ThinAir Data is designed so you can point AI at production databases without giving up control. It's read-only by default, encrypted at rest, and we do not copy your table rows.
Connection strings are encrypted at rest with AES-GCM and never logged. ThinAir Data does not copy your table rows. It does store your encrypted connection credentials until you remove the connection; the first 200 characters of each query's SQL, encrypted, with timing and row counts, for 7 days (the last 100 queries); schema snapshots for up to 30 days; and saved queries until you delete them.
Writes are blocked before they ever reach your database. Only SELECT, WITH, and EXPLAIN are permitted; INSERT, UPDATE, DELETE, DROP, ALTER, TRUNCATE, writes to pg_* / information_schema, xp_cmdshell, and COPY FROM are rejected by a static SQL firewall. Where the engine supports it, every connection sets a read-only transaction at the wire protocol level as a second guardrail.
Connection strings are encrypted at rest and never logged. Connections are encrypted in transit; SQL Server connections must use encrypt=strict. SQL Server uses TDS 8.0 strict mode, so it requires SQL Server 2022+ or Azure SQL. Where a database cannot do TLS, a private connector (on plans that include one) keeps credentials off the public internet; the final hop stays inside your network.
Every query is logged with timing and row count and can be exported from the audit log. Sessions are tenant-scoped; you can revoke access at any time from the Connect page. Enterprise deployments add private networking, dedicated connection pools, and bring-your-own-encryption-key.