Yes, your data stays encrypted, your access is revocable at any time, and AI tools only ever get read access to what you've explicitly connected — nothing more. You choose exactly which sources and which items within them are shared, and you can disconnect any of it the moment you want to.
The same is true of the people you share a workspace with. Nobody sees anything you haven't given them: you decide, per person, which sources, tables, and columns their AI can read, anything ungranted stays invisible rather than merely refused, every query anyone makes is logged, and removing someone ends their access within one request.
MCP has grown quickly since its release, and that growth has come with real security incidents across the broader ecosystem — servers left exposed to the open internet, vulnerabilities in specific implementations, and integrations granted far more access than the task in front of them required. That's why Synquil is built the way it is below, and why it's worth checking any MCP server you connect to against the same standard, not just Synquil's.
Read-only connections
Every source connects through that provider's own OAuth flow with read scopes, so your password for that tool never reaches Synquil, only a revocable access token. A direct Postgres or MySQL connection takes a connection string, which should be a read-only user; Synquil only ever runs SELECT against it and blocks private network addresses. Synquil never writes to a source tool.
Per-customer schema isolation
Your synced data lives in its own Postgres schema, not in shared tables split by a customer ID column. Every generated query is parsed before it runs and rejected if it reaches outside your schema: another schema, the system catalogs, or any function not on an allowlist.
Encryption
OAuth tokens and connection strings are encrypted with AES-256-GCM before they are stored; API keys are kept only as bcrypt hashes. The database is encrypted at rest by our hosting provider, and all traffic uses TLS. Credentials are never exposed in logs, error reports, or API responses.
Default-deny access, per person
Access is granted, never assumed. Each person in a workspace holds one or more roles, and a role names the sources, tables, and columns they may read — anything not granted is denied, including its existence. The check runs server-side when the query arrives, not in the AI tool and not in a prompt, so it cannot be talked around: the schema shown to the model is already the caller's subset, and the generated SQL is parsed and verified against that same subset before it executes.
Append-only audit log
Every query through the MCP server is recorded: the person, the AI tool, the tables touched, the SQL, the number of rows returned, and whether it succeeded or was blocked. The database itself refuses any edit or deletion of a log entry, and the log is written regardless of outcome, so a refused attempt to reach ungranted data leaves the same trail as a successful question. Admins can export it as CSV.
Read-only, validated queries
Every query an AI tool sends through the MCP server is parsed and validated as a single read-only SELECT before it runs. There is no code path from an AI tool to a write, an update, or a delete — the query layer checks the query's structure, not just the text the model generated.
Where your data lives
Stored in Frankfurt, Germany (AWS eu-central-1), and processed by our application servers in the Netherlands. The AI model that writes SQL runs in the United States; it receives your question and table structure, never query results.
What the AI model sees
To answer a question: the question and the structure of the tables you may read. To draft your schema: column names and statistics, plus up to five sample rows per source — which a workspace can switch off in Settings so that no cell value reaches the model at all.
Never used for training
Your data is never used to train any AI model, by Synquil or by any provider we use.
Deletion
Delete your account in Settings and your synced data, credentials, roles and logs are deleted with it, within 30 days at most. When a record is deleted in a connected app, it is removed from Synquil's copy on the next sync; for a table merged from several sources or a direct database, email us and we remove it by hand. Cancelling a paid plan deletes nothing: the workspace drops to Free and you keep your data.
Questions stay anonymous
The Questions tab shows what your team asked for and could not get, recorded without any link to who asked: there is no person column, and times are cut to the hour so they cannot be matched to the audit log.
Every service that handles customer data, and where it runs, is listed on the subprocessors page.
Compliance belongs to the organisation using the data, and no tool can hand it over. What Synquil gives you is the evidence and the controls that GDPR, the EU AI Act and US state privacy laws ask for: access limited per person to what their work needs, a record of every query, deletion that reaches our copy, EU data storage, and a list of every processor.
Synquil acts as your processor. A Data Processing Agreement with Standard Contractual Clauses is available on request. We do not hold a SOC 2 or ISO 27001 certification yet; SOC 2 Type I is next on our roadmap, and we are happy to complete your security questionnaire in the meantime.
On the Enterprise roadmap: row-level access policies, SSO/SAML, SCIM provisioning and configurable retention.
If you think you have found a security issue, email hello@synquil.com with "Security" in the subject. We will acknowledge within two working days and keep you updated until it is fixed. Please don't access data that isn't yours or disrupt the service while testing.