SQLOrganization boundaries
Accounts, instance administration and saved work are scoped by organization and user permissions. Client admins do not have access to platform-only billing or AI settings.
Know what goes where.
Separate app accounts, organization permissions and Oracle access, with clear controls over saved credentials and optional AI.
App account protection
The app supports security keys, authenticator codes and recovery codes. Web and desktop sessions are separate; a newer login on the same client type may replace its prior session. Web idle sign-out is ten minutes. Desktop offers a 30-second warning and five-minute extensions before idle sign-out.
Oracle credential lifetime
Customer Oracle queries and results stay on the registered computer. Desktop users can optionally save both Oracle username and password with operating-system encryption. The retained super-admin web connector holds Oracle credentials temporarily in backend memory, not our database.
AI request scope
Result rows are excluded from AI requests. Submitted prompts and SQL are sent to the selected OpenAI model; SQL may itself contain sensitive literal text, so review it before sending.
Personal AI controls
An organization administrator can block AI, grant shared AI or allow a personal key. Saved API keys are encrypted. Desktop refreshes permissions at startup and daily validation; a newly validated AI block cannot be bypassed with an old personal key. An already-authorized offline device can retain signed permissions only until its fixed deadline.
Retention & visibility
Saved SQL is retained until deleted. Automatic query history keeps the last month of activity or at least the latest ten queries. Audit logs are restricted to administrators and records older than 90 days are removed by scheduled cleanup.
REGISTERED DESKTOP ACCESS
One computer. A clear authorization deadline.
First sign-in registers one computer per user. SQL Hop checks authorization at startup and every 24 hours while open. If the account server is unavailable, previously authorized local work can continue only until the earlier of 48 hours from the last successful validation or the known subscription/trial expiry. Restarting does not extend this time.
An explicit blocked, revoked or expired response stops new queries and exports while keeping existing SQL and results. Replacement computers use an identity-verified transfer in Account security; old offline authorization can remain valid until its existing deadline.
Read about device authorization →YOUR NEXT STEP
Create an account ↗Make room for better queries.
Start an organization trial, download Desktop, or sign in to manage your account.