Security and data handling

SlashPeak is built so a security review can finish without a data-plane exception.

Access modelCopy Anchor Link

• Read-only custom IAM. See IAM.
• No roles/bigquery.dataViewer on your data. The only Data Viewer grant is on the optional billing export dataset, if you set one up.
• The scanner key cannot change your datasets, tables, or IAM. It only creates the metadata query jobs it runs.
• Findings are recommendations. A scan never changes anything.
• The optional Cognis AI DBA (Growth and up) makes fixes only with a separate operator key that holds the write permissions you pick, inside your policy. Its pull requests are never merged by SlashPeak.

The marketing Security page lists the same necessary permissions.

What we storeCopy Anchor Link

• Encrypted service account JSON: the scanner key, and the AI DBA operator key if you add one
• Encrypted dbt Cloud tokens, Slack webhook URLs and webhook URLs, if you add them
• Catalog snapshots (table names, sizes, DDL-derived layout, labels)
• Job metadata needed for cost and rules (including masked SQL text for query findings, and the user email on each job)
• Results of the AI query optimizer (the masked query and its rewrite, encrypted), kept 30 days
• For each AI-written AI DBA fix, a record of what was sent to the model (user emails removed first) and its answer, kept 120 days
• Findings metadata and metric rollups
• Account, team, and settings

Personal data in SQL textCopy Anchor Link

SQL can hold values like WHERE email = '[email protected]'. The scan masks these inside BigQuery, in the same query that reads INFORMATION_SCHEMA. The raw value never reaches SlashPeak.

• Emails become <email>, phone numbers <phone>, IP addresses (IPv4 and IPv6) <ip>.
• Phone numbers are masked in international form from any country (+44 20 7946 0018, +14155550134) and in US and Canada form ((415) 555-0134). A number written as bare digits is not masked, because in SQL it is usually an ID or a count. To mask local numbers from another country written without +, add a Privacy pattern.
• Owners can add their own regex patterns in Settings → Privacy, for example customer IDs. Matches become <redacted>. Patterns use RE2 syntax, which is what BigQuery runs.
• The mask covers query text, job error messages, query plan steps and view definitions.
• Table names in backticks are not masked.
• A new pattern applies from the next scan. Queries already scanned keep the text they were saved with.

The query optimizer uses only this masked copy. It never reads SQL from BigQuery again. Queries up to 40,000 characters are kept in full.

What we do not storeCopy Anchor Link

• Emails, phone numbers and IP addresses in your SQL, and matches of your Privacy patterns (see above)
• Table row contents
• Compiled dbt SQL from manifest.json (metadata only)
• Your GCP org’s full audit archive

AICopy Anchor Link

Cognis chat and the query optimizer use Google Gemini. Claude (Anthropic's model) repairs a failed Cognis SQL lookup and writes AI DBA fixes; the AI DBA fixes run only after an owner allows it. Both run on Google Cloud Vertex AI. Table rows are never sent. See AI and your data.

Audit trailCopy Anchor Link

Every AI DBA step and every Cognis AI call is written to an append-only log (the log does not hold chat message text), kept 365 days. On Growth and up, the Audit logs page shows it next to scans and BigQuery audit events.

Encryption and tenancyCopy Anchor Link

Keys are encrypted at rest (AES-256-GCM). Passwords are stored only as argon2id hashes. Accounts are split by email domain. The app limits every request to your account, and Postgres row-level security checks it again in the database. Owners, viewers and none gate changes. On Enterprise, a login policy can limit devices and sign out idle sessions. See Teams.

Sign-inCopy Anchor Link

You can sign in with a password, Google or Microsoft. Password sign-in, email sign-up and support access are guarded by a Cloudflare Turnstile bot check. The session cookie is HTTP-only and secure. Every user sees their signed-in devices and can sign them out (see Teams). SlashPeak support staff can open your account only in a read-only support mode, and every use is logged.

Scanner jobs in your projectCopy Anchor Link

The service account will appear in INFORMATION_SCHEMA.JOBS. Those scanner jobs are excluded from your findings so the product does not nag you about its own metadata queries.

Data residency and retentionCopy Anchor Link

• Settings → General has a default BigQuery location. Today it is US. EU is coming soon.
• Job and chart history is kept for your plan's history window (30, 60 or 90 days) plus about one month, and is removed in whole calendar months. Table snapshots are kept 120 days. See How scans work.
• When a trial or plan ends, scan data is deleted 30 days later.
• SlashPeak runs on Google Cloud in the United States (us-central1), behind Cloudflare. The subprocessor list names every vendor that handles customer data.
• Do not treat SlashPeak as a long-term legal hold for GCP logs.

ComplianceCopy Anchor Link

On Enterprise we sign a Data Processing Addendum and help with your security questionnaire. SOC 2 is in progress, not yet certified. See Enterprise.