Security & governance
Governed by default
Security isn't a bolt-on in DigDeep — access control, data protection and auditability are compiled into every single query, from self-serve explore to the AI assistant.
One policy engine, everywhere
Row-level security and column policies live in the semantic layer, not in each report. Define them once and they apply everywhere data is queried — dashboards, explore, the SQL console, embedded analytics and the assistant.
Access control
Decide precisely who can reach what, from broad roles down to a single dashboard.
Role-based access control
Owner, Admin, Editor and Viewer roles scope what every member can see and do — enforced on every request across the platform.
Per-resource grants
Fine-grained ABAC grants on individual sources, datasets, dashboards and charts, with deny-overrides-allow so a single exception never leaks.
SSO & SCIM
Bring your own identity provider on Enterprise — single sign-on and automated user provisioning keep access in lockstep with your directory.
Data protection
Keep sensitive data governed wherever it is queried — no ungoverned copies.
Row-level security
Row-level policies are compiled directly into every generated query, so users only ever see the rows they are entitled to — no post-filtering.
Column masking
Field-level column policies mask or hide sensitive columns per role, applied consistently across explore, SQL, dashboards and the AI assistant.
Export controls
Export rules govern who can pull data out and in what form, so governance follows the data even when it leaves a dashboard.
Safe AI & auditability
Let an AI assistant act on your data without giving up control or a paper trail.
Sandboxed code execution
The AI assistant runs Python in a fresh, isolated Docker container with no network access and no credentials — with AST safety checks before anything runs.
Human-in-the-loop approvals
Any change that writes to your workspace pauses for an explicit approval, with a clear human-readable summary of exactly what will happen.
Audit logs & change requests
A full audit trail plus governed change requests and access-request workflows mean every action is attributable and reviewable.
Multi-tenant by design
Every resource is scoped to an organization, and the production configuration validator fails fast on insecure settings — so isolation between tenants is enforced by the platform, not by convention.
Analytics your security team will sign off on
Roll DigDeep out across your whole org with governance built in from day one.