---
title: "Security and Compliance | OWOX Data Marts"
canonical: "https://www.owox.com/security-and-compliance"
updated: "2026-11-03"
---

# Security and compliance

## Know what you approve

Your teams want to use OWOX Data Marts. You need to understand the access, data flows, safeguards, and compliance responsibilities before you approve it.

OWOX Data Marts connects your Data Storage to the tools your teams use. Your organization controls the connected resources, project members, credentials, and Data Destinations.

OWOX operates the Cloud service on Google Cloud and manages its infrastructure and application updates.

## Data handling and ownership

### Your warehouse and its history

Your warehouse remains the system of record. Connectors load records into your Data Storage, and Data Mart SQL runs against your tables there.

Your tables and their full history stay in your warehouse, under your account. Leaving OWOX leaves them in place. You can also [export your data model as OKF Markdown or JSON](https://docs.owox.com/docs/getting-started/setup-guide/models-canvas-export/).

Report execution can pass result batches through OWOX Data Marts to the Data Destination you select. Cloud keeps the configuration and service records needed to operate these connections.

The [Data Ownership page](/features/data-ownership) explains warehouse ownership, history, and model export.

### Data movement

Your team controls the connected Data Source, Data Storage, and Data Destination accounts. OWOX Data Marts Cloud runs the connectors and Report delivery.

![Separate connector and Report sequences show data passing through OWOX Data Marts Cloud between a Data Source, Data Storage, and Data Destination.](https://cdn.owox.com/www/static/security-and-compliance/body/1-a44bde.svg/public) [Open the data movement diagram at full size (SVG).](https://cdn.owox.com/www/static/security-and-compliance/body/1-a44bde.svg/public)

Read each sequence from top to bottom. Dashed arrows show responses.

### Processing and retained information

| Information | Processing or storage |
| --- | --- |
| Data Source records | Connector operations read selected sources and can load records into your configured Data Storage. |
| Query results and Reports | The application processes results and delivers Reports to configured Data Destinations. |
| Credentials and service metadata | Cloud stores credentials, configurations, run history, and run logs. |
| Operational logs | Cloud records application activity to operate and investigate the service. |
| AI feature content | Enabled AI features can process schema, context, samples, and generated output. Cloud records and logs can retain related content. |

Logs can contain SQL, request inputs, and results. These records support operation and investigation of the service.

### Retention of logs and service metadata

Cloud generally retains operational logs for 30 days. This period does not apply to service metadata, such as run history and run logs.

The [Privacy Policy](/policies/privacy) describes personal-data retention and applicable exceptions.

### Warehouse locations and Cloud hosting

Data Mart SQL runs in your Data Storage, in the locations configured for your warehouse. Your organization controls those warehouse settings.

OWOX hosts the Cloud application and its primary application databases in the EU. These hold the service’s configuration, credentials, and service metadata.

Connector execution, Report delivery, and enabled AI features follow the data flows described on this page.

Some service records and log copies also use US services. The [Privacy Policy](/policies/privacy) explains personal-data handling and international transfers.

## Customer access controls

### Permissions for connected services

Connection permissions depend on the Data Source, Data Storage, Data Destination, and operation.

Where supported, OAuth lets your team connect an account without giving OWOX its password or uploading a service account key. Your team authorizes access at the provider and can revoke that grant there.

The [OWOX Data Marts add-on](https://workspace.google.com/marketplace/app/owox_data_marts/94902851409) limits its spreadsheet access to files where it is installed.

The setup guides explain the requirements for [Google BigQuery](https://docs.owox.com/docs/storages/supported-storages/google-bigquery/), [Snowflake](https://docs.owox.com/docs/storages/supported-storages/snowflake/), [AWS Redshift](https://docs.owox.com/docs/storages/supported-storages/aws-redshift/), [AWS Athena](https://docs.owox.com/docs/storages/supported-storages/aws-athena/), and [Databricks](https://docs.owox.com/docs/storages/supported-storages/databricks/).

Dedicated service identities help your team control which resources OWOX Data Marts can reach.

### Roles, ownership, and Data Contexts

OWOX Data Marts has three project roles:

*   **Project Admin:** Manages members and has access across the project.
*   **Data Owner:** Builds and maintains data resources.
*   **Business User:** Uses shared Data Marts for reporting and manages their own Reports and Data Destinations.

Access to a resource combines the member’s role, ownership, sharing settings, and Data Context scope. A Data Context can group resources for a business area, such as Finance or Marketing.

