Security

How ChartBase protects your data, described precisely enough to be checked — including what is not yet in place.

Accounts and authentication

• Passwords are hashed with bcrypt at cost 12. We cannot read them, and a database disclosure would not reveal them.
• Sessions use signed tokens held in HttpOnly cookies, so page JavaScript cannot read them and a cross-site scripting bug cannot steal a session.
• Cookies are SameSite=Lax and HTTPS-only in production.
• Email addresses are verified before an account becomes usable.
• Authentication and other sensitive endpoints are individually rate-limited.

Encryption

• In transit: HTTPS between you and us. Connections to our own database use TLS with certificate verification enabled — encryption without verifying who is on the other end protects only against passive eavesdropping, not an active attacker.
• Database credentials: the username and password for any database you connect are encrypted with AES-256-GCM before storage. The encryption key lives outside the database, so reading the database alone does not yield them.
• Outbound connections: connections to your database are encrypted by default and the server certificate is verified. You can turn encryption off for a database on a private network, but it is a deliberate choice, not the default.

Access control

• Every dashboard and dataset request is authorised server-side. A user who is not permitted to see something receives “not found” rather than “forbidden”, so the existence of other people's work is not disclosed.
• Uploaded files are stored under per-user keys, so one account's storage cannot collide with or address another's.
• Row-level security: you can restrict which rows a collaborator sees. The filter is applied inside the query plan before it is cached, so two groups can never be served each other's cached results — and it cannot be stripped by a formula, including functions specifically designed to remove filters.
• Embed tokens grant read-only access and can be rotated, which instantly voids the old one.

Application hardening

• Security headers are set on every response.
• Database connections resolve and pin the target address before connecting, which blocks server-side request forgery — the connector cannot be pointed at internal network services.
• Error responses carry a reference code rather than internal detail, so stack traces and query fragments are not exposed to clients.
• Request logs redact identifiers and credentials rather than recording URLs verbatim.
• The codebase carries an automated test suite covering these behaviours, so a regression in one of them fails the build rather than shipping quietly.

What we do not have

This section is here because it is the one buyers actually need, and because a security page without it is marketing.

• No SOC 2, ISO 27001, HIPAA, or PCI-DSS certification. No independent audit has been performed. If a questionnaire asks, that is the answer.
• Encryption at rest depends on deployment. Your uploaded files and analytics data are not encrypted by the application itself — they are protected by the storage and disk encryption of the environment the instance runs in. We do not encrypt those files in the application layer because the query engine reads them directly, and doing so would remove the ability to read a single column out of a large file.
• No contractual uptime guarantee or service-level agreement at present.
• No customer-managed encryption keys, and no single sign-on or SCIM provisioning.
• No formal penetration test has been commissioned.

Things you control

• Use a read-only database user. ChartBase never needs write access, and a read-only account limits the blast radius of any compromise.
• Leave connection encryption on unless the database is on a network you control end to end.
• Treat share links and embed tokens as credentials. Anyone holding one can view the dashboard.
• Think before using the AI features on sensitive data. They send sample rows to a third-party model provider — see the Privacy Policy for exactly what is sent.

Reporting a vulnerability

If you find a security issue, email info@chartbase.io with enough detail to reproduce it. We will acknowledge it, keep you updated, and will not pursue legal action for good-faith research that avoids privacy violations, data destruction, and service disruption. Please give us a reasonable chance to fix it before publishing.