Security at BiDesignLab

System architecture

BiDesignLab is a web application (Next.js). Design work runs on the server. Accounts and project configuration are stored in PostgreSQL.

In practice we use, among other things:

• encrypted HTTPS (TLS) connections on bidesignlab.com
• controlled access to infrastructure and APIs
• email-account passwords stored as a one-way hash (scrypt), never in plain text
• user sessions in HttpOnly and SameSite cookies
• projects separated by account owner
• a separate administrator role, limited to operating the service

PostgreSQL is not exposed publicly to the internet. The application connects to it from the server that runs BiDesignLab.

We do not need your production data

This is a core BiDesignLab principle. To design a report we primarily need data structure, not actual records.

You can provide, for example:

• table names
• column names
• data types
• relationship information
• data-source information

You do not need to provide:

• customer data
• transaction history
• employee data
• actual sales values
• database passwords
• tokens
• API keys

The database connection stays on your side

BiDesignLab can know that the report will later use Excel, CSV, SQL Server, PostgreSQL, MySQL, Oracle, or an existing Power BI project.

Indicating a source is for designing the future solution. It does not grant BiDesignLab access to that source.

After you download the project you configure the connection in Power BI Desktop. Passwords, tokens, and credentials stay with you.

Do not send database passwords or other credentials to BiDesignLab.

AI processing

BiDesignLab uses artificial intelligence to analyse the project and prepare proposals. The model provider is OpenAI (API, GPT-family models). BiDesignLab does not train its own language models.

AI may analyse table structure, column names, data types, a business description, report goals, proposed KPIs, and report structure.

We minimise data: AI receives what is needed for the specific task, not a full production database.

Under OpenAI’s current API data-use rules, data sent via the API is not used to train their models unless that use is enabled. BiDesignLab does not enable that use.

See the Privacy Policy for details.

User data and projects

Projects saved on an account are tied to the owner. Another BiDesignLab user cannot access them. Exceptions are the public Retail example — read-only — and administrator access needed to operate the service.

Part of the wizard works without registration. Progress may then be stored against a guest identity (HttpOnly cookie). After you create an account, that progress can be moved to the registered account.

Drafts abandoned early in the wizard may be deleted after 30 days without updates.

Access and authorisation

An account can be created with email (password + inbox confirmation) or via Google. Google sign-in is protected with a state token (CSRF).

• signed-in session: bdl_uid cookie (HttpOnly, SameSite=lax)
• guest identity: bdl_guest cookie (HttpOnly, SameSite=lax)
• project APIs require a session and an owner check
• the administrator role is separate from a regular user account

Administrative access is limited to people who need it to operate and develop the service.

API protection and abuse prevention

The application talks to the backend and selected third-party services through APIs. Features that require sign-in are bound to the user session.

We may apply operation limits, request limits, and blocks on suspicious activity — to protect both the infrastructure and user data. Current limits, if any, follow from how the Service runs.

Logs and monitoring

For stability and security we may monitor application and API errors, technical events, server logs, and service availability.

Technical logs are not used to build a business profile of the user.

Backups

We take backups of the application code and a PostgreSQL dump. Older copies are rotated. Access to backups is restricted.

The goal is to restore the service after a failure — not to store your production records, which BiDesignLab does not pull.

Security of the generated project

The Power BI project is built from information you entered and accepted. The ZIP package is assembled in your browser at download time and is not stored as a lasting file on BiDesignLab servers.

After download you are responsible for the ZIP file, the `.pbip` project, and data-source connections configured in Power BI Desktop.

Production data is refreshed by Power BI on your computer — not by BiDesignLab.

Data minimisation

There is no need to upload entire databases just to design the model, KPIs, and dashboard.

Third-party providers

BiDesignLab uses providers only as needed for a function, in particular:

• hosting and PostgreSQL
• OpenAI — AI analysis
• Google — sign-in
• Resend — email (for example email confirmation)

Data is sent to a provider only for that function. Provider categories are described in the Privacy Policy.

Updates and maintenance

The system may be updated to fix bugs, improve security, refresh libraries and infrastructure, and protect against new threats.

Some updates may run without prior notice when that is necessary for system security.

Responsible use of AI

AI works mainly on project structure and context. We recommend not sending production data, passwords, tokens, or API keys unless needed, and reviewing AI results before production use.

AI can be wrong. A correct final solution needs human review. The Terms of Service also set out the rules of use.

Reporting vulnerabilities

If you find a potential security issue, please report it responsibly to:

podkowa71@gmail.com

Please include a description, where it occurs, how to reproduce it, and the potential impact. Do not use a finding to access other people’s data, destroy data, or disrupt the Service.

Our approach

We build BiDesignLab as a secure environment for designing Business Intelligence solutions with AI.

The goal is to design reports, models, KPIs, and dashboards without sending production data into the design process. We treat security as part of the product architecture, not an add-on.