Compliance & Governance v2026.1

🔒 Enterprise Data Privacy & Security Policy

Learn how AI Data Analyst Pro secures your enterprise datasets, enforces local Microsoft SQL Server tenant isolation, and protects user privacy.

Effective Date: January 1, 2026

Last Updated: August 14, 2026

Privacy Sections

1. Absolute Zero Data Reselling & Model Training Guarantee

We enforce a strict Zero Third-Party Data Monetization Policy. Your uploaded CSV files, Excel spreadsheets, dataset records, and generated analytical outputs:

Are NEVER sold, leased, rented, or shared with advertising networks or data brokers.
Are NEVER used to train or fine-tune public artificial intelligence foundation models.
Remain strictly confidential and accessible solely to authorized authenticated users within your account instance.

2. Local Microsoft SQL Server Tenant Isolation

All uploaded datasets are converted into dedicated, parameterized table structures inside Microsoft SQL Server:

Multi-Tenant Schema Isolation: Each uploaded dataset is assigned a unique identifier string (e.g. Sales_Data_U6_T1786650). All T-SQL queries enforce strict user scoping (WHERE user_id = @user_id), ensuring complete data boundary isolation across accounts.

3. Secure LLM Prompt Guardrails & PII Protection

When you ask natural language analytical questions, the AI Translation Engine transmits only column headers and non-sensitive structural schema definitions to OpenRouter LLM endpoints:

Raw database record rows remain securely inside your local SQL Server instance and are executed via localized T-SQL engine calls.
Automated PII Guardrails detect and mask sensitive identifiers (e.g., credit card numbers, social security codes, passwords) prior to query processing.

4. Encryption & Security Infrastructure Standards

We implement modern cryptographic protocols across data transmission and storage:

TLS 1.3 Transport Encryption: All browser communications and API requests are encrypted via HTTPS.
Argon2id / PBKDF2 Password Hashing: User passwords are securely salted and hashed prior to database storage.
Transactional RFC 2822 Email Security: Email verification codes (OTP) utilize High-Priority transactional SMTP delivery headers to prevent spam intercept.

5. Session Governance & Cookie Security

We utilize HTTP-Only, SameSite-Strict session cookies exclusively for user authentication and CSRF protection. We do not place third-party tracking cookies or cross-site analytics scripts on your device.

6. User Rights (GDPR & CCPA Compliance)

Under applicable data protection regulations (including GDPR and CCPA), you hold the following explicit rights:

Right of Access & Export: Export your full raw datasets and analytical reports at any time in CSV, Excel, PDF, Word, or PowerPoint formats.
Right to Erasure (Be Forgotten): Permanently delete your account, profile credentials, and uploaded datasets with zero data retention.