Security Architecture

Ingress and Network Security

• Secure ingress: Azure Front Door (CDN) and Application Gateway, orchestrated within a secured VNet
• DDoS and threat protection: full Layer 3, 4, and 7 protection
• Granular access control: traffic can be restricted to internal VNets or specific geographic locations
• Compute segregation: dedicated node pools separate real-time services (MCP, SQL generation, user APIs) from data pipelines (ingestion, model generation, benchmarking) — see Platform Architecture

LLM Choice

You can choose between OpenAI (via Azure AI Foundry) or Azure OpenAI models to operate Solid. Both options run through the Azure AI Foundry boundary — direct calls to non-Azure LLM endpoints are not the default architecture.

The Solid MCP Advantage

Three properties distinguish Solid's security posture for AI workloads:

1. The LLM never interacts with raw data. It receives only schema metadata, semantic model context, and query patterns. Raw production data never enters the LLM boundary.
2. Bounded data access for validation. Solid executes SQL against your warehouse only for validation purposes — never to produce user-facing results. During SQL generation, a correction loop checks that generated SQL runs cleanly. During benchmarking, both the generated and ground-truth SQL are executed and their result rows are compared transiently to compute an accuracy score; rows are not persisted and never reach the LLM or the UI. At runtime (MCP and Analyze), Solid generates SQL only — your agent or warehouse executes it with your own credentials, and result rows never enter Solid's system. See When Does Solid Execute SQL? for the full breakdown by mode.
3. Identity-aware execution. At runtime, SQL is executed on the data warehouse using the end-user's own mapped credentials — not a shared service account. Solid never runs queries with elevated permissions on behalf of users, so your existing warehouse governance policies are strictly enforced.

"Zero-Raw-Data" Architecture

Metadata-only processing: Solid only scans the metadata structure of your analytics stack. No sensitive raw data or PII is ever stored in the Solid system.

Column value samples are metadata, not raw data. When Solid collects data samples to improve model accuracy (e.g., categorical value mapping — see Collect and Offline Process), it samples individual column values, not rows or records. A sample never reconstructs a row: it's a list of distinct values seen in a single column (e.g., the set of country codes that appear in a country column), not the corresponding record with its other fields intact. Because a sample carries no row-level context, it's classified and handled as metadata, not as raw customer data.

Active PII exclusion:

• Integrated AI-driven filtering (Azure PII Detection engine) automatically identifies and blocks PII at the source during ingestion
• If PII is suspected in a sampled column value, that column's data is neither saved nor processed
• Azure PII Detection covers all standard PII types

Enterprise-grade encryption:

• At rest: all data encrypted using Customer-Managed Keys (CMK)
• In transit: all traffic secured via TLS 1.2+ through authenticated SSL connections

See Controls and Safeguards for how these properties translate into SQL-generation-time guardrails, Compliance and Certification for third-party validation of this architecture, and When Does Solid Execute SQL? for how this DB Agent boundary compares across ingestion, benchmarking, and runtime MCP.