Read queries only
Semavex generates read queries only. We recommend connecting it with a read-only database account, so your database enforces the same rule.
Security
How Semavex protects the database your business runs on
Connecting a reporting tool to a production database is a decision for your DBA and your security team. This page describes what Semavex does with that connection, and what it does not do.
Data flow
From a question to your database
- 01
The question
A user asks a question in plain language, or a saved report runs on its schedule.
- 02
A structured plan
Vexon, the AI agent in Semavex, turns the question into a structured query plan using your semantic model. It never writes SQL and never connects to your database.
- 03
Validation
Semavex checks the plan against your semantic model and a whitelist of allowed operations. A plan that fails the check never reaches your database.
- 04
Deterministic SQL
Semavex translates the plan into parameterized SQL for your engine with deterministic code. Every filter value is a bound parameter.
- 05
A read query
The query runs on your database with a time limit, and the rows come back to Semavex to be formatted into the answer or the report.
Query controls
Controls on every query
A time limit on every query
Interactive questions stop after 30 seconds and scheduled reports after 120 seconds.
Non-blocking reads by default
On SQL Server, MySQL and MariaDB, Semavex reads at READ UNCOMMITTED by default, so reports never wait on your application's locks. PostgreSQL's multiversion concurrency gives the same result. You can choose committed-only isolation for each data source.
Index-aware plans
Semavex reads your index metadata from the system catalog and plans filters and joins around it, so reports use the access paths your database was built for.
AI and your data
What the AI sees
Vexon never connects to your database and never runs queries. It works from your semantic model: table and column names, descriptions, relationships, measures and synonyms, plus sample values from columns you have not marked as sensitive.
When someone asks Vexon to explain a result, Semavex computes exact statistics over the whole result in your database and shares them with a sample of rows. A consent card shows the row count, the cost and what will be shared before anything runs. Drill-down suggestions use a few rows of the result. Vexon is built on Claude, by Anthropic.
Credentials and isolation
How Semavex keeps what it needs
- Database credentials are encrypted with AES-256-GCM, with keys held in Azure Key Vault.
- Each customer workspace lives in its own isolated schema in Semavex's database.
- Semavex is hosted on Microsoft Azure in Canada.
- Access is controlled by custom roles built from fine-grained permissions, and every agent request is kept in a history with its user, status and cost.
Recommended setup
How to connect your database
- Create a dedicated read-only account for Semavex, limited to the schemas or databases it should see.
- Allow that account from Semavex's address only, and cap its number of connections.
- To keep reporting off your primary server, connect Semavex to a read replica.
- Each database guide below has a script for the read-only account.
FAQ
Questions from security teams
Can Semavex change data in our database?
Semavex only generates read queries. Its SQL comes from deterministic code that builds read statements from a validated plan, and the AI never writes or runs SQL. Connecting with a read-only account makes your database enforce the same rule.
Can a report slow down our application?
Reports are planned around your indexes, stopped at a time limit and, by default, do not take locks that block your application's writes. For heavy reporting, connect Semavex to a read replica.
Where is Semavex hosted?
On Microsoft Azure in Canada. Database credentials are encrypted with AES-256-GCM, and each workspace is isolated in its own schema. The privacy policy lists what is processed and where.
Which AI model does Vexon use?
Vexon is built on Claude, by Anthropic. It receives your semantic model and, when you ask for an explanation, statistics and a sample of rows from the result.
Security review
Questions from your security team?
Book a demo and we will walk your DBA and security team through the setup before you connect anything.