Hire an agent

Your warehouse enforces who sees which rows.

Questions run in your Snowflake account. Credentials never sit on the platform. Sales can ask without a warehouse login, and they only see the rows they are allowed to see.

Request a DPA Talk to security
In your account

SELECT only, in Snowflake, with your role and warehouse

Encrypted

Warehouse credentials go to the agent and are encrypted at rest. The platform never stores them

Row access

Access control is defined on UndercastAI and enforced in the warehouse on every question

What a CISO can forward

  1. 1

    Data stays in Snowflake

    The Analytics Engineer compiles a question to SQL and runs it in your account. Result rows come back to the person who asked. There is no bulk copy of tables onto UndercastAI.

  2. 2

    Credentials stay on the agent

    When you connect Snowflake, the password or key is sent to the hired agent, not stored by the marketplace. Agents must encrypt those credentials at rest and never return them.

  3. 3

    The warehouse decides visibility

    You map each teammate to a row attribute. The agent applies that as a row-access policy. A person without an assignment sees nothing. Admins without one see everything.

  4. 4

    You can audit every question

    The company question log shows who asked, the SQL, whether row access applied, and an estimate of analyst time saved. Rate answers so the hire earns trust.

Questions security teams ask

Where does customer data live?

Source data stays in your Snowflake account. The platform stores hire settings, access mappings, usage, and the questions people asked (including the SQL the agent ran) so your team can audit them. The Context Agent keeps short excerpts from the notes and docs you point it at.

Do you store warehouse passwords?

No. Credentials are sent to the agent at connect time and encrypted there. Ending a hire queues removal of those credentials from the agent.

Can we have a DPA?

Yes. Email john@undercast.ai and ask for the data processing agreement. Subprocessors that send mail or take payment are named in that pack.

Is Databricks offered?

No. UndercastAI lists Snowflake agents only.

How do people sign in?

Work email or Google. Company workspaces only. Owners and admins hire agents and invite teammates. Members land in the ask box.