Read-only
Rowgate only sends read queries to the database. The AI doesn’t write SQL: it asks for records or counts from a table, and Rowgate builds the query with values always passed as parameters. On PostgreSQL and MySQL, each query runs in a read-only transaction; on SQL Server, in a transaction that is always rolled back.
Even so, we recommend a read-only database user dedicated to Rowgate.
Your data stays in your database
Rowgate doesn’t copy or store your database content. Queries run at the moment of the question, and the result goes to the AI assistant that asked for it. Rowgate stores the configuration (data sources, profiles, people) and the audit record.
How conversations are handled in the AI assistant follows each person’s or the company’s agreement with the assistant’s provider.
Database credentials
Each source’s password, key or token is stored encrypted (AES-256-GCM) and is never sent back to the browser. Database connections use SSL (on SQL Server, encryption), with the option to verify the certificate.
Rowgate only connects to public addresses: hosts that point to internal networks are rejected.
Rules applied to every query
- The profile’s rules apply to every query, on top of the AI’s filters. The AI can only narrow the result.
- Hidden columns are never even requested from the database, and a question that tries to filter or sort by them is refused.
- If a person is missing a value used in a rule, access is closed.
- Every query respects the maximum time and row limit set in Settings.
Each person’s connection
- The connector URL carries no secret: each person signs in with their own account and authorizes.
- The authorization is tied to the person and the company. On every question, Rowgate checks that the person still belongs to the company and that the authorization still exists.
- Disconnect in Connect your AI, or deactivating the person in Users, cuts off access immediately.
Tamper-proof audit
The audit log is append-only: no row can be edited or deleted. See Audit.
Personal data
Details about personal data, legal bases and data subject rights are in the Privacy policy.