Security
Authentication
Sign-in is handled by the DataLakeHouse identity provider (Auth0). UnitOps never stores your password. Supported methods include email and password, Google Workspace, and enterprise SSO connections configured for your tenant.
Sessions are carried by a signed, HTTP-only cookie. The token contains your organization, your role, and the locations you may access.
Authorization
| Layer | Enforcement |
|---|---|
| Role | admin, general_manager, manager, read_only, ai_user decide which pages and actions exist |
| Location | Per-user grants decide which stores you can view, adjust, and publish, see Location permissions |
| API | Every endpoint re-checks the role and location scope; the UI is never the only gate |
| Database | Postgres row-level security filters rows by organization on every query |
Tenant isolation
Every record carries an organization identifier. Repository functions require it, the API sets it per request from the validated token, and the database enforces it. Warehouse SQL generated for KPIs and AI answers is statically checked for the tenant predicate and rejected if it is missing.
Data handling
| Data | Where it lives |
|---|---|
| Operational metadata, chats, audit log, embeddings | UnitOps Postgres database with pgvector |
| Source sales, labor, review, and weather data | Your warehouse; UnitOps queries it read-only |
| Uploaded documents | Your Google Cloud Storage or Amazon S3 bucket |
| Secrets (API keys, tokens) | Encrypted at rest, or referenced from a vault as vault://... |
Warehouse credentials are never returned to the browser, and API keys are never written to logs.
AI and your data
- Model calls carry only the context needed to answer the question: KPI results, forecast values, and retrieved document chunks for your organization.
- Retrieval respects the asking user's location permissions.
- Generated SQL is validated as read-only before execution.
- If you need model traffic to stay inside your own cloud, your deployment can be configured to use Vertex AI in your Google Cloud project; ask whoever operates UnitOps, see AI configuration.
Auditability
Admin -> Audit Log records who changed what and when: configuration changes, permission changes, forecast submissions, approvals, and publishes. Deleted records go to the Recycle Bin rather than disappearing.
Embeds
Embed URLs are HMAC-signed and expire, by default after 7 days and at most after a year. They bypass sign-in by design, so treat an embed URL as a credential and prefer short lifetimes for sensitive dashboards. See Embedding dashboards.
Reporting a concern
Email support@datalakehouse.io with the details and, if a specific request is involved, the time and the page. Do not include credentials in the message.