Security Posture: 100% Local

Secure by Design. Zero Telemetry.

TableAI is engineered for professional data environments. With a strictly zero-middleman architecture, your credentials and database connections remain 100% local, with all AI traffic routed directly to your chosen provider.

Zero Tracking SDKs

No analytics trackers, behavior monitors, or advertising components.

Zero Middlemen

Direct SQL connections. No cloud proxy, SaaS relay, or traffic interception.

Hardware Encryption

Passwords and API keys are secured natively via the macOS Keychain enclave.

Active Guardrails

Destructive operations require explicit confirmation. Safe Mode shields read-only data.

Strict Data Isolation

What data actually goes to the LLM?

TableAI enforces strict boundaries. Your database credentials and raw connection details never leave your local machine, and database records are only transmitted directly based on the mode you choose.

Schema-Only

Chat & Ask AI

Used for SQL generation, explaining queries, and schema exploration. Standard chat inputs never access actual table rows.

Transmitted Context

Structural schema metadata (table & column names, types, constraints, estimated row counts) and your chat prompts.

Never Transmitted

Your database credentials, query history, and all actual table records/row contents.

Autonomous Querying

AI Database Agent

Used for complex analytical goals. The agent queries databases and analyzes results to compile reports.

Transmitted Context

Structural schema metadata, plus subsets of actual table data (specific query results, counts, and samples)

Never Transmitted

Your database credentials, and any data rows/tables not explicitly queried or required by the agent's analytical steps.

100% Local Enclave

Keychain & Credentials

Secures your connection settings, passwords, SSH keys, and custom LLM API keys on-device.

Local Security Storage

Credentials remain isolated inside the native macOS Keychain. Decryption keys never touch standard defaults.

Never Transmitted

Database credentials, SSH private keys/passphrases, and custom API keys are never transmitted to the LLM or any third party.

Direct Pipeline & Storage

Bring Your Own API Key.
Zero Proxies.

Connect directly from your Mac to the model provider over TLS. Unlike traditional database assistants that route your queries through proprietary SaaS gateways, TableAI does not intermediate your traffic.

Direct connection without TableAI proxies
Keys stored strictly in macOS Keychain
Local offline support (Ollama)
No API keys synced to iCloud
Your Mac Local Env
TLS 1.3
Provider LLM API
End-to-End Security Zero Proxies • Encrypted
Any Database. Securely.

Localhost, VPN, and Cloud Connections

Secure Transport Layer

Connect to databases across local networks, corporate VPNs, or public clouds with built-in SSL support. Data is encrypted in transit using production-grade mechanisms:

  • SSL/TLS Modes: Support for Prefer, Require, Verify CA, and Verify Full modes.
  • Custom Trust Stores: Import custom CA certificates for self-signed infrastructure.
  • Mutual Authentication: Full support for client-side certificate validation (mTLS).

Native SSH Tunneling

Establish secure tunnels through bastion hosts without external shell dependencies or full TCP port forwarding:

  • Native Implementation: Utilizes Swift-native libraries; no external `ssh` process spawning.
  • In-Memory Decryption: Private keys remain encrypted on disk and are decrypted solely in volatile memory.
  • Remote SQLite over SSH: Connect to remote servers and query SQLite files directly over the tunnel.
Security Briefing

FAQs for Dev Teams & CTOs

It depends on the mode. In Chat mode and for the Ask AI feature, TableAI never sends your database rows; it only sends structural schema metadata to generate SQL. However, if you use the AI Database Agent to perform multi-step analysis, the agent may run queries locally and send relevant data subsets directly to your chosen LLM provider to compile reports. All connections are made directly using your own API keys, with no middleman server.

Passwords, SSH credentials, and LLM API keys are stored exclusively in the macOS Keychain. Sensitive driver-specific configuration values are isolated per connection. You can also configure TableAI to prompt for passwords "every time", keeping them in memory only without persisting them anywhere.

None. TableAI has a zero-middleman architecture. The application connects directly from your Mac to your database, and your Mac communicates directly with your chosen LLM provider (OpenAI, Anthropic, etc.). There is no TableAI proxy relaying or inspecting your traffic. Furthermore, TableAI contains zero telemetry or product analytics tracking.

No. TableAI uses iCloud to synchronize non-sensitive metadata (such as database hostnames, environment tags, and workspace layouts). However, hardware Keychain keys containing passwords and private keys are deliberately excluded and never synchronized to iCloud. You must securely enter your passwords individually on each Mac device.

Yes. TableAI allows you to provide a custom base URL for OpenRouter/OpenAI-compatible endpoints. This means you can point TableAI to a local instance of Ollama, Llama.cpp, or vLLM running on your local network, achieving a completely offline, air-gapped natural language to SQL workflow.