Security

Where your data lives

Datachef runs on AWS in the us-east-1 region. Synced data is stored as Apache Iceberg tables in Amazon S3, encrypted with AWS KMS. The application's own data (accounts, connections, models) is stored in an encrypted PostgreSQL database.

Private deployments are available on the Custom plan. They get their own network, database, storage and encryption key, on AWS, Google Cloud or Azure. Contact us to discuss one.

Encryption

• In transit: TLS 1.2 or later between your browser and Datachef, and between Datachef and its database and storage.
• At rest: synced data and the application database are encrypted.

Isolation

Each workspace's data is stored in its own namespace, and every query is checked so it can only read its own workspace's tables. Queries are read-only. See SQL editor.

Private workspaces are closed even to your own organization's admins unless they're granted access.

Source credentials

Credentials for your connections are encrypted before they're stored. They're never sent back to the browser after you save them, never shown to Datachef support staff, and never available to AI agents connected through the Claude connector.

Datachef only reads from your sources. Use a read-only user for each connection. The Salesforce and PostgreSQL and MySQL guides show how.

What the AI features see

When you ask a question, Datachef sends the AI model provider your question and your workspace's schema: table and column names, their types, and model definitions. It doesn't send your rows. The generated query runs inside Datachef.

Support access

Datachef support uses a read-only console that shows account metadata, not your synced data. Every lookup is logged.

Deleting data

• Deleting a connection stops its syncs. The tables it already synced are kept.
• Deleting a workspace deletes its data immediately.

For questionnaires, data processing agreements or our subprocessor list, contact us.