How does iDBQuery store my database credentials?

Connection credentials are sensitive, so iDBQuery is designed to protect them and to minimise what they can do.

• Encrypted at rest - source credentials and connection secrets are stored encrypted, not as plain text, and protected by keys you can control in self-hosted deployments.
• Least privilege - connect with read-only or scoped accounts so the credentials iDBQuery holds cannot write, delete, or reach beyond what you intend.
• Stays in your environment - in a VPC or on-prem install, secrets never leave your infrastructure; in an air-gapped setup, nothing leaves at all.
• Private paths - reach databases over private networking, SSH tunnels, or behind your firewall, so credentials are used only across trusted routes.

For example, you can create a read-only database user scoped to the schemas iDBQuery should see, hand it those credentials, and know that even if a query is malformed it cannot modify your data. This layered approach - encrypted storage plus least-privilege accounts plus private network paths - means a single control is never the only thing standing between a secret and your data. It fits iDBQuery's broader model of query-in-place, RBAC, and encryption in transit and at rest, and it pairs with your own encryption key management. The result is that connecting a source does not hand over broad, plaintext keys to your systems. Contact us for guidance on least-privilege connections.