Table metadata
Last-modified timestamps and row counts from INFORMATION_SCHEMA for the specific tables you choose to monitor. This is how we know whether data arrived today.
Security & data access
We read metadata. Never your data.
Connecting a monitoring tool to your warehouse is a real decision, so here is the whole picture in plain language: what Vectornosis reads, what it stores, what it can never see, and how to shut it off.
The short version
Your rows never leave your warehouse.
Freshness monitoring only needs to know when a table last changed, not what is in it. Cost monitoring only needs to know how many bytes a job billed. Neither requires reading a single row, so we do not ask for the permission to. Vectornosis is independent — not Datadog-owned — and exports OpenLineage so your metadata stays portable.
What we read
Query job statistics
Bytes billed and job durations from your BigQuery job history. This is how we detect cost spikes against your rolling baseline.
dbt run artifacts
The run_results.json file you upload. It contains model names, test names, statuses, and timings — not query results.
What we never touch
- ✕Row-level data from any table
- ✕Column values, samples, or previews
- ✕Query result sets
- ✕Anything from projects or datasets you have not explicitly added
- ✕Anything at all without a service account you created and can revoke
What we store on our side
- Table identifiers
- Project, dataset, and table names you chose to monitor
- Freshness history
- Timestamps and healthy / warning / critical status over time
- dbt results
- Model and test names with pass or fail status and duration
- Cost aggregates
- Daily bytes billed and estimated spend, not query text
- Alert recipients
- The email addresses you want notified
- Credentials
- Your service account key, encrypted at rest
Least-privilege access
You create a Google Cloud service account and grant it the narrowest roles that make monitoring work — metadata read access on the datasets you pick, and permission to list job history. You do not grant data viewer access, and we do not ask for it.
Because you created the service account, you control it. Deleting the key in Google Cloud revokes our access immediately and completely, without going through us or waiting on a support ticket.
Handling and retention
- ✓All traffic is encrypted in transit over TLS
- ✓Service account credentials are encrypted at rest
- ✓Monitoring history is scoped to your workspace only
- ✓Ask us to delete your workspace and we remove your data and credentials
What we do not claim yet
Vectornosis is early and founder-built. We are not SOC 2 certified yet — that audit is on the roadmap. If your procurement process requires a completed SOC 2 report today, we are not the right fit yet, and we would rather tell you now than waste your quarter.
What we can offer instead is a narrow permission model you can audit yourself in an afternoon, and a founder who will answer security questions directly.