Security

This page explains where your data is stored, how it is protected, and how Fresco BI keeps organizations apart.

Where your data is stored

Fresco BI stores three kinds of data:

What	Where
Your account, organizations, workspaces, data source settings, data models and reports	The Fresco BI database
Imported data (Import Data Tables)	Encrypted files in your organization’s own storage area
Uploaded files (Excel, CSV)	Fresco BI file storage, then loaded into a Data Table

Realtime Data Tables keep no copy: each query reads your source.

In transit

All traffic between your browser and Fresco BI uses HTTPS (TLS).
You choose the SSL mode of each data source. Test connection shows the result: TLS, certificate verified, TLS, certificate not verified or Not encrypted. Some cloud sources always encrypt the connection and verify the server certificate.
An SSH tunnel checks the bastion’s host key. You confirm the key once, and Fresco BI refuses a server that shows another key.

At rest

Data source passwords, keys and tokens are encrypted with AES-256-GCM. Each organization has its own key.
Imported data is stored in encrypted files. Each file has its own key.

Passwords and keys of data sources are write-only. The app never shows them again. To keep a saved password, leave the field empty when you edit.
Credentials never appear in logs or error messages. Fresco BI shows a fixed message for each error code, never the raw text from your database.
Only the part of Fresco BI that connects to your sources can decrypt the credentials. Each use is written to the audit log.
Your Fresco BI password and two-step secrets are handled by the sign-in service only. The rest of the app never receives them.

Every record in the Fresco BI database belongs to one organization. The database itself refuses to return another organization’s records, even if the application asks for them.
Imported data of each organization is stored and encrypted separately.
Inside an organization, every request is checked against your workspace role and your shares.
An item you may not see answers “Not found”. Its name is not revealed.

Fresco BI only reads your sources. It never writes to them.

Use a database account with read-only access.
Test connection checks whether the account can write. If it can, the app shows Account can write: blocked and refuses to save the data source.
SQL you write in Explore is checked first: one statement, SELECT only, allowed functions only, no comments.
Uploaded files are checked before they are read. Files with macros, encryption or a suspicious archive structure are refused.
Exported Excel and CSV files are made safe: a cell that starts like a formula is not run as a formula.

The Gateway Agent reads databases inside your network for Fresco BI.

The agent only calls out to the Fresco BI relay on port 443. You open no inbound port.
The agent connects only to the networks, ports and source types in its allow list (policy.toml). You own this file. Fresco BI cannot change it.
Data source passwords are sealed for the gateway and opened only on the agent machine.
An enrollment token works once and for 1 hour. You approve a new member only after you compare its fingerprint.
The agent writes each task to its own audit.log, without data or passwords.

See Gateway Agent for details.

Passwords need at least 12 characters and cannot contain your e-mail or user name.
Repeated failed sign-ins are slowed down to stop password guessing.
You can turn on two-step verification with an authenticator app or a passkey, and keep recovery codes. See Account security.
An organization admin can require two-step verification for admins or for everyone, and choose which sign-in methods are allowed. See Authentication.
A session ends after 30 minutes without activity and after 12 hours at most.
Account › Security lists your signed-in devices. You can sign out all other devices at once.
Sensitive actions, such as adding or deleting a gateway, ask you to confirm with your two-step code or to sign in again.
Company SSO (OpenID Connect or SAML 2.0) is on the Enterprise plan and is coming soon.

A report is visible only to people with a role in its workspace or a share. Viewers can only get Read.
Row-level security limits the rows each viewer sees. A report with row-level security cannot be published to the web.
Public website (iframe) makes a report public to anyone with the link. An admin can turn Allow publish to web off; this stops every public link of the organization at once.
Secure embed (app token) keeps the report private. The app token stays on your server. Your page gets a short-lived embed token that never goes in a URL.

Organization admins can see the Activity log in the organization settings. It records who did what and when, for example:

data sources created, changed, tested or deleted;
Data Tables created, renamed or deleted, refreshes requested, and schedule changes;
data models and reports saved, published or deleted;
items shared or unshared, and changes to security role members;
invites revoked; members removed, restored or given another role; members who leave; ownership transfers;
each time a data source credential is decrypted.

The log records ids and event types, not the values of your data. See Audit log.

Deleted items go to the Trash and stay there for 30 days. After that they are deleted for good. See Trash.
When an organization is deleted, its members lose access at once. The Owner can restore it within 30 days. After that all its data is deleted for good.