Security and data handling

No, and it is enforced in code rather than by policy: before any generated query reaches BigQuery, DataLens rejects it unless it is a plain SELECT (or a WITH … SELECT), and it blocks INSERT, UPDATE, DELETE, MERGE, DROP, TRUNCATE, ALTER, CREATE, GRANT and EXECUTE IMMEDIATE outright. For least privilege on your side too, connect via a service account scoped to BigQuery Data Viewer + Job User — signing in with Google instead grants DataLens the broader OAuth scope BigQuery requires to start a query job at all.

DataLens does not replicate your database. Every query runs live against your connected warehouse or ad accounts — there is no background sync and no copy of your tables. What is persisted is the conversation itself: your questions, the answers, the generated SQL, your visualization settings, and up to 50 rows per message of the result behind an answer, so a past analysis still renders when you reopen it. Deleting a conversation removes it. The Privacy page has the full retention disclosure.

All credentials (database service account keys, OAuth tokens, and LLM API keys) are encrypted at rest using industry-standard AES-256-GCM encryption. Credentials are only decrypted temporarily in memory during server-side query execution and are never logged, exposed to client browsers, or shared with third parties.

DataLens does not train any model on your data, and does not share it with anyone but the AI provider you pick. That provider receives the messages in the turn you send — that is what generates the answer — and its own API terms govern retention and training from there. Rather than ask you to take a vendor contract on trust, DataLens gives you a switch that removes the question: turn on Hide identifying values (Settings → Privacy) and the identifying text never reaches the provider at all. You can also bring your own provider key, or point DataLens at a local OpenAI-compatible endpoint, so your data only goes where you have already contracted for it.

Yes — Settings → Privacy → "Hide identifying values from the model". With it on, DataLens swaps every identifying value for a stable placeholder on this server, just before the request leaves for the provider, and swaps it back the moment the answer returns. The provider sees DLX_A_7K2M9QRTVX where your data says a customer name; you keep seeing the real name on screen, in charts, and in CSV/Excel exports. Because each value maps to the same placeholder every time, the model can still group, rank, join and filter on it normally — which is why this is pseudonymization rather than encryption. Numbers, dates and platform vocabulary (status, country, device, and so on) are sent unchanged, so every figure stays exact. It is off by default and applies from the moment you switch it on; you can also force any individual column to plain or hidden.

Yes. For teams with strict air-gapped security or compliance requirements, DataLens supports connecting to custom OpenAI-compatible local endpoints (such as Ollama or vLLM running on your private VPC hardware).

Cloud warehouses (like BigQuery) bill by bytes scanned. DataLens performs dry-run estimations before executing queries to surface the exact data volume and estimated cost in advance. You can also configure hard byte-scan limits to prevent accidental full-table scans.

Not when it is answering questions. The Google Ads integration only sends read-only GAQL search queries and contains no mutate call, so it cannot change bids, budgets, keywords or ads. Meta Ads analysis tools only read. A separate Ads Launcher, available to allow-listed accounts only, can create or edit Meta ads — and every change it makes must first be approved by a person who sees exactly what will be written.

Share links are read-only snapshots of a conversation. API keys and credentials are stripped from the snapshot, viewers cannot run new queries, and shared pages are excluded from search engines.