Security

← Administer

This page summarizes how Monomer protects your account, your warehouse, and your team’s work. It describes what Monomer does today; policy details are in Privacy and Terms.

Agents sign in with OAuth

Agents and your own programs connect through OAuth 2.0 with PKCE. You approve each app in your browser, signed in with your Google account. There are no tokens or API keys to copy: Monomer has no screen that issues them, and the app’s client stores its own short-lived tokens.

• An access token lasts 15 minutes. The connection expires 30 days after you approve it; refreshing does not extend it.
• If a used refresh token is sent again, Monomer revokes the whole connection.
• Apps identify themselves with an HTTPS client ID metadata document. Monomer offers no dynamic registration and uses no client secrets.

In Your settings → Agents (select your name at the bottom of the sidebar, then Settings), you see each connection by app, what it connects to, when it was last used, and when it expires. Select Revoke to end a connection immediately; its access and refresh tokens stop working. Revoking a connection does not recall information the app already received. Each person sees and revokes only their own connections. Connect an agent and Connect a REST client describe the sign-in flow.

Warehouse credentials stay in Monomer

Warehouse credentials are encrypted with AES-256-GCM before they are stored, using a key held in AWS Secrets Manager, and the database storage is encrypted as well. Credentials are write-only: the app, the API, and agent reads never return them, and existing secret values are never displayed. Deleting a connector destroys its saved credentials.

Enter credentials in the connector form rather than in an agent conversation, document, or support message. A Workspace Owner can replace credentials at any time from the connector; see Add a warehouse connection.

Use a read-only warehouse account

Monomer runs SQL with the connector’s warehouse account, for people and their agents alike. Use a dedicated read-only account with access only to the data your team should analyze.

Monomer checks SQL before running it, for example by requiring a single read statement and using read-only transactions where the warehouse supports them. These checks help prevent common mistakes, but Monomer does not guarantee read-only access: if the account can write, Explorers and their agents can change warehouse data. Deny procedure, pass-through, and remote or external function privileges as described in Prepare the source. Warehouse grants, row policies, and network rules still apply.

Roles apply to people and agents alike

Every Workspace member has one role: Viewer, Explorer, Editor, or Owner. The ladder is cumulative, and Workspace roles lists what each allows.

An agent acts as the person who connected it, with that person’s current roles, in the Workspaces they belong to. There is no separate agent permission. Monomer checks the role again on every request, so a role change or removal applies to the person’s agents at once. A missing Workspace and one you can’t access return the same response, so an agent can’t discover what it isn’t allowed to see.

Some actions are available only to people in the web app, including accepting or declining an invitation; creating or renaming Organizations and Workspaces; removing an Organization member or changing their Organization role; turning public Pages on or off; changing the Workspace’s Reporting time zone; configuring time spines; and revoking agent connections or signing out of all devices from Your settings.

Work is attributed

Monomer records who did the work, whether it came from the web app or an agent, and which app. Dashboards, drafts, semantic models, metrics, Pages, and runs show it, for example Updated by Sam Kim via Claude, and Overview puts a badge for the app on the person’s avatar. An app’s name is its own claim, so Monomer shows the Claude, OpenAI, or Cursor logo only when the host it verified for the app is claude.ai, chatgpt.com, or cursor.com; any other app appears by its verified host, such as via agents.acme.dev. Hover the mark to see the app’s name and host; on detail pages you can also focus it. Work recorded before Monomer kept app names reads via agent. On Overview, Recent activity can show only agent work. See Direct your agent for the fields agents read.

Sign-in and connections in transit

You sign in to the web app with Google. Traffic to the app and the API uses HTTPS, and connections to the database require TLS. A browser session lasts up to seven days from sign-in. In Your settings → Security, Sign out of all devices ends your browser sessions; connected agents keep working until you revoke them in Agents.

Where your data lives and how long it is kept

Monomer hosts application data on Amazon Web Services in the United States (US East, N. Virginia).

Data	How long
Explore results	Available to view and download for 3 days after the run, shown as Available until. After that the result can’t be opened, though its stored file is not automatically deleted.
Download links	A direct result download link expires within 5 minutes.
Definitions, dashboards, and Pages	Stay in your Workspace until you or your team remove them.
Database backups	Seven days.
Service logs	Seven days.

Public Pages are off for every new Workspace. Only a Workspace Owner can turn them on; see Share Pages publicly.

Deletion requests and security reports

Monomer has no self-service account deletion. Email support@monomer.cc with Deletion request in the subject; requests are handled manually after identity, authorization, and scope are reviewed. A deleted record can remain in a database backup until that backup expires.

To report a security concern, use Security report in the subject and describe the issue privately. Do not send passwords, tokens, or warehouse credentials. See Contact Monomer for details.