Data Encryption
How Edilitics encrypts every piece of data it stores using per-workspace key derivation. What is stored, what is never stored, and how encryption works.
Edilitics encrypts all data it stores using a per-workspace key derived from three independent inputs. No two workspaces share an encryption key, and your underlying data rows are never stored on Edilitics infrastructure.
What Is Never Stored
Edilitics does not store your underlying database or warehouse records. Source data rows remain entirely within your own infrastructure. The only temporary exception is the Transform sample snapshot described below, which is encrypted at rest and deleted after use.
How Encryption Works
Every workspace has a unique encryption key derived using PBKDF2-HMAC-SHA256 with 100,000 iterations. The key is derived from three inputs combined at runtime:
Prop
Type
The derived key is used with Fernet symmetric encryption for all data at rest. A compromised key from one workspace cannot decrypt data from any other workspace.
What Is Encrypted
| Data | Module | Detail |
|---|---|---|
| Connection credentials | Integrate | Hostname, port, database name, username, password, connection URL, and OAuth refresh tokens. Each field encrypted individually before storage. |
| Schema and column metadata | Integrate | Table structure, column names, data types, DQ statistics, and AI-generated column insights. Encrypted as a unit before storage. Never includes actual data rows. |
| Transform sample snapshot | Transform | A temporary 16,600-row snapshot of your source table created while you configure transformation operations. Each column is encrypted individually before storage. Decrypted on every read, re-encrypted after every write. Deleted when you leave the flow or save the pipeline. |
| Pipeline operations | Transform | The saved operation sequence for each pipeline. Encrypted before storage, decrypted only when the pipeline runs or you reopen the builder. |
| AskEdi chat title and tables context | AskEdi | The conversation title and the tables metadata associated with the chat session. Encrypted before storage. |
| AskEdi prompts and replies | AskEdi | The prompt text you submit, the LLM reply, generated SQL queries (pre- and post-processed), follow-up suggestions, LLM API response objects, and runtime metrics. All encrypted before storage. |
| AskEdi chart data | AskEdi | Chart and MDX data returned by the LLM and rendered in the response. Encrypted before storage, decrypted only at render time. |
| Dashboard and chart configurations | Visualize | Chart type, column mappings, aggregations, filters, and sheet structure. Encrypted before storage. External share access tokens are also encrypted. |
| Uploaded files | Integrate | Files uploaded via CSV, Excel, Parquet, JSON, PDF, SQLite, Avro, Feather, or Pickle. Encrypted before being written to storage. Decrypted on every read, re-encrypted after every write. |
File Upload Security
All files uploaded through Integrate are processed with two controls before any data is accessed:
- Malicious content scanning. Every file is scanned before processing. Files that fail the scan are rejected and not stored.
- Encryption at rest. Files are encrypted using the workspace key before being written to an isolated storage bucket. Every subsequent read decrypts the file in memory and re-encrypts the result before writing it back.
Frequently Asked Questions
Related Docs
Privacy & Context Modes
Control exactly what schema context is sent to an LLM across AskEdi, Visualize, and Integrate.
Audit Logs
Every action in your workspace logged with user, timestamp, and description.
Bring Your Own Key (BYOK)
Use your own API keys for OpenAI, Anthropic, or Google DeepMind and control provider-side logging.
Need help? Email support@edilitics.com with your workspace, job ID, and context. We reply within one business day.
Last updated on
Security & Governance
How Edilitics protects your data at rest, governs AI access, and gives your team full accountability over every action taken in the workspace.
Privacy & Context Modes
How Private, Balanced, and Full Context modes control what schema metadata is sent to an LLM across Integrate, AskEdi, and Visualize. No raw rows sent in any mode.