Limited Availability
Sign up
ProductSecurityCompanyDocsSign inSign up
Security

Your data, your rules.

Each workspace's identities, data and settings are its own. Here is how Gnok protects them.
Identity

Strong sign‑in by default.

Sign-in is one page: workspace, email, password and a second factor. Your bookmark can fill in your workspace.
Account access guide →

  • Second factor

    Sign in with a password plus a passkey, an authenticator app, or a one-time recovery code. Administrators must use a second factor.

  • Passkeys

    Passkeys use your device to confirm it is you, and cannot be phished or reused on another site.

  • Protected sign-up

    New workspaces pass a browser check and verify their email, and during Limited Availability Gnok reviews each one before it is activated.

  • Lockout and throttling

    Repeated failed sign-ins are slowed and locked, and errors never say which credential was wrong.

Single sign-on

Use the identity provider you already have.

Connect Gnok to your identity provider so people join, change roles and leave in one place.
Authentication →

  • OIDC and SAML 2.0

    Sign in through your organization’s identity provider, optionally requiring Gnok’s second factor as well.

  • Enforced SSO

    Require single sign-on for everyone, with passkey-protected emergency access for named administrators.

  • SCIM provisioning

    Create, update and remove members from your identity provider, and map groups to application roles.

Access control

Least privilege, down to the row.

Sharing a worksheet never shares the data behind it: every query runs with the permissions of the person running it.
Roles and grants →

  • Roles and grants

    Grant privileges on catalogs, schemas and tables to roles, and roles to people and service accounts.

  • Row policies and masking

    Filter rows and mask columns by role, so one table can serve many audiences safely.

  • Application access

    Each person needs an entitlement to use Gnok Studio, separate from their data permissions.

  • Audit

    Sign-ins, grants and administrative changes are recorded for your administrators to review.

Data protection

Encrypted in transit and at rest.

Gnok runs the infrastructure; you control who can see what in your workspace.

  • In transit

    TLS on every public endpoint. Inside the platform, the query engine and the catalog authenticate each other with mutual TLS.

  • At rest

    Table data and files in Amazon S3, the catalog database, and its backups are encrypted at rest with keys managed in AWS.

  • Isolation

    Each workspace’s data, identities and settings are scoped to that workspace. Background work runs under an identity of your workspace, never a shared superuser.

  • Protected web front door

    Gnok Studio and sign-in sit behind a web application firewall, with a browser check on sign-up and password reset.

AI Governance

Language models stay off until you turn them on.

AI functions and ASK send selected text to a language-model provider (Anthropic). Each workspace decides whether and how that happens.
AI Governance →

  • Opt-in per workspace

    No language-model feature runs until the workspace has a token budget and an administrator enables a rollout policy. A trial workspace starts with a monthly budget that its administrators can adjust.

  • Policy you approve

    Choose the provider and model, the operations allowed, and approve data egress and retention.

  • Budgets

    Monthly token budgets cap spend, and every call is metered against them.

  • Embeddings

    EMBED(), which turns text into vectors for search, is on for every workspace within a monthly allowance. The text you embed is sent to OpenAI.

Report a security issue

If you believe you have found a vulnerability, email security@gnok.com with the details. Please don’t include another customer’s data, and give us a chance to fix it before you share it. Our disclosure policy explains what’s in scope and our safe harbor for good-faith research.