AES-256-GCM encryption at rest
LiveEvery API key and database credential is encrypted before it touches disk. The encryption key lives in env, never in the database. Key rotation runbook documented for compliance reviews.
For IT
Finally, see what your business is asking for.
Every Excel uploaded. Every AI prompt. Every dashboard. Every cost. In one place. Encrypted, auditable, governed by you. The full picture of what governance + observability look like in zenital selfBI today.
What IT sees
A real feedback loop, finally.
Every Excel upload, every AI call, every dashboard. Filter by team, user, period. Spot the columns your warehouse should have, straight from how people actually work. Live in /admin today.
- Org-scoped data sources, connect once, choose which workspaces see it
- Cost observability, by workspace, user, model, period
- Excel surveillance, every upload logged with columns and topics
- Wizard observability, every prompt, every "AI is wrong" flag
- AI key policy, one company key, per workspace, or BYOKComing soon
- AES-256-GCM encryption at rest for keys and credentials
zenital selfBI · /adminThis week · 12 users
AI spend
€128.10
↑ 12% vs last week
AI calls
2,847
↑ 18%
Dashboards
47
38 active
Files uploaded
23
3 with new columns
AI spend, last 7 days
Recent Excel uploads
- Q2_sales_export.csvSales
- churn_score_weekly.xlsxnew columnRetention
- invoices_jan_apr.csvFinance
- team_workload.csvOps
Prompts that failed this week, gaps in the warehouse
- “Show me cancellation reasons by week”column
cancellation_reasonnot in any model - “Compare churn vs retention this quarter”column
churn_statusnot in any model - “NPS score by region”column
nps_responsenot in any model
Excel observability
See what your business is asking for, even when nobody asks IT.
Every Excel uploaded is logged with its columns, who uploaded it, and which topics it covers. When three teams upload files with a column called `customer_health_score`, you know what to add to the warehouse next sprint. Live in /admin/files today.
Excel uploads, this week
23 files · 3 with columns not in your warehouse
AllFinanceSalesOps
| File | Uploaded by | Size | Topics | Signal |
|---|---|---|---|---|
Q2_sales_export.csv | maria.gomez | 12 cols · 8.4k rows | — | |
churn_score_weekly.xlsx | david.ruiz | 7 cols · 2.1k rows | +2 new cols | |
NPS_responses_apr.csv | lucia.fdz | 9 cols · 1.3k rows | +1 new col | |
invoices_jan_apr.csv | lucia.fdz | 18 cols · 14k rows | — | |
team_workload.csv | pablo.lara | 5 cols · 340 rows | — |
Connect anything
Five live database connectors. Plus CSV and Excel.
Test, introspect, and connect any production database in under a minute. Cryptic columns get AI-suggested aliases automatically. Credentials are AES-256-GCM encrypted before they touch disk.
Pg
PostgreSQL
Live database connection
My
MySQL
Live database connection
Ms
MSSQL
Live database connection
Bq
BigQuery
Live database connection
Rs
NewRedshift
Live database connection
Sn
Coming soonSnowflake
Live database connection
CSV
CSV / Excel
File upload (Parquet behind the scenes)
Every database connection is tested before save · Credentials are AES-256-GCM encrypted at rest · Introspection auto-suggests aliases for cryptic columns.
Govern everything
One connection. Many workspaces. You decide who sees what.
IT connects a data source once at the organization level. Then a visibility matrix says which workspaces (Finance, Sales, Operations…) can use it. The Cube query layer enforces the matrix server-side, no one can query a source they aren't enabled for, even by guessing the cube name.
zenital selfBI · /admin/data-sources
enabled blocked
| Data source | Type | Tables | Finance | Sales | Operations | Marketing | Customer Support |
|---|---|---|---|---|---|---|---|
CRM (production) | PostgreSQL | 47 | |||||
ERP, billing | MSSQL | 28 | |||||
Warehouse, sales | BigQuery | 14 | |||||
Field operations | PostgreSQL | 22 | |||||
Analytics, Redshift | Redshift | 18 |
IT connects each source once at the organization level, then flips toggles per workspace. Cube queries enforce the matrix server-side, a workspace can’t query a source it isn’t enabled for, even if it knows the cube name.
Security & governance
Built for IT departments that audit before they sign.
Per-org row-level security
LiveCube enforces workspace_id filtering on every query through queryRewrite. A user from workspace A literally cannot query data from workspace B, even if they know the cube name.
Privacy modes
LiveOrg admin picks: full telemetry (default, log every prompt, file, dashboard) or metadata-only (cost and usage stay, prompt content stripped). Every employee knows what is logged.
Audit-ready event log
LiveA unified events table captures every AI call, file upload, dashboard action, and admin change. Queryable from /admin. Five indexes for sub-second range queries.
BYOK, three modes
Coming soonChoose one company-wide key, per-workspace keys, or each user brings their own. Matches how the company actually buys AI. UI surfaces only the relevant config based on org mode.
SOC 2 path
RoadmapOn roadmap for the first regulated enterprise client. Until then: encryption + RLS + audit log cover the substance of what SOC 2 asks for, just not the audit certificate itself.
Under the hood
Anatomy of a question.
No raw SQL ever touches the LLM. Every chart goes through a validated semantic layer that prevents hallucinations.
01 · Your prompt
Plain English. No SQL.
02 · Schema + glossary
Your aliases. Your KPI definitions.
03 · Cube JSON
Validated structure. Never SQL from the LLM.
04 · SQL (compiled, not generated)
Cube.js compiles, applies RLS, runs the query.
05 · Chart
4 seconds from prompt to render.
The LLM never writes SQL. It emits structured JSON that the semantic layer validates and compiles.
What's next
Want to see the manager view too?
The other half of zenital selfBI is the wizard managers use every day. Charts in plain English, no SQL, no IT ticket. Same data layer. Same governance you control.
or write to the contact form