For members whose scope includes selected Data Contexts, shared access requires a matching Data Context. Project Admins retain project-wide access. Ownership can also grant access independently of Data Context matching.

The [roles guide](https://docs.owox.com/docs/project/roles-and-permissions/), [ownership guide](https://docs.owox.com/docs/project/ownership-and-sharing/), and [Data Context guide](https://docs.owox.com/docs/project/contexts/) explain these controls.

### Corporate identity

Cloud supports Google and Microsoft account sign-in, alongside email and password. Your team can use its existing corporate Google Workspace or Microsoft accounts.

Your organization can require multi-factor authentication (MFA) through its corporate Google or Microsoft account policies. OWOX email-and-password sign-in does not provide MFA.

Project Admins can configure corporate-domain provisioning. New members can receive a default role and Data Context scope, or request project access.

The [member management guide](https://docs.owox.com/docs/project/members/#user-provisioning) explains these options.

### Credential management

Your team saves credentials for the services it connects. The credential management interface and credential API do not display or return saved secret values.

Cloud stores these credentials in its managed application database. HTTPS protects their transfer to the application, and TLS protects application connections to the database. Google Cloud encrypts the database content at rest.

Server-side services use the credentials to perform authorized operations.

Credential owners and Project Admins can manage ownership, sharing, and enabled status. Sharing lets eligible members use or maintain a credential under the project’s access rules.

The [credentials guide](https://docs.owox.com/docs/project/credentials/) explains ownership, sharing, replacement, and disabling.

### Stop or change access

Your team can use these controls when access requirements change:

1.  Stop the relevant scheduled work.
2.  Disable the credential in OWOX Data Marts.
3.  Remove project members who no longer need access.
4.  Change resource ownership or sharing where necessary.
5.  Revoke the access grant at the external provider when the connection is no longer required.

Disabling a credential and changing its sharing have different effects. Removing sharing can leave an existing Data Storage or Data Destination binding active. The [credentials guide](https://docs.owox.com/docs/project/credentials/) explains which control applies.

Stopping access is separate from personal-data erasure. Existing logs and service metadata follow their respective retention and request-handling rules.

## Choose how AI receives data

### Your AI assistants through MCP

Your organization selects and configures its AI assistants. OWOX Data Marts provides authenticated access through the Model Context Protocol (MCP).

An assistant can receive Data Mart descriptions, schema, and requested results through the available tools. Its AI provider’s processing and retention settings apply to information the assistant receives.

Your team controls the assistant’s configuration and the OWOX access used for the connection. The [MCP guide](https://docs.owox.com/docs/getting-started/setup-guide/mcp/) explains the connection.

![Your AI assistant requests data through OWOX Data Marts using MCP. OWOX Data Marts queries your Data Storage and returns the requested results.](https://cdn.owox.com/www/static/security-and-compliance/body/2-f82274.svg/public) [Open the MCP diagram at full size (SVG).](https://cdn.owox.com/www/static/security-and-compliance/body/2-f82274.svg/public)

### Built-in Cloud AI

#### Metadata generation

For metadata generation, Cloud uses OpenRouter, restricted to Google Cloud Vertex AI. OWOX sends these requests to OpenRouter with zero data retention enabled and data collection denied.

Enabled metadata features can send schema and context. They can also send sample rows when sampling is enabled.

These request settings apply to AI provider processing. OWOX separately keeps service metadata and operational logs, which can contain AI-related content.

![OWOX Data Marts Cloud sends metadata-generation requests through OpenRouter to Google Cloud Vertex AI. Generated output returns through OpenRouter.](https://cdn.owox.com/www/static/security-and-compliance/body/3-1d69f4.svg/public) [Open the metadata-generation diagram at full size (SVG).](https://cdn.owox.com/www/static/security-and-compliance/body/3-1d69f4.svg/public)

#### Search indexing and requests

Cloud search can send catalog information and search text to OpenRouter to help find relevant resources. Catalog indexing can run in the background.

Catalog information can include Data Mart names, descriptions, and output field names and descriptions. It can also include Data Storage, Data Destination, and Report names, plus connected-account or recipient email addresses.

### Your own AI provider credentials

Your team can add its own AI provider credentials to OWOX Data Marts for plugins that use AI. Your team selects the provider and manages its credentials and provider settings.

The [AI credential guide](https://docs.owox.com/docs/project/credentials/#ai-mappings) explains provider and model mappings.

## OWOX security controls

### OWOX staff access

OWOX staff access customer data only on customer request. We do not use customer data for tests or development.

