Security & data handling
Your event data never leaves your warehouse.
suky is built around one invariant: we compute quality in your Snowflake and never ingest your events. Zero ingestion is the architecture, not a setting, and it's enforced in CI.
Zero ingestion
suky has no endpoints that accept event payloads. Every quality metric (freshness, volume, null rates, schema compliance, SLA status) is computed by read-only SQL inside your Snowflake. A CI gate blocks any write or DDL keyword from the warehouse code paths, so the invariant can't regress.
Read-only, least-privilege access
You connect a dedicated service account with key-pair (RSA) authentication and the minimum grants: USAGE on the warehouse, database, and schema, and SELECT on your event tables. suky can read; it cannot write, drop, or alter anything.
What suky stores
Computed results: counts, rates, per-event health status, violation records, plus a small sample of values used for discovery. Your raw event stream is never transmitted or stored. Credentials are encrypted at rest.
Your agents read verified data
The same guarantees protect the event tables your analytics and AI agents query. suky checks that those tables still match their contracts, so an agent doesn't answer confidently from a table that silently drifted.
What happens when a contract breaks
suky alerts, and it blocks changes. It never quarantines events. Quarantine means holding someone's data in a buffer until a human releases it, and suky never receives the data. Three things happen instead, in three different places.
- In your pull request. The CI check reads the tracking changes in the diff and classifies each one as breaking, additive or cosmetic. A breaking change fails the check, so the pull request cannot merge. That is the only thing suky blocks.
- At your CDP, on ingestion. suky publishes the contract to Segment Protocols, RudderStack, Snowplow Iglu or mParticle. Whether a violating event is then dropped, quarantined or let through is that system's decision, taken on that system's copy of the data.
- In your warehouse, after the fact. Scheduled read-only SQL compares what actually landed against the contract, opens a violation, and sends it to Slack or email. suky can draft the pull request that fixes the instrumentation; you merge it.
None of that requires suky to hold one of your events.
Subprocessors
The third parties suky relies on to run the service. A Data Processing Agreement is available on request at [email protected].
| Supabase | Database, authentication, edge functions |
| Vercel | Website and app hosting |
| Anthropic | AI processing of schema and chat content |
| Stripe | Subscription billing |
| Resend | Transactional email (invites, digests, access requests) |
| Slack | Alerts to workspaces you connect, and access-request notifications to ours |
| Voyage AI | Embeddings for search over schema and knowledge content |
| Intercom | Support messaging |
| Twilio Segment | Product analytics |
| LaunchDarkly | Feature flags and AI configuration |
| iubenda | Cookie consent and policy hosting |
Reporting a vulnerability
Found a security issue? Email [email protected] and we'll get back to you quickly. Please give us a reasonable window to fix it before public disclosure.