Security
Last updated: 13 November 2026
- Your data is processed on your computer. onViz runs no cloud service that stores or relays it.
- onViz only reads data. Several layers block statements that would change or delete it.
- Secrets are encrypted and kept in your operating system’s secure storage. Secret columns are always masked from the AI.
- Found a vulnerability? Email us privately, see section 7.
1. Local by design
The desktop app runs its own server on your computer, reachable only from your computer. Imported files, charts, reports and conversations live in the app’s data folder. Queries go directly from your computer to your data sources and the AI provider you chose, never through onViz.
2. Passwords and keys
- Database passwords, Grafana tokens and AI API keys are encrypted with AES-256-GCM before they are saved.
- The encryption key is kept in macOS Keychain or Windows Credential Manager, or in a file only your user account can read. You choose in Settings › System.
- Moving to a new computer uses a password-protected key file, so secrets never travel in plain text.
3. Read-only access
- Only SELECT queries are allowed. Write and admin keywords are blocked before a query is sent.
- Direct database connections run in read-only sessions that are always rolled back.
- Imported files are opened read-only, with access to other files and extension installs turned off.
- Optional limits: required LIMIT clause, maximum row count, blocked CROSS JOIN and your own blocked keywords.
These safeguards reduce risk but do not replace database permissions. Connect with accounts that only have read access.
4. What the AI can see
- Columns named like secrets (password, token, API key, OTP, PIN, card number, CVV…) are always masked.
- You can mask more columns, block tables and limit how much conversation history is sent.
- The AI works through onViz tools that apply the same read-only rules. Claude Code and Codex run with shell, file editing and web search turned off.
5. Sharing on your network
Remote viewing is off by default. When on, it requires a password, offers view-only access to reports, and cannot import or change data. Turn it off when you no longer need it.
6. Signed updates
Updates are downloaded from our server and installed only after their signature matches the public key built into the app. The app asks before installing. Grafana installed from the app is verified against the checksum published by grafana.com.
7. Reporting a vulnerability
Please report security issues privately to [email protected], not in public channels. English or Vietnamese is fine. Include:
- the onViz version and operating system;
- steps to reproduce, and a proof of concept if you have one;
- the impact you expect.
We will acknowledge your report within 3 business days and keep you updated until it is fixed. Please give us reasonable time to release a fix before disclosing. We will not take legal action against good-faith research that respects users’ privacy and does not disrupt our services. There is no paid bug bounty at the moment.
8. Recommendations
- Keep onViz up to date.
- Use read-only database accounts and only enable the data sources you need.
- Back up from Settings › System and keep the backup somewhere safe.
- Encrypt your disk (FileVault, BitLocker) and lock your computer when you step away.