Staff must use corporate accounts and two-factor authentication. Employees and contractors sign confidentiality agreements. OWOX records staff access cases in logs.

### Encryption and network protection

Customer connections to the application and MCP endpoints use HTTPS. Cloud database clients use TLS. Google’s [network encryption](https://docs.cloud.google.com/docs/security/encryption-in-transit) also protects the configured load-balancer-to-backend and private database paths.

Google Cloud provides [encryption at rest](https://docs.cloud.google.com/docs/security/encryption/default-encryption) for Cloud SQL data. Its external load balancers provide network-layer protection against distributed denial-of-service attacks.

### Development checks and monitoring

OWOX reviews code changes and runs automated checks for known vulnerabilities in the third-party software packages that OWOX Data Marts uses.

Cloud infrastructure records operational and access events.

### Backups and recovery

Cloud SQL uses daily backups. OWOX Data Marts Cloud’s recovery targets are a **24-hour recovery point objective** and a **72-hour recovery time objective**.

The recovery point objective sets the target for potential data loss. The recovery time objective sets the target for restoring service.

Your organization’s Data Storage and Data Destination recovery arrangements remain part of your own setup.

### Vulnerability disclosure program

OWOX runs a public [vulnerability disclosure program on HackerOne](https://hackerone.com/owox). The program gives independent researchers a defined route to report potential security issues.

## Security assessments

OWOX uses its [Cloud Application Security Assessment (CASA)](https://appdefensealliance.dev/casa) work to review security practices shared across OWOX Data Marts Cloud. These include database encryption at rest and secure database connections.

OWOX BigQuery Data Marts for Google Sheets completed a CASA Tier 2 assessment with TAC Security.

[![App Defense Alliance Tier 2 — CASA Verified program mark](https://cdn.owox.com/www/static/security-and-compliance/body/4-r2azph.png/public)](https://appdefensealliance.dev/casa)

## Official integrations and APIs

OWOX integrations are available through these provider directories:

*   **[ChatGPT](https://chatgpt.com/plugins/owox-data-marts):** The published OWOX Data Marts integration has passed OpenAI’s submission review.
*   **[Claude](https://claude.ai/directory/owox-data-marts):** The OWOX Data Marts connector is listed in Claude’s directory.
*   **[Google Sheets](https://workspace.google.com/marketplace/app/owox_data_marts/94902851409):** The OWOX Data Marts add-on for supported warehouses.
*   **[Google Sheets BigQuery extension](https://workspace.google.com/marketplace/app/owox_bigquery_data_marts/263000453832):** The separate OWOX BigQuery Data Marts add-on.
*   **[Excel](https://marketplace.microsoft.com/en-us/product/WA200011946):** The OWOX Data Marts add-in for Excel on the web, Windows, and Mac.
*   **[Data Studio](https://datastudio.google.com/datasources/create?connectorId=AKfycbz6kcYn3qGuG0jVNFjcDnkXvVDiz4hewKdAFjOm-_d4VkKVcBidPjqZO991AvGL3FtM4A):** The OWOX Data Marts connector. The [setup guide](https://docs.owox.com/docs/destinations/supported-destinations/data-studio/) explains authorization and configuration.

Review the requested permissions in the provider listing before installation.

The documented [OWOX API](https://docs.owox.com/docs/api/) and [MCP server](https://docs.owox.com/docs/getting-started/setup-guide/mcp/) provide supported interfaces for programmatic access. Their guides explain authentication and available operations.

## Compliance and GDPR

OWOX supports GDPR-related personal-data requests through account controls and published request routes.

Your organization decides which personal data to process and which access to approve. Our Privacy Policy explains OWOX’s controller and processor roles and the responsibilities that apply.

Use these references in your compliance review:

*   **[Privacy Policy](/policies/privacy):** Processing purposes, personal-data rights, retention, international transfers, and AI use.
*   **[Control Your Data](/policies/control-your-data):** Request routes and email and cookie choices.
*   **[Subprocessor list](/policies/control-your-data#owox-inc-subprocessors):** Providers, their purposes, and countries.
*   **[Terms of Service](/policies/terms-of-service):** The service agreement.

### Data Privacy Framework participation

[![Data Privacy Framework Program mark](https://cdn.owox.com/www/static/security-and-compliance/body/5-3xnq9v.png/public)](https://www.dataprivacyframework.gov/list)

OWOX, Inc. is an active participant in the EU-U.S. Data Privacy Framework, its UK Extension, and the Swiss-U.S. Data Privacy Framework.

