Structural security

Every privilege is absent where it could become dangerous.

The control plane orchestrates; the connector you operate decides and executes. Networks, signatures and local policy make that boundary verifiable.

Planning without direct access

The hosted planner requests a signed aggregate count. It holds no customer database coordinates or credentials.

The worker sends a signed declarative instruction; only the local connector opens the connection and applies batches.

A session without a bound tenant sees nothing. Even table owners cannot bypass the policy.

The connector signs its result, which is then bound into SaaS evidence without transmitting rows or source identifiers.

The connector resolves database credentials from files or a local vault; the control plane has no field that can receive them.

The Apache-2.0 tree builds alone, imports no private package and exposes exactly four closed operations.

Never include customer data in a report. Use the dedicated security channel before public disclosure.