Security

NatureQuery is built to read data, never to change it. Every query is protected in layers, before and while it runs.

• Checked before it runsEach query is checked against the rules for its database: one statement at a time, only reading commands, and no functions that can change data, run code or reach other servers. For MongoDB, pipeline stages that write data or run JavaScript are refused.
• Refused by the databaseOn PostgreSQL, Neon, Supabase, CockroachDB, Redshift and Oracle, and on MySQL and MariaDB servers that support it, queries run inside a read-only transaction, so the database itself refuses any change. On Turso, each query runs in a transaction that is never saved.
• Your own safeguardConnect NatureQuery with a database user that can only read. Then your data cannot change, whatever happens in NatureQuery.

• Passwords encryptedConnection passwords are encrypted with AES-256-GCM before they are stored, and are never sent back to your browser.
• Encrypted connectionsConnections to your database are encrypted. New connections also check the database's certificate, so NatureQuery knows it is talking to your server. For providers that sign their own certificates, such as Amazon RDS, you can choose to trust the certificate as it is. The connection stays encrypted.
• Public addresses onlyOur servers connect only to public internet addresses. Private networks, local addresses and cloud metadata services are refused, so nobody can use NatureQuery to reach machines inside our hosting network. For databases on your own network, use NatureQuery Desktop.

NatureQuery reads table and column names to write queries. It does not copy your database.

• What we keepYour questions, the queries that ran, row counts and timings (your history), saved queries and dashboards.
• What we do not keepQuery results. They pass through our servers to your browser and are not saved or cached.
• Only when you chooseIf you share a dashboard with its charts, each chart's numbers are saved so the shared page can show them, and turning chart sharing off removes them. A saved investigation keeps its summary totals. Scheduled reports email their results to the people you choose.
• Uploaded filesCSV and Excel files you upload are stored in a database separate from NatureQuery's own data, with a private area for each person. A query on uploaded data can read only that person's own tables.
• Your controlYou can delete your account and its data under Settings, Security. To get a copy of your data, write to us.

To write a query, the AI receives your question and the structure of your database: table and column names and types (including the allowed values of columns limited to a fixed list), keys, relationships and approximate row counts. It does not receive the rows in your tables, except through two features you choose to use. AI Insights on the website sends column statistics and up to 5 rows of a result. Summarize in NatureQuery Desktop sends up to 50 rows, and only after you turn on "Let AI summaries use result rows", which is off by default. Explaining or fixing a query sends the query text, and fixing it also sends the database's error message.

• PasswordsStored as bcrypt hashes, never in plain text. After 5 wrong attempts, signing in is locked for 15 minutes.
• Two-factor sign-inUse an authenticator app, with backup codes in case you lose your phone.
• Teams and rolesOwners, Admins, Members and Viewers. Only Owners and Admins add or change database connections and invite people. Viewers can open dashboards but cannot run queries.
• Checked every timeEvery request checks who is signed in and whether they may use that connection, query or dashboard.
• API keysCreated by you, shown once, stored only as a SHA-256 hash, and can be revoked at any time.
• Audit logQueries, sign-ins and important changes are recorded with the time, the address they came from and the browser used. Each entry carries a fingerprint of the one before it, so a change to past entries would show.

• HTTPS onlyAll traffic is encrypted, and browsers are told to always use HTTPS (HSTS).
• Browser protectionsA content security policy limits what the site may load, and other websites cannot embed NatureQuery in a frame.
• Up-to-date softwareWe keep the software NatureQuery is built on up to date and check it for known vulnerabilities.
• Error reports and analyticsThey do not store IP addresses, never record your screen, and blank out secret links such as password resets and shared dashboards. Error reports also remove passwords and card numbers.

NatureQuery Desktop connects to your databases directly from your computer, so a database on your own network never needs to be reachable from the internet. Connections, results and history stay on your computer, and passwords are encrypted with your Windows account. The same read-only checks and read-only transactions apply.

We would rather tell you than let you find out. NatureQuery does not yet offer:

• A formal certification such as SOC 2 or ISO 27001.
• Single sign-on with SAML.
• Fixed outgoing IP addresses to add to your database firewall. If your database accepts only known addresses, use NatureQuery Desktop.
• A way to end website sign-ins on other devices. A sign-in lasts up to 7 days. NatureQuery Desktop sign-ins can already be ended under Settings, Security.

If you find a vulnerability, email hello@naturequery.app with the steps to reproduce it, and a person will reply. Please do not access other people's data or disrupt the service while testing.