# Security & Compliance Architecture

VeilAnalytics is an enterprise-grade analytics engine engineered with a **Local-First, Zero-Raw-Data AI Privacy Architecture**. Unlike traditional BI platforms that require uploading confidential data files to cloud warehouses or external LLM vendors, VeilAnalytics guarantees zero raw data row exposure.

---

## 1. Zero-Raw-Data Privacy Isolation

VeilAnalytics enforces strict data isolation between your analytical workloads and external AI models:

```
┌─────────────────────────────────────────────────────────────────────────────┐
│                          LOCAL COMPUTATION BOUNDARY                          │
│                                                                             │
│  [ Local Dataset / DB Source ]                                              │
│               │                                                             │
│               ▼                                                             │
│    [ Embedded DuckDB Engine ] ◄────── In-Memory SQL Execution (Sub-50ms)     │
│               │                                                             │
│               ▼                                                             │
│     [ Schema Extraction ] ──► (Column Names & Data Types ONLY)              │
└───────────────┬─────────────────────────────────────────────────────────────┘
                │
                │  Sanitized Metadata Definition (0 Raw Data Rows)
                ▼
  ┌───────────────────────────┐
  │ Cloud LLM / Local Ollama  │ (Synthesizes SQL Queries ONLY)
  └───────────────────────────┘
```

### Core Security Guarantees:
1. **Raw Data Isolation**: Raw rows, PII, banking records, and confidential metrics never leave local RAM or your container environment.
2. **Schema-Only AI Context**: Only sanitized column names and data types are passed to natural language models to synthesize SQL queries.
3. **Schema Column Masking (Anonymization Mode)**: For sensitive datasets, users can enable **Schema Anonymization Mode**. Column identifiers are dynamically aliased (e.g. `customer_email` ➔ `col_01`) prior to prompt dispatch. Generated SQL statements are un-aliased locally before execution, preventing PII metadata exposure.
4. **Local Execution**: Queries run 100% locally using an embedded C++ analytics engine.

---

## 2. AST Query Firewall & Security Sandboxing

To prevent prompt injection, file modification, or unauthorized system access, all SQL queries pass through a multi-tier **AST (Abstract Syntax Tree) Query Firewall** prior to execution.

### Firewall Policy Enforcement:
- **Read-Only Whitelist**: Only non-destructive analytical operations (`SELECT`, `SHOW`, `DESCRIBE`, `SUMMARIZE`) are permitted by default.
- **System & Filesystem Function Blocking**: System pragmas, OS environment access, file export/import commands, and binary execution routines are blocked at the AST node level.
- **Multi-Query Chaining Protection**: Semicolon-delimited multi-statement injections are rejected before database dispatch.

---

## 3. Enterprise Compliance Alignment

VeilAnalytics is designed to simplify compliance across strict enterprise privacy frameworks:

### HIPAA (Healthcare Data Protection)
- **Zero PHI Transmission**: Patient health records and raw rows remain strictly within local RAM.
- **Air-Gapped LLM Support**: Support for local, air-gapped models (e.g., Ollama / Llama 3) ensures 100% offline compliance without vendor cloud dependencies.

### GDPR (EU Data Protection)
- **Data Minimization (Art. 5)**: Processing is strictly limited to schema metadata required for SQL synthesis.
- **Zero Remote Persistence (Art. 17)**: Closing an analytics session immediately purges temporary in-memory tables.

### SOC 2 & Enterprise Perimeter
- **Zero-Retention Perimeter**: Local execution ensures data stays inside your existing enterprise security boundary and SOC 2 perimeter.

---

## 4. Live Database Connector Security

For direct querying against live production databases (PostgreSQL & MySQL):
- **Encrypted Transport**: Enforces TLS/SSL encrypted client connections.
- **Read-Only Transactions**: Direct queries run inside isolated read-only transaction wrappers (`READ ONLY`).
- **Local Credentials**: Connection strings and credentials remain stored in your local browser environment or environment variables and are never transmitted to third parties.

---

## 5. Security & Technical Inquiries

For custom enterprise DPAs, security questionnaires, or vulnerability disclosure:
- **Email:** `sales.veilanalytics@outlook.com`