Yes, your data stays encrypted, your access is revocable at any time, and AI tools only ever get read access to what you've explicitly connected — nothing more. You choose exactly which sources and which items within them are shared, and you can disconnect any of it the moment you want to.
The same is true of the people you share a workspace with. Nobody sees anything you haven't given them: you decide, per person, which sources, tables, and columns their AI can read, anything ungranted stays invisible rather than merely refused, every query anyone makes is logged, and removing someone ends their access within one request.
MCP has grown quickly since its release, and that growth has come with real security incidents across the broader ecosystem — servers left exposed to the open internet, vulnerabilities in specific implementations, and integrations granted far more access than the task in front of them required. That's why Synquil is built the way it is below, and why it's worth checking any MCP server you connect to against the same standard, not just Synquil's.
OAuth 2.1 with PKCE
Every data source is connected through that provider's own standard OAuth 2.1 flow with PKCE. Your password or API key for that tool is never shared with Synquil — only a scoped, revocable access token.
Per-customer schema isolation
Your synced data lives in its own isolated Postgres schema, not a shared table distinguished by a customer ID column. A query bug affecting one customer's schema has no path to another's.
Encryption at rest
OAuth tokens and synced data are encrypted at rest. Credentials are never exposed in logs, error reports, or API responses.
Default-deny access, per person
Access is granted, never assumed. Each person in a workspace holds one or more roles, and a role names the sources, tables, and columns they may read — anything not granted is denied, including its existence. The check runs server-side when the query arrives, not in the AI tool and not in a prompt, so it cannot be talked around: the schema shown to the model is already the caller's subset, and the generated SQL is parsed and verified against that same subset before it executes.
Append-only audit log
Every query through the MCP server is recorded: the person, the AI tool, the tables touched, the number of rows returned, and whether it succeeded or was blocked. The log is append-only and is written regardless of outcome, so a refused attempt to reach ungranted data leaves the same trail as a successful question.
Read-only, validated queries
Every query an AI tool sends through the MCP server is parsed and validated as read-only before it runs. There is no code path from an AI tool to a write, an update, or a delete — the query layer checks the query's structure, not just the text the model generated.