Security

1. Account gate

Middleware on the AnalyzeIt site redirects visitors without an auth cookie to sign in before Chat, globe, dashboards, connectors, objects, billing, profile, and related tools can load. Those routes never fetch workspace APIs for anonymous visitors. API routes that serve customer data still expect a bearer token. The marketing homepage, login, and legal pages stay public.

2. Authentication

Passwords are stored as hashes. Sessions use a bearer token kept in the browser. We recommend a unique password and signing out on shared devices. Social sign-in may be offered later; until then, email and password are the supported method.

3. Read-only IAM for connectors

When you connect an external system, grant the minimum access the connector needs — preferably a read-only role. AnalyzeIt is designed to display and analyze data, not to change source systems. Connector credentials are encrypted at rest when a vault key is configured. GitHub, Stripe, Salesforce, SQL, and catalog datasets (Kaggle, Hugging Face, OpenML) sync as live read-only pulls.

4. Transport and isolation

Production traffic is served over HTTPS. Workspace records are scoped to your account. Project sharing uses explicit links and role-aware UI redaction. Incognito mode avoids writing durable history for that session.

5. Model providers

Assistant requests are sent to language-model and search providers as needed to answer you. Do not paste secrets into chat that you would not share with those processors. We do not use your private connected business data to train public models.

6. Desktop app and command line

The desktop app and command line keep data you import on your own computer, in a vault encrypted at rest with a key kept in an owner-only file on that computer. Nothing in the vault is uploaded; when you ask the online assistant about a local dataset, only your question and a column summary you allowed are sent, never rows. Sign-in happens in your browser (no password is typed into the app), and the session token is stored in an owner-only file on that computer. Queries you run on local data are read-only and limited to your own datasets.

Cloud compute is off unless you turn it on (analyzeit compute cloud). With it on, your data still stays stored on your computer; for each question an assistant asks, the app sends only the columns that one analysis needs, over HTTPS, to the AnalyzeIt compute service. The service checks your sign-in, runs the same analysis and the same rules as the app (no rows, no identifiers, no group of fewer than 3 records in what an assistant receives) in memory, returns the result to your computer and keeps nothing: no file, no database and no log of the data. If it cannot be reached, the analysis runs on your computer. Private datasets are never sent.

Updates are signed with a private key that is kept off our build servers; the app and command line verify each update against a public key built into the program and refuse anything that does not verify or is older than the installed version. Release files list SHA-256 checksums on the download page. Builds are produced in private repositories.

7. Reporting issues

If you discover a vulnerability, email security@analyzeit.in. Please do not publicly disclose an issue until we have had a reasonable chance to investigate and fix it.