Security & Data Sovereignty
askLenny is designed for environments where data cannot leave the network. Here is exactly what does and does not cross your perimeter — and which container is responsible.
Row data: never read by the engine
The Rust graph engine only stores schema metadata. The Python app layer executes SQL and returns results to the browser — no row data is ever stored or forwarded.
Passwords: never stored
connectors.yaml references environment variable names only. Actual passwords are injected via Docker Compose and exist only in the app container process memory.
Graph engine: fully isolated
The Rust engine container has no external network access. It cannot reach your databases, the internet, or any LLM. It responds only to the Python app container.
Container trust boundaries
Frontend Container
:5173
Outbound connections
- →Python app layer API only
Holds in memory / disk
- ·No credentials
- ·No database access
- ·No persistent storage
App Layer Container
:8000 (loopback)
Outbound connections
- →Source databases (INFORMATION_SCHEMA + SELECT)
- →LLM endpoint (configurable)
- →Rust engine (:3030 internal)
Holds in memory / disk
- ·DB credentials (env vars)
- ·connectors.yaml
- ·Temporary query results
Graph Engine Container
None
Outbound connections
- →No external connections whatsoever
Holds in memory / disk
- ·Schema graph (.dat files)
- ·Vector embeddings
- ·No credentials
What leaves your network
Every category of data askLenny handles — where it goes and which container handles it.
| Data | Leaves network? |
|---|---|
| Table names | Yes — to AI endpoint |
| Column names + SQL types | Yes — to AI endpoint |
| Natural-language question | Yes — to AI endpoint |
| Schema context (markdown) | Yes — to AI endpoint |
| Row data (SELECT results) | Never |
| Database passwords | Never |
| Schema graph / embeddings | Never |
| Query history / results | Never |
Controlling the AI endpoint
Only the Python app container makes LLM calls — for description generation during enrichment and for SQL generation at query time. All other containers are isolated from external networks.
Point LLM_BASE_URL at any OpenAI-compatible server. Use a local model and zero bytes leave your perimeter.
Cloud LLM (default)
GEMINI_API_KEY + remote endpointSchema names + questions leave (app container only)
Self-hosted Ollama
LLM_BASE_URL=http://ollama:11434/v1Zero bytes leave — full on-prem
Private Azure OpenAI
LLM_BASE_URL=https://corp.openai.azure.comData stays within your Azure tenant
Network isolation
Exposed ports
- :5173Frontend dashboard — expose only to internal network or VPN. Never to the public internet.
- :8000App layer API — bound to 127.0.0.1 by default; browser talks to it via the Compose network.
- :3030Rust engine — NOT exposed. Accessible only from the app container over the internal Docker bridge.
askLenny never calls home
- ✓No telemetry or usage reporting
- ✓No licence check or phone-home
- ✓No package downloads at runtime — all dependencies in the image
- ✓MIT licensed — audit the source code on GitHub
Known limitations
Being honest about what askLenny does not currently do.
No dashboard authentication
The web UI on port 5173 has no login screen. Run it behind a VPN, internal network boundary, or a reverse proxy with auth. Do not expose it to the public internet.
No application-layer encryption at rest
The .dat files in the engine volume are unencrypted binary. Apply host-level disk encryption (BitLocker, LUKS) if required by your policy.
AI provider privacy policy applies
When using a cloud LLM (Gemini, OpenAI, etc.), your schema names and questions are subject to that provider's data terms. Use a self-hosted model to eliminate this entirely.
SQL execution uses the read account
The same database account used for INFORMATION_SCHEMA discovery also executes user queries. Scope permissions to SELECT on the tables you want queryable.