Wren AI security

One governed path for your people and your AI agents.

Identity, context-layer policy, row and column controls, and audit logs sit in front of every query. Same path for people, apps, and MCP agents.

Talk to our security team Read security docs

Policy point: Context layer
Every caller: UI, API, MCP
Deployment: Cloud to air-gap

Live policy gate

Request path

Identity-aware

RLS and CLS

Audited

Mechanisms

Security claims you can trace through the product.

Security architecture

The control plane runs before the query.

Every prompt resolves through identity, context-layer definitions, row and column rules, and SQL validation before a result reaches anyone.

OIDC + workspace roles
MDL context layer
RLS + CLS at query time
SQL + answer lineage logged

Inside the policy check

How a prompt becomes governed SQL

Live trace

Prompt

“Show Q4 revenue by region”

analyst@acme.comrole: analystregion: EMEAfrom OIDC, not the prompt

Wren control plane

before execution

RLSregion = 'EMEA' from session
CLSsalary, email masked
MDLrevenue as approved metric
SQL guardread-only, bound params

Governed SQL

logged and inspectable

SELECT region, SUM(net_revenue) AS revenue

FROM mdl.orders-- approved model

WHERE region = 'EMEA'-- RLS, not the prompt

AND order_date >= '2025-10-01'

GROUP BY region

4checks per query

0prompt-supplied filters

100%SQL inspectable

Agent governance

Agents get the same door as everyone else.

When Claude or Cursor calls Wren as a sub-agent over MCP, it resolves through the same path as Slack, Teams, embedded apps, and API callers: one governed MCP and API boundary. There is no side door to the warehouse.

One MCP + API boundary
Skills and memory grounded in the context layer
Project access inherited per request
Generated SQL stays inspectable

Agent governance

One door for every caller

No side doors

5caller types

1governed door

0direct connections

Data residency

Run it inside the boundary you trust.

Managed cloud, private cloud, self-hosted, or fully air-gapped. Wren AI connects to data where it already lives; nothing migrates into a new silo.

20+ sources, queried in place
GCP us-east-4 by default, other regions on request
Bring your own LLM
Project isolation per tenant
Audit logs: who asked what

Your security boundary

Run Wren AI where your data lives

One governance model

Fastest startTightest boundary

Managed

Wren AI Cloud

GCP us-east-4, other regions on request

Fastest startSOC 2

Your VPC

Private cloud

Your network rules, your keys

PeeringYour IAM

Your infra

Self-hosted

Kubernetes or standalone, on-prem

BYO LLMFull control

Offline

Air-gapped

No external egress at all

Local modelsNo telemetry

Same identity, context layer, RLS/CLS and audit in every mode

4deployment modes

20+sources, in place

1governance model

Control surface

Built for the review your data team actually runs.

Identity and access

OIDC login, workspace and project roles.

OIDCRolesProjects

Row and column controls

Filtered in the query path, before results reach anyone.

RLSCLSQuery-time

Context-layer guardrails

Approved metrics and joins, defined once in MDL.

MDLMetricsJoins

Auditability

Who asked what, and which SQL ran.

Activity logSQLLineage

Deployment control

Cloud, private cloud, self-hosted, or air-gapped.

CloudVPCAir-gap

Agent-safe APIs

One governed context for UI, API, and MCP clients.

MCPAPIEmbedded

Security walkthrough

Bring your data agent to security review.

Walk your security, platform, and data teams through the governed execution path.

Request a security walkthrough Request a demo