Security & compliance
Nothing leaves the building
Asky was designed for banking, insurance and telco environments where a cloud-only BI copilot is not an option. Deployment, keys and logs stay under your control.
The security model
Deployment
On-prem, air-gapped or private VPC. No hyperscaler dependency and no vendor-side data copy.
Keys & models
BYOK LLM per customer, CMEK for encryption, or a fully local model. Credentials are never stored by Asky.
Execution guard
Read-only SQL with EXPLAIN dry-run and cost estimate before execution. Asky cannot write or drop.
Access control
SSO, RBAC, row-level and column-level security. SQL visibility itself is a role, not a default.
Spend governance
Token quotas at session, user and team level so finance can cap exposure before it happens.
Auditability
Every question, generated query and result is logged with user and tenant context for review.
Multi-tenant isolation keeps user and team scopes 1–1, so a pilot in one business unit cannot read another’s data — even when both point at the same warehouse.
Security review questions
Can Asky run with no outbound internet access?
Yes. With a local model, the full path — retrieval, generation, execution and charting — runs inside your network.
Who can see the generated SQL?
Only roles you grant it to. Business viewers get the answer and chart; analysts and admins can inspect and verify the query.
What stops a query from hurting production?
Read-only credentials plus an EXPLAIN dry-run with a cost estimate. Queries over the threshold are refused, not run.