> ## Documentation Index
> Fetch the complete documentation index at: https://docs.delphina.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & Deployment

> How Delphina protects your data and where it runs

How Delphina protects your data, controls access, and where it runs.

## Data handling

* **Read-only access** — the agent cannot modify your warehouse data.
* **No persistent data storage** — query results are stored in S3 within your deployment. The control plane stores only metadata.
* **Credential security** — warehouse credentials are encrypted at rest, decrypted only when establishing a connection.
* **Workspace isolation** — each workspace uses its own credentials. See [Workspaces](/workspaces).

## Access controls

* **SSO authentication** — Google Workspace, Okta, or other SAML/OIDC providers. No separate passwords.
* **Role-based access** — Explorer, Developer, Admin per workspace. See [User Management](/administration/user-management).
* **Organization boundaries** — no cross-organization access.

## Compliance

* **SOC 2 Type II** — audited controls for security, availability, and confidentiality.
* **HIPAA** — available for customers with healthcare data requirements.
* **No model training** — your data is never used to train AI models.

## Deployment options

| Option                | Description                                                       |
| --------------------- | ----------------------------------------------------------------- |
| **Multi-tenant SaaS** | Shared infrastructure with logical isolation. Most organizations. |
| **Single-tenant**     | Dedicated AWS account + EKS cluster. Complete physical isolation. |
| **VPC deployment**    | Runs within your own AWS account. Data never leaves your network. |

Contact the Delphina team to discuss options.

## LLM usage

* Query context (schemas, metric definitions, results) is sent to the LLM to generate SQL and interpret results.
* No data is used for training — commercial API agreements prohibit it.
* Data is not persisted by LLM providers beyond the request lifetime.
* Available providers include Anthropic via AWS Bedrock.