ReefLink
Sign In Request a Demo

Security

Intelligence without compromising control.

Every request — from an analyst, a dashboard or the AI — passes through the same identity, policy and audit path before it touches data. Permissions are enforced by the platform, not by convention.

Talk to an Expert View controls

Governed results

Same query. Different identity. Different result.

Switch between users to see resource, column, masking and row-filter policies change the result of one unchanged query.

Query / crm.subscribersPolicies applied

Run as

SELECT msisdn, region, monthly_revenue, cell_id
FROM crm.subscribers LIMIT 4
msisdnregionmonthly_revenuecell_id

Illustrative data. Policies are defined in Apache Ranger and enforced by the query engine at execution time.

Controls

Four layers of data access control.

  1. 01

    Role-based access

    Who can reach which catalog, schema, table and column.

    • Resource policies at catalog, schema, table and column level
    • Role hierarchy that mirrors your directory
    • Allow and deny with explicit precedence
    • Policies managed through a REST API
  2. 02

    Column-level access

    Unauthorized columns never reach the user.

    • Per-column permissions by user, group or role
    • SELECT * returns only permitted columns
    • Denied columns removed before execution
  3. 03

    Dynamic masking

    Sensitive values are transformed at query time, per user.

    • Partial masking — ****-****-1234
    • Nullify, SHA-256 hash, date truncation
    • Custom SQL masking expressions
    • Tag-based: PII, FINANCE, SENSITIVE
  4. 04

    Row-level filtering

    Users see only the rows they are entitled to.

    • Filters injected as WHERE clauses automatically
    • Directory attributes (department, region) as conditions
    • Multi-tenant partitioning within shared tables
    • Regional data isolation

Architecture

Security properties of the platform.

Identity

Your directory, your SSO

Users and groups sync from LDAP or Active Directory. Authentication uses your identity provider; ReefLink does not keep a separate user store for your staff.

Encryption

TLS throughout

Client, service and source connections use TLS with your enterprise CA. Data at rest remains under your existing storage encryption.

Secrets

No credentials in config

Source credentials are injected through a protected secrets mechanism, use read-only service accounts, and are never shown to the AI model.

AI

Permission-aware AI

The model is only given metadata the user may see. Generated SQL is read-only, validated and executed as the user.

Audit

Every query recorded

Identity, statement, policies applied and result metadata for every query, with a searchable audit browser.

Deployment

Inside your boundary

Runs in your data centre or private cloud. Your data is queried in place and does not leave your environment.

Security review

We do not list certifications on this site. For security questionnaires, architecture documentation or a technical review with your security team, contact connect@reeflink.ai.

Turn your data into intelligence.

See ReefLink run against your own sources — federated queries, governed access, and AI analysis that shows its evidence — inside your environment.

Request a Demo Talk to an Expert