Security notes.

The AI never returns chart data. It sees a small sample of rows plus an exact statistics digest, enough to design sensible charts, and answers with a specification: what to group, what to measure, how to aggregate.

The full dataset never goes to the model. Every rendered value is computed by a deterministic engine over every row, in the browser for live dashboards and on the server when shared links refresh. The same mechanism that keeps numbers accurate keeps your data private.

Every AI request runs on the server. The key that authorises it is a server-side setting that is never compiled into the code your browser downloads, so no page, extension or visitor can read it.

API connections and program credentials are stored on the server. Anything that lists them masks the secrets first, and data is loaded by connection on the server, so credentials never travel through the browser at all.

Everything inside the app requires a signed-in session, obtained with a one-time email link rather than a password. Each workspace sees only its own projects, connections and shares, and people are given a role in it: owner, admin, editor or viewer.

Share links are the deliberate exception. Each one enforces its own email allowlist, or an explicit public mode you have to switch on. Shared data can be read, never changed: anything that manages a share stays inside the app. Scheduled jobs authenticate with their own secret.

Workspace records, such as projects, connections, shares and settings, are stored in a Postgres database, each one scoped to its workspace. Data pulled from a program is cached per project on the server’s private volume.

Beyond the AI request described in note 01, data goes to two kinds of provider only: the email service that delivers sign-in links and insight emails, and, when you pay for a plan, the payment processor. Card details are entered on the processor’s own checkout page; DashVault never sees or stores them.

This marketing site counts its own page views, first-party. There are no third-party scripts and no tracking cookies. A visit is counted under a one-way hash of the network address and browser, salted with a value that changes every day, so a visitor can be counted once a day but not followed across days. Neither the address nor the browser string is stored, and referrers are kept without their query strings.

The application itself, shared links and dashboards are never tracked.