What FutrixData Does Not Protect Against — Threat Model and Limits

Local-only audit, not external immutable storage

The agent audit log is local and hash-chained. The CLI verifier detects modified, deleted, inserted, or reordered rows inside the chained section. It does not detect a full local log rewrite where an attacker with host control rewrites every row and recomputes every hash. It also cannot prove that a truncated tail ever existed without an external anchor.

For environments that need stronger guarantees, mirror agent-tool events to a separate append-only store you control (for example, a Postgres instance with WAL archiving, an object store with object lock, or a write-only sink in another network). Local verification is meant to give you a quick, offline integrity signal — not to substitute for external immutable storage.

Deterministic masking is not anonymization

Result masking is a stable secret-backed HMAC, not an anonymizer. The algorithm is HMAC-SHA256: an HMAC key is derived per (data source, field) from a local secret, and the output format is masked:v1: followed by the first 16 hex characters of the HMAC — so the same raw value in a different field or a different data source produces a different hash. The substitution makes a sensitive value pseudonymous: callers see consistent hashes across calls without seeing raw values, but the mapping is deterministic by design. Anyone with access to the local masking secret can recompute hashes from known inputs; an attacker with control of the local host can do the same. Low-cardinality input spaces (booleans, gender, age in years, small enums) remain vulnerable to enumeration: anyone who can submit known inputs through the gateway — or who holds the local secret — can build a lookup table that effectively reverses such fields.

Deterministic masking is the right tool for keeping PII out of LLM prompts and agent contexts while preserving join keys for analysts. It is the wrong tool for releasing a dataset publicly — that requires k-anonymity, differential privacy, or full tokenization with an external secret manager.

Console is the authorized-human raw-data path, by design

The desktop Console returns raw rows to the engineer at the keyboard. Result masking is intentionally not applied here — the Console exists to inspect real data. If you do not want raw values to reach a given user, the right control is access to the data source itself (per-data-source ACL, per-environment credentials), not Console-side masking.

The agent result path (MCP, Skill, agent CLI) is masked separately. The two paths share the same risk engine and the same audit log, but masking diverges on purpose.

Schema metadata is a separate path from result rows

AI Chat, schema-knowledge browsing, and ER assistance can include schema metadata in prompts to the configured LLM provider. Result masking does not automatically cover schema metadata. If the schema itself is sensitive — KYC table names, regulatory column names, internal product codes — disable schema-to-LLM transmission for that data source. Each transmission is recorded; review the record before assuming a data source is "AI-safe".

Your AI provider has its own data policies

Bring-your-own-LLM means FutrixData does not see your prompts or completions, but it also means the provider you configured (Anthropic, OpenAI, Google, Azure, Ollama, etc.) has its own data-retention, training-eligibility, and regional-routing policies. FutrixData masks PII on the agent result path before the row leaves the gateway; what your LLM provider does with the resulting prompt is governed by the contract you have with them, not by FutrixData.

External MCP clients and external agents you build against FutrixData also have their own data-handling policies. The gateway can prove what was returned to a caller; it cannot enforce what the caller does next.

Not a certification, not a SIEM, not full IAM, not DLP

FutrixData is a database gateway. It is not, and does not replace:

• SOC 2 / ISO 27001 / HIPAA / PCI certification. The gateway produces evidence those programs typically ask for, but the certification is owned by your organization, not by FutrixData.
• An external SIEM. The audit log is local and verifiable; there is no built-in export to a SIEM today. If you need real-time SIEM ingestion, you'll add it in front of (or alongside) FutrixData.
• A full IAM stack. Per-agent identities, access keys, and revocation are first-class on the agent path. Team RBAC with roles, permissions, environment scopes, and schema scopes is an Enterprise-edition feature; on the free desktop, agent-level identity and audit attribution is the granularity you get.
• Database-side access control. The gateway is enforcement; the database itself still owns its grants and roles. If a database principal can drop a table directly, FutrixData cannot stop that bypass — sit the gateway in front, and remove direct credentials from the humans and agents who should not have them.
• A DLP product. Result masking covers structured fields the sensitivity classifier knows about. Free-text columns, blob columns, and adversarially crafted queries that cast values around the classifier are out of scope. If you have a hard data-loss requirement, layer a DLP product behind the gateway.

Things the marketing copy avoids claiming

So the marketing copy and this page stay consistent, here are claims we explicitly do not make:

• "Tamper-proof" or "immutable" — we say locally hash-chained, with a verify CLI and document the local-only scope.
• "Anonymized" — we say secret-backed deterministic masking on the agent egress path.
• "PII never reaches an LLM" — we say sensitive result values are masked before they are returned to MCP, Skill, or CLI callers. Schema metadata, free-text columns, and the Console path are separate.
• "SIEM export" — until the export path ships, the audit log is reviewed and verified locally with the CLI.
• "SOC 2 / ISO 27001 ready" — we say the gateway produces evidence those programs ask for; the certification itself is your responsibility.

If you find marketing copy elsewhere on the site that conflicts with this page, treat this page as authoritative and report it to hi@futrixdata.com.