How Query Streams Keeps Your Data Secure
Query Streams was designed so that connecting a database never means exposing it. Your database stays in your own network, your credentials stay on your own machine, and every connection is encrypted and outbound-only. This overview explains the security model in plain language for evaluators, IT teams, and security reviewers.
Ask Nova questions over connected data
Meet Nova
Turn saved queries into secure endpoints
Build an API
+more
Schedule syncs and push live results
Explore
+more
Query SaaS APIs with SQL
Explore
Let AI tools query connectors directly
Connect AIQuery Streams is a secure, real-time database integration platform. You install a lightweight Network Agent inside your own infrastructure. It makes a single encrypted outbound connection to Query Streams, and authorized people in your organization run pre-approved queries from Excel, Google Sheets, REST APIs, AI/MCP tools, and the web portal. The design goal behind every one of the controls below is simple: give your team live access to your data while your database — and its credentials — stay inside your own network. When our support team assists with troubleshooting, any access to your account happens at your request and is recorded in the audit log.
The core idea: your data never leaves your control
Unlike traditional integrations, Query Streams does not ask you to open a firewall port, whitelist our IPs into your database, or upload a copy of your data to our cloud. The Network Agent runs where your database already lives and reaches out to us — never the other way around.
Security at a glance
Outbound-only connectivity
The agent opens one encrypted outbound connection. No inbound firewall rules, no VPN, and no public exposure of your database.
Credentials stay in your environment
Your database username and password are held by the agent on your own machine, protected with operating-system key protection (DPAPI on Windows and equivalents on Linux/macOS).
Read-only by design
The agent validates every query and rejects anything that is not a read. Queries run under the read-only database credential you configure.
Encryption everywhere
All connections use TLS 1.2 or higher in transit. Data stored on our platform is encrypted at rest.
Tenant isolation
Every request is scoped to your organization. Access to another organization’s data is rejected at the data layer.
Single sign-on
Users sign in with Google or Microsoft, so your existing identity, MFA, and conditional-access policies apply.
Role-based access
Viewer, editor, admin, and owner roles control who can run, build, share, and manage. Shared users run queries without ever seeing the SQL.
Audit logging
Authentication, permission changes, configuration changes, and query activity are recorded, with sensitive values redacted.
Encryption
| Path | Protection |
|---|---|
| Your browser / Excel / Google Sheets → Query Streams | HTTPS / WSS, TLS 1.2+ |
| Network Agent → Query Streams cloud | Encrypted outbound WebSocket (WSS), TLS 1.2+ |
| Query Streams platform database & backups | Encrypted at rest (cloud-managed encryption) |
| Database credentials on the agent | OS-level key protection (DPAPI / platform equivalent) |
| Stored integration secrets & tokens | Application-level encryption at rest |
Access control and identity
Sign in with your identity provider
Authentication is delegated to Google or Microsoft OAuth. Your organization’s multi-factor authentication and conditional-access rules are enforced by your provider before a session is ever created.
Short-lived sessions
Sessions use short-lived access tokens stored in secure, HTTP-only cookies that are never exposed to page scripts, and can be revoked server-side.
Least-privilege roles
Viewer, editor, admin, and owner roles map access to responsibility. Queries can be shared so recipients can run them without seeing the SQL or touching credentials.
Organization isolation
Every data path is filtered by your organization identifier and cross-organization access is rejected — including on the connection that routes queries to your agent.
Active threat monitoring and edge defense
Our communication servers are protected by a purpose-built security system that watches every connection attempt in real time. It sits behind a global edge network and talks to it directly — so a threat detected at the application layer can be blocked at the edge, worldwide, in moments.
Real-time connection analysis
Every connection attempt is inspected as it happens: connection-rate anomalies, failed authentication attempts, malformed or forged commands, and protocol abuse are all detected and logged to a durable security ledger.
Threat-intelligence enrichment
Sources are automatically enriched with network and threat-intelligence data — known abusers, anonymizing proxies, Tor exit nodes, and hosting-provider traffic are flagged the instant they connect.
Edge-level blocking
The platform integrates directly with our edge network (Cloudflare). Offending IP addresses, entire networks (ASNs), or whole countries can be blocked at the edge in seconds — before their traffic ever reaches the platform again.
Automated response
Configurable rules turn detections into action automatically — repeated authentication failures or abusive connection patterns can trigger bans without waiting for a human, with every action recorded in an auditable ledger.
Proprietary protocol
Agents speak a proprietary, authenticated message structure over their encrypted channel. Traffic that does not match it exactly — fake commands, guessed keys, replayed messages — is rejected outright and flags the source for banning.
Trusted-source protection
A curated allowlist protects known-good infrastructure and customer agents from false positives, so defensive automation never disrupts legitimate traffic.
Sub-processors
Query Streams relies on a small number of established infrastructure and service providers to operate the platform. A current summary:
| Provider | Purpose |
|---|---|
| Google & Microsoft | Sign-in / identity (OAuth) |
| Cloudflare | Edge network and web application protection |
| Stripe | Billing and payment processing |
| Sentry | Application error monitoring |
Compliance and certifications
Being straight with you: Query Streams does not currently hold a SOC 2 Type II report or ISO 27001 certification. We operate under a written security program built around the controls described on this page, and we are actively working toward SOC 2. If certification status affects your evaluation, we’re happy to share our security architecture documentation and respond to your security questionnaire under NDA.
Your data, your control
Query results are not warehoused
Results stream to the person who ran the query and are rendered in their spreadsheet, browser, or tool. Query Streams is a live access layer, not a copy of your database.
Export and deletion on request
You can request export or deletion of your account data. Removing the agent immediately ends all access to your database.
Visibility
Administrators can review users, connectors, saved queries, and activity for their organization at any time.
Frequently asked security questions
Do I have to open a firewall port or expose my database? +
Where are my database credentials stored? +
Can Query Streams change or delete data in my database? +
How do you keep my data separate from other customers? +
How do users sign in, and is MFA supported? +
Are you SOC 2 or ISO 27001 certified? +
Need to go deeper for a security review?
We’ll share our security architecture documentation, answer your questionnaire, and set up a call — under NDA.
Related guides: Install the Query Streams Agent on Windows | Explore Query Streams features
English 
Spanish 
German 
French 
Portuguese 
Japanese 
Korean 
Chinese 
Italian 
Dutch 
Indonesian 
Polish