Autonomous AI Discovery
On Your Data — Enterprise Ready
Everything in the open-source platform, plus SSO, role-based access control, data governance, audit logging, and a Slack integration — built for organizations that need security, compliance, and multi-tenant isolation.
Enterprise layers around the open-source core
Enterprise Authentication
Plug into your existing identity infrastructure. No custom integration, no user migration, no separate password database.
Any Identity Provider
Auth0, Okta, Entra ID, Google, Keycloak, Cognito — automatic OIDC discovery.
Role-Based Access
Custom roles from your identity provider, a role-to-permission matrix, and per-project access by role.
Multi-Tenant
Organization-scoped isolation via JWT. Each tenant sees only their data.
Claim Mapping
Map any IdP claim to roles and orgs. Namespaced, array, and custom formats.
Data Governance
Control exactly what the AI can see and query. Protect sensitive data without changing your warehouse schema or ETL pipelines.
| user_id | region | amount | |
|---|---|---|---|
| u-4821 | [email protected] | US-West | $142.00 |
| u-7733 | [email protected] | EU-North | $89.50 |
| u-1094 | [email protected] | US-East | $215.75 |
| u-5507 | [email protected] | APAC | $64.20 |
Granular Access Policies
Exclude datasets, tables, or columns using exact match, glob patterns, or regex — no source data changes needed.
Data Classifications
Tag columns as PII or restricted for automatic exclusion. Safe, internal, and confidential levels for flagging.
Three-Layer Protection
Schema filtering, query result redaction, and AI-powered SQL rewriting — defense in depth at every layer.
Governance Audit Trail
Every exclusion decision recorded with timestamp, rule, and affected data — ready for compliance reviews.
Audit Logging
Know who did what, when. Full visibility into every action across your organization — built for compliance teams and security reviews.
One dashboard for your entire audit trail
Search by user, time range, or action type. Every request is logged with full context — no gaps, no blind spots. Configurable retention from 30 days to indefinite.
Complete Accountability
Every action is attributed to a user and organization. Know exactly who ran a discovery, changed a setting, or accessed sensitive insights.
Compliance Ready
Filterable audit trail with configurable retention. Built to support SOC 2, HIPAA, and GDPR audit requirements.
Operational Visibility
Spot unusual access patterns, track adoption across teams, and understand how your organization uses AI discovery — all from the admin dashboard.
Slack Integration
Discovery notifications and a search over your findings, in the channels your team already lives in. Nothing new to learn — just a slash command.
Discovery Notifications
Auto-posted to linked channels when a discovery run completes — with stats, severity breakdown, and a deep link to the dashboard.
Slash Commands
search, ask, insights, and status — semantic search over your findings and run status, answered directly in-thread.
Channel-Linked, Signed, Audited
Each channel connects to one project. Every request is signed, verified against the Slack signing secret, and logged to the audit trail.
More in the Enterprise edition
Beyond identity and governance, Enterprise adds the operational layer that makes discovery run itself and land where your team already works.
Email Notifications
Discovery results in the inbox — SMTP or Amazon SES, routed per project and per category, with a test-send before you save.
Run Scheduling
Put discovery on autopilot — daily, weekly, monthly, or cron, timezone-aware, with next/last-run and run-now.
Knowledge Sources
Connect Google Drive or upload files directly as searchable context alongside your warehouse.
Mobile & Desktop App (coming soon)
In development: chat with the agentic Data Q&A from your phone or desktop, with push notifications and enterprise SSO.
Fine-tuning on your discoveries
DecisionBox records the queries, fixes, findings, and feedback from your runs. A wizard turns them into a training set, tunes a cloud model on Vertex AI, and switches your project to it when you're ready.
Built from your own runs
Six signals from your projects: exploration, analysis, recommendations, Ask conversations, SQL fixes, and your team's feedback. Preview each one before you build.
Evaluated before you switch
Each job is scored against the base model on held-out examples, including an LLM-as-judge check, with sample answers side by side.
Tuned on Vertex AI
The tuning job runs on Vertex AI with a Gemini base model. Use the tuned model in a project with one click. Training on your own hardware is planned.
Enterprise warehouse connectors
Beyond the open-source warehouses, the Enterprise edition adds read-only connectors for the databases large organizations actually run on — the same autonomous discovery agent, pointed at your estate.
Oracle Database
Connects read-only with a login you control — service name, SID, or connection string. Works with Oracle Database 12c and newer, including RAC and Autonomous Database.
SAP HANA
Connects read-only, scoped by your HANA role — username/password (incl. LDAP) or a connection string. Works with SAP HANA Cloud and on-premise SAP HANA 2.0.
Open Source vs Enterprise
The open-source edition gives you the full discovery engine. Enterprise adds agentic Ask, reports, compounding discovery, and the security and governance layer your organization needs.
Plugin Architecture — Zero Fork
Enterprise features are plugins that layer on top of the open-source platform. No core code is modified. Upgrade the open-source edition independently — enterprise capabilities are always additive.
Discovery engine, API, dashboard, providers, playbooks, Helm, Terraform
OIDC auth, RBAC, data governance, audit logging, priority support
Deploy Your Way
Kubernetes + Helm
Enterprise Helm values overlays layer on open-source charts. Secrets management, ingress, and RBAC — production-ready on any K8s cluster.
Terraform (GCP / AWS / Azure)
Infrastructure-as-code modules for GKE, EKS, and AKS. VPC, IAM, Workload Identity, and enterprise config — all provisioned in one apply.