Credential handling
Zingle AI needs credentials to reach your data warehouse and your Git provider. This page describes how those credentials are stored and used.
Warehouse credentials
- Per user. Each user supplies their own credential for a warehouse connection. SQL runs as that user, so access follows your warehouse grants and actions are attributable to a person.
- Encrypted at rest. Credentials are encrypted at rest using Fernet symmetric encryption before being persisted.
- Supported secrets. A credential can be a warehouse password or a private key (for key-pair authentication).
Warehouse connections (account, provider, connection-level config) are created once by an administrator and shared across the organization; each user then attaches their own credential to that connection.
Git credentials
- Each user connects their personal Git identity (via OAuth), and the resulting token is stored encrypted at rest.
- Organizations also install a Git App (for example, the Zingle GitHub App) that grants repository access at the organization level.
- Because each user connects their own identity, commits and pull requests are attributed to the person who initiated them.
How credentials are used
- Warehouse credentials are decrypted in memory at query time to open a connection to your warehouse, and are not written to logs.
- Git tokens are used to clone repositories, push agent branches, and open pull requests.
Least privilege
You control the scope of what Zingle can do by scoping the warehouse role and Git access you grant. See the Production safety model for the recommended posture.