Security and data handling

A consolidated summary of the guarantees stated elsewhere in this guide.

Area	Guarantee
Database credentials at rest	The password reaches disk only if you tick Remember password, and only as ciphertext from the Windows credential vault. There is no plaintext fallback: if the vault is unavailable, the password simply is not saved.
Credential erasure	Clear saved credentials and Sign out perform a deep erase that rewrites the underlying storage, so no remnant of a previously saved password survives. Settings and theme are preserved.
Credentials in logs	Scrubbed from every record before it is written. Request bodies are never logged.
Credentials in bug reports	Never included.
Network	All database traffic is between your machine and your database server. The only outbound call the product makes is the one-off licence activation.
AI	Off until you configure it. Your key is stored locally and sent only to the Base URL you entered. Your prompt and the SQL in context go to that endpoint — nowhere else, and secrets found in the SQL are redacted first. The assistant is text-only: it cannot execute SQL, reach your database, commit or roll back, or change any setting (§34.3).
Destructive actions	Killing a session, closing a PDB, dropping an object, restoring a version, deleting a suite/report/workflow/test, and truncate/replace imports all require explicit confirmation.
Generated scripts	Schema sync scripts, grid update scripts and ER-model DDL are generated, never executed. You review and run them yourself.