Security & Compliance by Design for Regulated SQL Server Environments
This page answers common security review questions with auditable details. Offline-first by default, read-only diagnostics, and user-controlled optional cloud LLM.
- Default mode: Local (Offline)
- Cloud: Disabled
- Send Policy: L0
- Redaction: On (cloud mode)
Local LLM keeps prompts and tuning context inside your environment.
No background collectors, no outbound telemetry, and no hidden services.
Trust posture and data-handling model at a glance
Security content is now grouped into the same strong sections and card patterns used on the homepage.
How data moves
Offline (default)
- Runs locally with Local LLM.
- No prompts or tuning context leave your network.
- Recommended for regulated environments.
Cloud (optional)
- Enabled only by you with a provider and API key.
- Controlled by Send Policy levels L0 to L3.
- Redaction can mask literals, comments, and PII patterns.
What we collect and what we do not collect
We collect
- Procedure or query text when enabled for tuning.
- Plans, Query Store metrics, and metadata.
- Signals such as IO, CPU, waits, and memory grants.
We do not collect
- Table or row contents as part of collection.
- Credentials or secrets intentionally.
- Background-harvested database contents.
Deep-dive controls for security reviews and procurement checks
Detailed answers remain in expandable sections, but now sit inside the same polished card system used across the homepage.
LLM Mode Comparison▾
| Feature | Local LLM | Cloud LLM |
|---|---|---|
| Internet Required | No | Yes |
| Data Leaves Environment | No | Yes, to the selected provider |
| Regulated Suitable | Yes | Depends on policy |
Controls▾
Offline mode: no prompts or context leave your environment.
Send Policy (L0–L3)▾
Redaction toggles▾
Encryption, Network, and Deployment▾
Encryption
In cloud mode, transmitted context is sent over encrypted HTTPS and TLS connections.
Network Requirements
Offline mode needs no internet. Cloud mode requires outbound access only to explicitly approved endpoints.
Deployment Model
Windows desktop deployment, offline installer options, and no background license agents.
Access, Logging, and Audit Readiness▾
Minimum permissions
Read-only metadata and performance views, plus optional Query Store access when enabled.
Supported authentication
Windows Authentication, SQL Login, and Active Directory where configured.
Audit logging
Logins, analysis runs, report generation, configuration changes, and exports.
Accelerate procurement and security approvals without reworking the narrative every time
Audit-ready reports and evidence-backed analysis are designed to shorten enterprise security reviews while preserving operational control.