Read-only against your data
The assistant reads metadata and runs read-only queries. Tools that change data are refused to it whatever the settings say; only people run them.
Security & deployment
Self-hosted, governed, and signed.
A control plane, and an agent beside your databases, both on your own Linux host. What moves where, who sees what, and what the AI can do.
Where it runs
Every part, inside your network.
The agent dials out; nothing dials in. It needs only read-only accounts on your databases, Informatica Cloud and Airflow. The model runs on-prem, or at a provider under your key.
Your network
Postgres
SQL Server
Oracle
Terazu agentbeside your databases, on a read-only account
Terazu control planedefinitions, evidence, receipts, audit trail
Your modelon-prem, or a cloud provider under your key
Data flow
Exactly what moves, and where to.
Rows stay in your databases unless someone allowed to see them asks. This is everything that crosses to the control plane, and on to a model.
WhatWhat it containsWhere it goes
MetadataSchemas, keys, views, procedure and report definitions. Live from Informatica Cloud and Airflow: taskflows, mappings, DAGs, each task’s SQL, runs, and what an Informatica run’s log shows it read and loaded. Query history only where a person turned it on: statements and how often they ran. A person is never named; the service account that ran a load or copy job is.agent → control plane
Files you importBI model exports, SSIS packages and Cognos models a person uploads, read as text, never run. Connection-string user names and passwords aren’t kept.you → control plane
Column statisticsRow counts, nulls, distinct counts and ranges, worked out in the agent from a sample, 5,000 rows by default. The ten commonest values of low-cardinality columns, except values screened as personal data or credentials.agent → control plane
Join evidence across systemsHashed key sketches: the overlap between two systems is measured without either side sending a value.agent → control plane
Answers and checksComputed in your database; only the result returns, with its SQL. A check reads at most eight times per number, a share or ratio checks its parts too, and checking every number stays within a read budget. Every read is recorded.agent → control plane
Previews and probesOnly for someone allowed to see rows: a small sample or preview of a table, or a read-only probe, 200 rows unless it asks for more, never past 5,000. Every probe is recorded.agent → control plane
Everything elseRow-level data.stays in your databases
To a modelWith on-prem chat and embedding models, nothing. With cloud providers, under your keys: each question; the evidence a draft is written from, with rows only from a source that allows them; what the assistant reads in a chat; and text indexed for search. Values at Restricted or above, or flagged and undecided, never reach a model you haven’t marked local.control plane → model
Access control
Who can do what, the AI included.
Every person has one of five roles. The assistant acts as the person asking, with only the tools and sources your admins allow, so it never sees or does more.
What they can doOwnerAdminEditorViewerConsumerAI assistant
Ask for certified answerseach number with its receiptYesYesYesYesNoYes
Read definitions, evidence and the estate mapmetadata: names, SQL, lineage, ownersYesYesYesYesNoYes
See rows from your databasessamples, previews, profiling, probes, checksYesYesYesNoNoLimited
Draft and propose definitionsproposals wait for a personYesYesYesNoNoLimited
Certify a definitionpinned to the exact versionYesYesYesNoNoNever
Choose the model and the assistant’s toolsYesYesNoNoNoNever
Manage members and service accountsYesYesNoNoNoNever
Delete the workspaceYesNoNoNoNoNever
Viewers get a number only when their words match a certified question, or they accept an offer. Consumers see an answer’s definition, never a number.
Who you are comes from a sign-in or a key, never a header. A test tries every write route without one; all are refused.
- Audiences per definition
- Each certified definition can name which roles get answers from it. Anyone else is refused, and told an answer was withheld.
- People certify
- Service accounts and API keys are refused. The assistant can prepare the case but never sign it.
- Metadata only, whole workspace or source by source
- On such a source, the assistant and MCP tools see names, structure, SQL and definitions, never rows or values. A certified number reaches the person.