The participation covers non-HR personal data. The [official participant register](https://www.dataprivacyframework.gov/list) shows the scope; search for OWOX, Inc.

### Personal-data controls in your account

OWOX Data Marts Cloud uses your shared OWOX platform account. In [profile settings](https://platform.owox.com/user-settings/profile), you can download your personal account information, request account erasure, or update your profile.

Use [notification settings](https://platform.owox.com/user-settings/notifications) to manage email preferences.

The account-erasure process anonymizes associated personal information. User IDs remain to preserve record relationships. The Privacy Policy describes request handling and applicable retention rules.

## Source transparency and deployment controls

### Open source and code transparency

OWOX publishes its open-source connectors under the [MIT License](https://docs.owox.com/licenses/mit/). The core platform’s source is available under [Elastic License 2.0](https://docs.owox.com/licenses/elasticv2/).

Your technical team can inspect that code to assess connector behavior and platform logic. The [edition terms](https://docs.owox.com/docs/editions/self-managed-editions/#terms-of-service) explain the license boundaries, including proprietary Enterprise features.

### Additional controls with self-managed hosting

Self-managed hosting lets your team choose the application environment, network restrictions, identity configuration, database, and logging settings.

Your team operates this deployment and manages its updates, access controls, encryption configuration, and backups. The [deployment guide](https://docs.owox.com/docs/getting-started/deployment-guide/environment-variables/) explains these options.

Your team also controls connections to external AI providers and Data Destinations. Licensed Report Runs use Cloud authorization and consumption reporting, as described in the [license guide](https://docs.owox.com/docs/getting-started/deployment-guide/license-key-setup/).

The [self-managed editions guide](https://docs.owox.com/docs/editions/self-managed-editions/) describes anonymous CLI usage analytics and its opt-out settings.

## Contact OWOX about security and data protection

Send security requirements or privacy questions to our **Data Protection Officer** at [data-protection@owox.com](mailto:data-protection@owox.com).

## Book a call

You are booked. The invitation is on its way to , with the calendar invite and the meeting link.

[Reschedule](#)

[Cancel](#)

## Schedule a meeting

## Schedule in person meeting at Data Outpost San Francisco

You are booked. The invitation is on its way to , with the calendar invite and the meeting link.

[Reschedule](#)

[Cancel](#)

## Links

Pages this page links to, on this site and on docs.owox.com. Where the page has a Markdown twin, its address follows the link.

- [export your data model as OKF Markdown or JSON](https://docs.owox.com/docs/getting-started/setup-guide/models-canvas-export)
- [Data Ownership page](https://www.owox.com/features/data-ownership) — /features/data-ownership.md
- [Privacy Policy](https://www.owox.com/policies/privacy) — /policies/privacy.md
- [Google BigQuery](https://docs.owox.com/docs/storages/supported-storages/google-bigquery)
- [Snowflake](https://docs.owox.com/docs/storages/supported-storages/snowflake)
- [AWS Redshift](https://docs.owox.com/docs/storages/supported-storages/aws-redshift)
- [AWS Athena](https://docs.owox.com/docs/storages/supported-storages/aws-athena)
- [Databricks](https://docs.owox.com/docs/storages/supported-storages/databricks)
- [roles guide](https://docs.owox.com/docs/project/roles-and-permissions)
- [ownership guide](https://docs.owox.com/docs/project/ownership-and-sharing)
- [Data Context guide](https://docs.owox.com/docs/project/contexts)
- [member management guide](https://docs.owox.com/docs/project/members)
- [credentials guide](https://docs.owox.com/docs/project/credentials)
- [MCP guide](https://docs.owox.com/docs/getting-started/setup-guide/mcp)
- [setup guide](https://docs.owox.com/docs/destinations/supported-destinations/data-studio)
- [OWOX API](https://docs.owox.com/docs/api)
- [Control Your Data](https://www.owox.com/policies/control-your-data) — /policies/control-your-data.md
- [Terms of Service](https://www.owox.com/policies/terms-of-service) — /policies/terms-of-service.md
- [MIT License](https://docs.owox.com/licenses/mit)
- [Elastic License 2.0](https://docs.owox.com/licenses/elasticv2)
- [edition terms](https://docs.owox.com/docs/editions/self-managed-editions)
- [deployment guide](https://docs.owox.com/docs/getting-started/deployment-guide/environment-variables)
- [license guide](https://docs.owox.com/docs/getting-started/deployment-guide/license-key-setup)