Security notes.

Claude never returns chart data. It sees a small sample of rows plus an exact statistics digest, enough to design sensible charts, and answers with a specification: what to group, what to measure, how to aggregate.

The full dataset never goes to the model. Every rendered value is computed by a deterministic engine over every row, in the browser for live dashboards and server-side when shares refresh. Accuracy guarantee and privacy stance, one mechanism.

The Claude API call runs in a server-side route reading a plain environment variable. The key carries no NEXT_PUBLIC prefix, so it is never compiled into client JavaScript, and no browser code can reach it.

API connections and program auth live in the server-side store. List endpoints mask secrets before responding, and data loads happen by connection id on the server, so credentials never round-trip through the browser at all.

The entire application surface is treated as internal: middleware requires an owner session for every page and API route, obtained by magic-link sign-in for the configured owner and invited users.

Share pages are the deliberate exception. Each one enforces its own per-dashboard email gate with an allowlist, or explicit public mode. Their data routes are public for GET only; anything that manages a share stays owner-only. The scheduled-jobs endpoint authenticates with its own bearer secret.

Pulled program data is cached per project as JSON on the server volume, outside version control. Shares persist as single records that hold their snapshot and allowlist. Nothing is sent to third parties beyond the model call described in note 01 and the email provider that delivers magic links and insights.