Security
Built for enterprise data that has to stay under your control.
Encryption at rest
Every database is encrypted with SQLCipher (AES-256), and uploaded files are sealed with authenticated AES-256-GCM so tampering is detected. The application refuses to start without valid keys.
Your environment
Wombat runs as a single self-hosted service that can be deployed inside your own environment and pointed at your own model endpoint. Your data is not used to train public models.
Access controls
Protected API requests require an authenticated session, and identity is taken from that verified session. Role-based permissions, single sign-on through your OIDC identity provider, and lockout after repeated failed sign-ins.
AI guardrails
AI-generated queries are read-only: a single SELECT statement, restricted to approved tables, on a separate read-only connection. Sensitive fields can be detected and redacted before they reach a query or a model.
Audit trail
AI review workflows record model calls, confidence, evidence, and reviewer actions. Changes to org structure, expenses, business rules, and SAP publications are recorded too.
Tenant isolation
Data is scoped to your organization. Integration and SAP records are bound to your tenant on every read and write, and connector credentials are encrypted at rest.