Coming Soon — This page describes an architecture that is currently in development and not yet generally available. Contact us to learn more.
Multi-Layer Security
Layer 1: AstroBee Application Security
Layer 2: Credential Management
Layer 3: Native Platform Security
Each connected data source enforces its own access control:Layer 4: Audit & Compliance
Zero-Trust Principle
AstroBee operates on a zero-trust model — it assumes it has no inherent rights to customer data and must prove authorization for every query.Comparison with Traditional Data Integration
Credential Lifecycle Management
Credentials go through a well-defined lifecycle:1
Initial Connection
User redirects to data source OAuth, grants scopes (read data, list tables/objects), receives access + refresh tokens.
2
Active Usage
Tokens used for queries (validity varies by provider).
3
Background Refresh
Before expiry, AstroBee uses the refresh token to get a new access token (transparent to user).
4
Expiry/Revocation
If refresh fails, the connection is marked as expired and the user is prompted to re-authenticate.
5
Deletion
User can disconnect a data source anytime — tokens are securely deleted.
Compliance & Data Residency
Key Compliance Benefits
- Data Residency — Customer data never leaves their cloud region. If Snowflake is in EU, data stays in EU.
- GDPR Compliance — No data processing agreement needed (AstroBee doesn’t process personal data, just query results)
- HIPAA Compliance — PHI remains in customer’s BAA-covered warehouse. AstroBee only sees aggregated results.
- SOC2 Inheritance — Leverage data platform provider’s SOC2 certification (Snowflake, Databricks, Salesforce audited annually)
- Right to Deletion — Deleting data in source system immediately reflects in AstroBee queries (no stale copies)
Audit Capabilities
- Query logs — “Show all queries Bob ran against
sensitive_customerstable” - Access reports — “Which users accessed finance data in last 30 days?”
- Compliance dashboards — Track failed permission attempts, unusual query patterns
Deployment: Customer Onboarding Flow
1
Admin setup
Organization admin connects data sources, defines ontology (business model).
2
User onboarding
Each team member authenticates individually with data sources (their own credentials).
3
Permission inheritance
Users automatically inherit their source system permissions in AstroBee.
4
Usage
Users ask questions, get insights respecting their access levels.
Next Steps
Federated Query Layer
Core architecture and credential delegation model
Architecture Overview
Back to the high-level architecture overview