenance
Authorized users can inspect the SQL, sources, assumptions and freshness of every answer.
AI and LLM handling
Your models, your keys
Use AWS Bedrock, Vertex AI, Azure OpenAI or direct APIs with your own credentials. Admins choose allowed models.
Minimal data to the model
The model receives relevant, authorized metadata and minimal aggregates, not full datasets, by default.
Guidance is not permission
Business guidance in Knowledge Studio shapes interpretation; it can never grant access or act as an executable instruction.
Application security
Secrets in your secret manager
Credentials are encrypted and stored in AWS Secrets Manager, Google Secret Manager or Azure Key Vault, never in plaintext.
Identity
Email and password with verification, Google sign-in, and enterprise SSO, set up as part of your service plan. Organization roles isolate accounts and content.
Audit trail
Questions, queries, model calls and admin changes are logged and can be exported to your SIEM.
How we operate
Least-privilege access
Our engineers use only the access you grant, scoped to what the service needs, and you can revoke it at any time.
Patching and updates
Security patches and dependency updates ship on a regular cadence under every service plan.
Compliance support
We help you map Sageivo controls to your SOC 2, ISO 27001, HIPAA or GDPR programs and provide evidence for reviews.
Security FAQ
Common security questions.
Does Sageivo store our business data?
Business data stays in your warehouse. The Sageivo app database stores accounts, settings, chat history, dashboards and knowledge. Rows shown in a chat answer (up to 500) are kept for 7 days so the conversation can be reopened, private to the person who asked, then deleted.
Can Sageivo staff see our data?
Only if you grant access. Because Sageivo runs in your cloud and queries run as each user, our engineers work with the scoped, revocable access you provide for operating the service.
Which LLM providers can we use?
Anthropic Claude, OpenAI, Google Gemini, AWS Bedrock, Google Vertex AI and Azure OpenAI. Using your cloud's managed models keeps traffic inside your provider's boundary.
Found a vulnerability? Email security@sageivo.ai. See our security.txt.
Start with a 30-minute call
Ready to see your own data in Sageivo?
Tell us your tools and your cloud. We'll map the sources, check funding eligibility and recommend the right service plan.