- A governed door for coding assistants
- Claude Code and Codex connect over MCP with their own keys. They get structure and counts, never a row or business figure, and change nothing.
- The assistant’s tools, per workspace
- The assistant holds every tool until an admin narrows the list. What it proposes waits for a person. Its reads and daily runs are capped.
- Query history, only where you turn it on
- Off until a person, never the assistant, turns it on. Terazu reads statements and run counts, never Oracle’s extra-cost packs. A person is never named; the service account that ran a load or copy job is.
- Limits no setting lifts
- Whatever a workspace allows, the assistant can’t write to your databases, certify, apply a correction, turn on query history, or change its own settings.
- Everything recorded
- Every tool the assistant calls, every refusal, and every probe lands in the audit trail, next to who asked.
Always on
Certified answerseach with its receipt
Definitions, SQL and lineagemetadata, no rows
A small sample on request5 rows by default, for people who may see rows, never from a metadata-only source
Your admins decide
Drafting definitionsproposals wait for a person
Table previews10 rows by default, at most 50
Profilingstatistics from a sample
Probesone read-only query, at most 200 rows, recorded
Checksmeasure a number where else it’s computed, at most 8 reads a number (a share or ratio checks its parts too), recorded
Metadata only: no rows or stored values reach a model
The whole workspaceevery source at once
HR systemSQL Server · the assistant sees names and structure; answers go to the person
WarehousePostgres · data allowed, within the tools above
Never, whatever the settings
Certify a definition
Write to your databases
Turn on query history
Change its own settings
Whatever is on, the assistant acts as the person asking, and never sees rows they couldn’t.
Added in October 2026
- Sign-in through your identity providerSign-in is on from the first start: single sign-on with your provider’s MFA, or an authenticator app. Your directory makes and ends accounts.
- An audit trail a security team can useHash-chained, so a changed or removed row shows. Exported or streamed to your SIEM, kept a year at least, previews and downloads included.
- Sensitive data classifiedNDMO’s four levels on tables, columns and Measures. Personal and health data and credentials are flagged inside your network, by fixed rules, never a model.
- Outside AI tools see shape, not contentID numbers, IBANs, cards, emails, mobiles and credentials are masked in anything an MCP client gets. Every outside call is on the record.
- Local models onlyInstall-wide lists of allowed model providers and hosts; any other call is refused. Non-root containers, security headers and HTTPS come in the bundle.
- Your data, on your termsExport or delete a workspace, with a record; erase a person; set how long chats are kept. The installer backs up and restores, checked.
Built in, not configured
Boundaries the product enforces.
These hold because of how the product is built, not because a prompt asks the model nicely.
Only a person certifies
One person’s signature certifies. A workspace can ask a second, different person to confirm; until then the record answers, marked “confirmation pending”.
Pinned definitions
Certification pins the exact content. A breaking change sends a definition back to draft before anyone sees a new number.
Every number says what it stands on
The engine computes each number from a definition, never the model. Certified ones name who signed; uncertified ones say so, for the data team only.
Write-only credentials
Connection secrets can be set or replaced but never read back, and they’re encrypted at rest with a key you supply.
Every decision audited
Who proposed, certified and confirmed, on which evidence. The trail behind every certified definition is one click away.
Supply chain
Verify it before you run it.
Signed images
Both images are signed with cosign, each release with a signed SBOM and a vulnerability scan. Verify them against our public key first.
No source, no secrets
The product ships as compiled modules, with no source code and no secrets in the images.
An offline license
The license is a signed token checked on your own host. Without a genuine one, the control plane doesn’t start.
Runs without internet
The license checks offline, and the install bundle needs no registry. Pair it with an on-prem model and nothing needs to leave.
Docker on Linux
Runs with Docker on a Linux host, on x86-64.
Start a pilot
Put it on your servers.
A pilot runs on your servers, read-only against your data, and can stay inside your network. Bring your security team; we’ll go through this page line by line.
Or write to the Terazu team.