Security at exelens

exelens connects with an identity you create, and we ask for one that can only read. When you test a connection we check its privileges and warn you if it can write.

We only read the views you import. Every read is a single statement built by exelens: the listed columns of one view, filtered to one period, with a row cap. The statement is verified against that shape before it runs, and statements that differ in any way are refused.

The language model chooses which views, periods and calculations to use from a fixed set of tools. None of those tools accepts SQL or code. Calculations run in an isolated engine over data that is already loaded.

Before any data is loaded, each question is checked to confirm it can be answered from the views you selected. After the answer is drafted, every figure in it is matched against the loaded rows. If a figure can’t be verified, the answer is withheld.

• Warehouse credentials and AI keys are encrypted with envelope encryption using AWS KMS keys dedicated to exelens, with a separate encryption context for each workspace.
• The web API can encrypt secrets but can’t decrypt them. Warehouse credentials are decrypted only inside an isolated query service; AI keys only inside the worker that calls the model.
• Secrets are never returned by any API, never logged and never shown again after you save them.
• You can rotate warehouse credentials with no downtime: the new secret is tested before it replaces the old one.

Rows loaded to answer a question live in a short-lived working session (30 minutes idle by default) and are deleted when it ends. We do not keep copies of your views.

When you pin an answer, we keep that answer’s result (for example the 12 rows behind a chart), capped and filtered by your column policies, so the board can show it. Retention is set per workspace.

Columns you mark as hidden are never read. Columns marked as masked are hashed before any person or model sees them.

Every table that holds customer data is protected by PostgreSQL row-level security keyed to the workspace, in addition to checks in application code. Background jobs run with the same workspace scope. Object storage paths are separated per workspace.

• Hosted on AWS in the region you choose for your workspace (United States or European Union).
• TLS 1.2 or later everywhere; HSTS on all exelens domains.
• Databases and object storage are encrypted at rest. Backups are encrypted and tested.
• Outbound connections to warehouses and webhooks pass a filter that blocks private and internal network addresses.
• Production access is limited, uses single sign-on with multi-factor authentication and is logged.

• Sign-in through Amazon Cognito, with Google and Microsoft sign-in and SAML single sign-on on Business and Enterprise plans.
• Two-step verification is required for workspace owners and admins on paid plans.
• Five roles (owner, admin, builder, member, viewer) and per-board sharing. Every sign-in, warehouse read, refresh, share and export is recorded in the audit log.

Email security@exelens.ai. We acknowledge reports within two business days and won’t pursue legal action against good-faith research that avoids privacy violations and service disruption. Our machine-readable policy is at /.well-known/security.txt.