Security

Every query from every surface — a person in a workspace, an agent over MCP, an API call from your application — enters through one gateway, where it is checked against the model's access rules and logged to a permanent audit trail. Security is not a layer added around Credible; it is a property of the path every query takes.

Identity

• People sign in through your SSO. Credible's APIs are a standard OAuth resource server: users authenticate through your organization's identity provider — Microsoft Entra ID and others via Auth0 — and every request they make acts with their permissions. See Users & Groups.
• Services use API keys scoped to a group. Anything server-to-server — your product, a script, CI/CD — authenticates with an API key that acts with its group's permissions. Keys are minted from the CLI and can be revoked at any time.
• Every request names its organization. Each organization has its own hostnames, and a request's identity or key must belong to the organization it addresses.

Access Control

Access is defined in the model and enforced at the gateway, on every query, from every surface:

• Environment roles (Admin, Modeler, Viewer) control who can model, publish, and query; workspace and document sharing control analysis. See Permissions.
• Row and column scope live next to the data they protect, as #(authorize) gates, secure givens, and field access modifiers in the model — version-controlled, reviewed like code, and enforced identically for workspace chat, MCP agents, data apps, and the REST APIs.
• Secure givens resolve server-side from the caller's verified identity — their email and groups, or an API key's group — so a caller cannot forge them. This is how a product embedding Credible isolates tenants without reimplementing row-level security in application code; see Tenant Isolation for Embedded Products.

Fine-grained access control and audit logging are part of the Enterprise plan.

Data Protection

• Credentials never leave the control plane. Database credentials are stored once, in an environment; modelers and consumers never touch the database directly, and every query is proxied.
• Encrypted in transit. All traffic terminates TLS behind a global load balancer with a web application firewall. Outbound queries originate from stable egress IPs you can allowlist.
• Isolation. Organizations are isolated by identity and hostname on shared clusters; the Enterprise plan adds dedicated single-tenant clusters, VPC connectivity, and Private Link.
• Compliance. Credible is undergoing a SOC 2 Type I audit covering the Security trust services criteria, with Type II to follow; the security package is available on request from security@credibledata.com. Subprocessors and data handling are described in the privacy policy and subprocessor list.

Audit Trail

Because all consumption routes through one gateway, every query is logged — who asked, from which surface, against which model version, and what it returned — to an immutable audit trail. See Monitoring.

Next Steps