Security and deployment
Read-only. Your environment. Your metadata, exportable in full.
DQHQ queries source data in place and stores metadata, test outputs and profiling samples. This page states what is stored in each deployment model, who can see it, and how it leaves when you do.
Not in the write path
DQHQ connects to your systems of record, warehouse, feeds and exports with read-only credentials through standard connectors. It never writes to a source system.
What is stored
Schemas, definitions, lineage, test definitions and results, classifications, and profiling samples. In your environment and private cloud, all of it stays inside your boundary. Hosted, it is held in a single-tenant store in the region you choose.
Deploys where you need it
Inside your own cloud account or data center, in a dedicated private cloud we operate for you, or hosted. Profiling samples can be disabled per source in any mode.
Access follows classification
Classifications such as PII, MNPI, member-submitted or confidential travel with the data. People and AI agents see only the columns their role allows, including over MCP.
Exportable, in full, at any time
Everything DQHQ stores is in documented formats and can be exported in full at any time, during a pilot or after. On termination, metadata is exported to you and deleted within 30 days.
Questionnaires answered
Send your vendor security questionnaire before the scoping call and we return it completed. The controls below cover the questions we are asked most.
Controls
What your security team will ask, answered.
Encryption
TLS 1.2+ in transit. AES-256 at rest for metadata, test results and profiles. Keys managed by your cloud KMS when deployed in your environment.
Authentication and SSO
SAML 2.0 and OIDC single sign-on with your identity provider. MFA enforced through the IdP. Service accounts use scoped API tokens with expiry.
Role-based access
Roles for viewer, steward, owner and admin. Column-level visibility follows classification (PII, MNPI, member-submitted), and applies equally to people and AI agents over MCP.
Audit logs
Every login, query, classification change, test edit and agent request is logged with actor, timestamp and object. Logs are exportable to your SIEM.
Data residency and deployment
Your cloud account or data center, a dedicated private cloud in the region you name, or hosted single-tenant. Source data is queried in place; only metadata, test outputs and optional profiling samples are stored.
AI models and training
Model provider is your choice, including models hosted inside your environment. Your data and metadata are never used to train models. Agent context is scoped by the same classifications as human access.
Retention, backups and deletion
Retention periods set by you. Encrypted daily backups with a documented restore test. Full export and verified deletion of all metadata within 30 days of termination.
Subprocessors and questionnaires
Current subprocessor list, architecture diagram and completed security questionnaires (SIG Lite, CAIQ, your own) available on request before the scoping call.
security@dataqualityhq.com for questionnaires and disclosures