Does an AI analytics agent need access to your data warehouse?
The honest answer is that it depends what you mean by access. Here is what an Operator reads, what is kept, what is not, and how to check.
It needs to read, through connections you grant and can revoke, and it does not need you to hand over a copy of your data. The distinction that matters in a security review is not read versus no read. It is what leaves your systems, what is retained afterwards, and whether you can see every query that was run.
Most vendor answers in this category collapse those three into one reassuring sentence. A reviewer cannot test a reassuring sentence. Below is what an Operator reads, what is kept, what is not, and the questions worth asking any vendor here, us included.
What does an AI analytics agent actually read?
An Operator that owns a KPI needs whatever evidence explains that KPI, which is rarely in one place:
- Web and product analytics, for the metric itself and its breakdowns.
- Session replay, for what a customer actually did on the surface in question.
- Change management and engineering tickets, because the cause is often a release rather than a customer.
- The warehouse or BI layer, where most enterprises keep the definitive version of a metric.
Whether the warehouse specifically is in scope is your decision, not a requirement. A useful investigation can run on analytics, replay and change records alone. The warehouse adds the authoritative numbers and the long history, which is why most teams include it once the first investigations have earned trust.
Does it need a copy of your data?
No, and this is where vendors differ most.
Augmeta connects to the systems you authorize and queries them in place. Agents only touch the integrations you explicitly connect. Nothing is crawled, scraped or inferred beyond what you authorize, and an integration can be disconnected instantly.
Being precise about what that does and does not mean, because a security reviewer will ask:
That fifth row is the one most buyers assume and never verify, and the fourth is the one most vendors leave out. Retrieval needs an index, an index is storage, and the honest answer is to name it and say how it is isolated rather than to claim nothing is kept.
What should a security review ask any vendor in this category?
These are the questions we would ask, including the ones that are least comfortable for us.
- What exactly is read, per integration, and who decides? If the answer is a category like "your analytics", ask for the list of calls.
- What is retained after an investigation ends, and for how long? Push past "nothing" until you have the list: indexes, embeddings, traces, logs, cached results.
- Where does it run, physically? Region matters for your own commitments to customers.
- How is one customer's data separated from another's? Ask whether isolation is enforced at the data layer or by application code. The first survives a bug in the second.
- Do model providers train on our data? Ask to see the contractual position, not the marketing claim.
- Can we see every query the agent ran? If the working is not inspectable, neither the security review nor the analysis can be checked.
- How do we revoke access, and how fast does it take effect?
- What happens on an incident? Who is told, in what time, and what is the disclosure history.
- What is the audit position, and what is in progress rather than finished? A vendor that distinguishes the two is telling you the truth about the rest.
For the questions to ask about accuracy and follow-through, see How to choose an AI analytics tool for enterprise retail.
How Augmeta answers them
- Scope: agents touch only the integrations you connect. Nothing beyond what you authorize.
- Retention: credentials encrypted before storage and never logged; query results processed and discarded; retrieval documents and embeddings stored with namespace-level isolation per organization.
- Region: managed, US-hosted infrastructure. Application services on AWS US regions and Railway, with isolated compute per service layer.
- Isolation: every resource is bound to a single organization and queries are scoped at the organization level, so cross-tenant access is prevented architecturally rather than by convention. PostgreSQL with encrypted connections enforces that at the data layer.
- Encryption: AES-256-GCM, 256-bit keys, a random IV per operation, GCM auth tag, TLS 1.2 or above in transit.
- Models: third-party providers called through APIs, contractually prohibited from training on your inputs or outputs.
- Inspectability: every agent action is traced and logged, so you can see what data was accessed, what reasoning was applied and what came back.
- Access control: authentication through Clerk, which is itself SOC 2 Type II certified, with short-lived tokens, automatic refresh, device-level revocation and MFA available. Every request authenticated by JWT carrying organization and role claims.
- Audit position: a SOC 2 Type II audit is underway, monitored continuously through Oneleet, covering security, availability and confidentiality over an observation period rather than a point in time. It is in progress, not complete, and we say so.
A vendor pack, a completed questionnaire and architecture documentation are available for a review, at security@augmeta.ai. The full posture is on our security page.
What about the evidence and the conclusions?
An investigation produces two things: the evidence it read, and the account of what it concluded. The evidence stays in your systems. The account lives in your workspace, scoped to your organization, visible to the people you have granted access to, and inspectable step by step: which hypotheses were tested, which were refuted, which remain open.
That inspectability is a security property as well as an analytical one. A conclusion you cannot trace is a conclusion you cannot audit. How to check that trail is in Do AI analytics agents invent explanations, and how to audit one.
Next step: bring your security questionnaire and one KPI to a demo, and we will walk through both.
Key takeaways
- Access is not one thing. Separate what is read, what leaves, what is retained, and what is inspectable.
- An Operator reads through connections you grant and can revoke instantly. It does not need a bulk copy of your data.
- Retrieval requires an index, so something is stored. Ask what, and how it is isolated.
- Warehouse access is a choice, not a requirement. Analytics, session replay and change records support real investigations on their own.
Key terms
- Data in place: querying the systems a company already runs, rather than exporting the data into the vendor's own store.
- Tenant isolation: keeping one customer's data separate from another's. Strongest when enforced at the data layer rather than by application logic.
- Namespace isolation: separating stored vectors or documents per organization so retrieval cannot cross customers.
- Scoped access: permission limited to the specific integrations granted, revocable by the customer.
- Observation period: the window a SOC 2 Type II audit covers, as opposed to a point-in-time check.
Frequently asked questions
Does an AI analytics agent need access to our data warehouse?
Not necessarily. It needs read access to the systems that explain the KPI, which can be analytics, session replay and change records. The warehouse adds authoritative numbers and history, and whether to include it is your decision.
Do you copy our data into your own systems?
No. Connected systems are queried in place and results are processed and then discarded. Documents and embeddings used for retrieval are stored with namespace-level isolation per organization.
Do the AI models train on our data?
No. Third-party models are called through APIs under contracts that prohibit training on inputs or outputs.
How is our data separated from other customers?
Every resource is bound to a single organization and queries are scoped at the organization level, enforced at the data layer, with per organization namespaces for stored vectors.
Where is the data processed?
On managed, US-hosted infrastructure, with application services on AWS US regions and Railway and isolated compute per service layer.
Are you SOC 2 certified?
A SOC 2 Type II audit is underway, monitored continuously through Oneleet. It is in progress rather than complete, and a vendor pack is available for security reviews in the meantime.
Can we revoke access?
Yes. Integrations can be disconnected instantly, and sessions support device-level revocation.