← Back to home

Security

Last updated: September 7, 2026

You are considering giving an AI assistant access to your database. This page says exactly what we hold, what someone would get if they breached us, and how you take access away.

Two ways to connect

They have genuinely different threat models. Pick deliberately.

Agent (BoltSchema Connect)

We store no credentials at all.

What we store
Nothing that can reach your database. The agent runs on your machine and holds the connection string; we store only a SHA-256 hash of an agent token. Our database schema enforces this — an agent-backed endpoint has no credential columns populated.
If we were breached
An attacker gets no way to reach your database, because there is nothing stored to reach it with.
How it reaches your database
The agent dials out to us over HTTPS. You add no inbound firewall rule and expose no port. Works for localhost, VPC-private and on-prem databases.
The agent does not trust us
It re-checks every statement against its own read-only guard and runs it inside a Postgres READ ONLY transaction. If our servers were compromised, we still could not make your agent write. You can read that code: npm pack boltschema gives you the unminified source.

Hosted credentials

We hold an encrypted connection string.

What we store
Your connection string, encrypted with AES-256-GCM using a random 12-byte IV per record and an authentication tag. The key is held in our environment, not in the database.
If we were breached
An attacker with both the database and the encryption key could read your connection string. This is the honest trade-off of any hosted service that connects on your behalf — the same one Retool, Metabase Cloud and Fivetran make. If that risk is unacceptable, use the agent instead.
How we reduce the blast radius
We generate a scoped read-only role for you, with the password created in your browser, so you never paste an administrator credential. If your role can still write, we warn you before storing it.

What the AI can and cannot do

Two independent layers, because one is never enough:

  • A SQL guard strips comments and string literals, then rejects mutation keywords — DROP, DELETE, ALTER, INSERT, UPDATE, TRUNCATE, CREATE, GRANT and others — and refuses multi-statement input.
  • Every query then runs inside a Postgres READ ONLY transaction. Even if the guard missed something, the database itself refuses the write.
  • Results are capped at 1000 rows, 100 by default.

These protect you from the AI — a bad query, or a prompt injection in your own data. A scoped read-only Postgres role is what protects you from everything else, including us. Use both.

How to revoke us

You should never have to rotate your application's password to remove us:

  • Agent: stop the process. The endpoint goes offline immediately. Delete the agent to invalidate its token.
  • Scoped role: DROP ROLE boltschema_ro; on your own database. Instant, and nothing else is affected.
  • Endpoint: delete it in your dashboard. The token stops resolving and any connected AI client is disconnected.

Other measures

  • Endpoint tokens are compared in constant time.
  • Agent tokens carry 32 bytes of entropy and are stored hashed, never in plaintext. They are shown once and cannot be recovered.
  • An agent can only answer its own requests. The agent identity comes from the authenticated token, never from the request body.
  • We refuse connection strings pointing at loopback, private, link-local and carrier-grade NAT addresses — this prevents our servers being used to probe networks, including our own.
  • All traffic is HTTPS with automatically renewed certificates.

What we do not claim

  • We are not SOC 2 certified and hold no third-party security audit. We are a small team and will say so plainly rather than imply otherwise.
  • Our gateway source is not currently public. The agent is — it is what runs on your machine, and it is published unminified for that reason.
  • Query text passes through our servers so it can be relayed. Query results pass back through in transit but are not stored.
  • We have not yet built per-teammate access controls or an audit log. Everyone with an endpoint URL has the access that endpoint has.

Reporting a vulnerability

Email security@boltschema.com. Tell us what you found and how to reproduce it. We will confirm receipt and keep you updated, and we will not pursue action against good-faith research that avoids privacy violations, data destruction and service disruption.