Security

Your organization’s data is yours. This page says how it’s kept apart, who can reach it, what’s recorded, and how it’s deleted.

Kept apart from every other organization

Each organization’s data has its own space in storage, and Ontyx reaches it only through an access role tied to that one organization. Which organization a request acts for is worked out on every request from the signed-in person’s membership (or, for a script, from its push key), never from anything the request itself claims. The limit is enforced by the cloud provider’s permissions, not only by Ontyx’s own code.

Automated tests run on every proposed change to Ontyx, including tests that one organization’s requests never reach another’s data. Separately, every deploy that changes the part of Ontyx that manages organizations runs a live check that tries to read one test organization’s data as another, and if it ever succeeds, that deploy fails.

Encrypted with your organization’s own key

Every file of your data is encrypted with an encryption key that belongs to your organization alone, and storage refuses any file that isn’t. Data travels over encrypted connections (HTTPS).

The description of your data (the names of datasets, columns, metrics and views, their descriptions, the values you list as allowed in a check, the filter values you chose for a metric, a view or a dataset built from others) is kept separately, in Ontyx’s own database, which the cloud provider encrypts. Your rows are never kept there.

Ontyx runs on AWS in the United States.

Who can read it

You, through your assistant or the dashboard, as your role allows. A reader’s requests can only read: anything that would change data is refused before it does anything.
Your scripts’ push keys can only add data. They can’t read anything, and they can’t connect an assistant.
Ontyx staff accounts can’t read or decrypt your stored data. The only way for a person at Ontyx to read it is an emergency access role, used only for a real need such as support you asked for. Using it alerts the Ontyx team, and every file it reads is recorded. It can read, but never change, your data.
Changes to the encryption keys, the access role or the storage rules are recorded and alert the Ontyx team too.

What’s recorded

Access to stored data is recorded in an audit trail: every file read or written, by which role.
Every push request is logged with the organization, the key’s identifier (never the key), the dataset, the number of rows and the outcome.
Every load records how it came in, who sent it and when, inside your own data (see Lineage and history).
Every structure and metric decision records who proposed it, who approved or rejected it, and when.

When a question fails, only the kind of failure is logged, never your data.

You sign in through your assistant’s connector with your Ontyx account; your assistant never sees your password.
Push keys and personal API keys are shown once, when they’re created, and stored only in a form that can’t be turned back into the key. Revoking one takes effect on its next request.
Removing someone from your organization takes effect on their next request, from any assistant.

Deleting data

A dataset is deleted in two steps: marked for deletion (hidden straight away, deleted for good after 7 days, or the number of days you choose up to 30, unless restored), then deleted for good. An owner or admin can delete a marked dataset for good right away. Deleting for good removes every version of its data and its structure. See Datasets.

Your organization’s data, all of it: ask Ontyx at support@ontyx.io. Deleting an organization:

stops it taking new data and revokes every push key;
deletes every file of its data, every version included;
removes its datasets’ descriptions, its metrics and views, its members and its invitations;
schedules its encryption key for deletion. After a seven-day window, the last chance to undo a mistake, the key is gone and any copy of the data that was missed can never be read.

A record that the organization existed and was deleted is kept, with none of its data.

Lineage and history Tools reference