Function and processing matrix

This page lists, for every function of the DQC Platform, which data it processes, over which interface and protocol, which permission a user needs for it, and whether it uses a language model.

In a private cloud or on-premises installation, all components run inside the infrastructure you control. Metadata, rules and results stay in your tenant; the only outbound connections are the ones you configure yourself (LLM endpoint, e-mail, webhooks, connected sources).

How to read the matrix

Data processed - the categories described under "Data categories" below.
Interface / protocol - how the data reaches the function. "HTTPS" means the platform's own web interface or REST API.
Permission required - either a tenant capability (shown in code font) or an object-level right on the connector, table or ruleset. Which role holds which capability is documented under User management and access rights.
AI usage - the model class the request is routed to, or "none" when the function works without a language model. The classes and the models behind them are described under Private Cloud & On-Premises Deployments.

Matrix

Function	Data processed	Interface / protocol	Permission required	AI usage
Sign-in and session	Identity data (name, e-mail, password hash or SSO subject), session cookie	HTTPS; OpenID Connect / OAuth 2.0 for SSO; TOTP or WebAuthn for MFA	none - every authenticated user	none
User and role administration	Identity data, role assignments	HTTPS (UI and REST API)	`Invite users`, `Change roles & remove users`	none
Group management	Group names, memberships	HTTPS	`Create & manage groups`	none
Connecting a data source	Connection parameters and credentials of the source system	Native database protocols (PostgreSQL, MS SQL Server, Oracle, SAP HANA, Snowflake, Databricks, BigQuery, Redshift, ClickHouse, Synapse, MotherDuck/DuckDB), OData over HTTPS, SharePoint, object storage (S3, Azure Blob, GCS)	`Add data sources`	none
File upload	Contents of the uploaded file (XLSX, CSV, JSON, Parquet)	HTTPS	Edit on the target object	none
Profiling	Column values of the selected table and the statistics derived from them	Protocol of the connected source	View or Edit on the table	none
Rule execution (data quality check)	Data of the connected source in the scope of the ruleset; resulting findings	Protocol of the connected source	Edit on the ruleset	none
Rule prediction	Table and column metadata, sample values released by the user	HTTPS to the AI gateway (OpenAI-compatible)	Edit on the table	`STANDARD`
DQ AI Assistant (chat)	User prompt, table metadata, released sample values	HTTPS to the AI gateway	View on the table	`FAST`
LLM-based rules (semantic rules)	Values of the columns the rule checks	HTTPS to the AI gateway	Edit on the ruleset	`FAST`
Rule descriptions, ruleset and mission naming	Rule and ruleset metadata	HTTPS to the AI gateway	Edit on the object	`NANO` (falls back to FAST)
Column matching when mapping system tables	Column names and data types	HTTPS to the AI gateway	`Add data sources`	`COLUMN_RELATION` (falls back to FAST)
PDF connector	Contents of the provided PDF documents	HTTPS to the AI gateway	`Add data sources`	`PDF_PROCESSING` (falls back to STANDARD)
Data improvement: addresses	Address fields of the selected records	HTTPS to the AI gateway; optionally a geocoding or fetch proxy, if configured	Edit on the table	`STANDARD`
Duplicate survivorship	Records of the selected table	HTTPS to the AI gateway	Edit on the table	`STANDARD`
Issue review and export	Findings and the records they refer to	HTTPS; export as XLSX, CSV, JSON, Parquet or PDF	View on the table	none
Missions and alerts	Recipient data (name, e-mail), summaries of findings	HTTPS; SMTP for e-mail; configured chat channels	`Manage missions & alerts`	none
Webhooks	Event payloads (object ids, run results)	HTTPS, outbound, signed	`Access to API tokens`	none
REST API	Depending on the endpoint - the same objects as in the user interface	HTTPS/REST (JSON), authenticated with a JWT or an API token	`Access to API tokens` plus the object-level rights of the caller	none
BI connection	Aggregated results and findings	PostgreSQL wire protocol, read-only	`Access to BI connection`	none
Company rules, tags, quality dimensions	Rule metadata	HTTPS	`Manage company rules`, `Manage tags`, `Manage quality dimensions`	none
LLM settings	Endpoint URL, API key, model names	HTTPS	`Manage LLM settings`	none

Data categories

Category	Examples	Where it is stored
Identity data	Name, e-mail address, role, group memberships, authentication factors	Platform database (identity schema managed by Ory Kratos)
Connection metadata	Host, port, database, user and the credentials of a connected source	Platform database. The credentials of the deployment itself (platform database, LLM gateway, SSO) are held as Kubernetes secrets or in an external secret store.
Structural metadata	Table and column names, data types, profiling statistics, rules and rulesets	Platform database, in the schema of the respective tenant
Sample data	Individual values from a connected source, as far as a check, a profiling run or an assistant request needs them	Platform database (tenant schema) and the configured object storage
Findings	Rule results, issue records, quality scores and their history	Platform database, in the schema of the respective tenant
Operational data	Container logs, traces and metrics, run history	Standard output of the containers, the configured OpenTelemetry endpoint, and the platform database

What reaches the language model

All LLM traffic of the platform goes through one gateway, which is OpenAI-API compatible. It runs either inside your own cluster (self-hosted) or, if you choose so, as the DQC-hosted gateway reached with a virtual key issued for you.

Requests carry structural metadata and the sample values the respective function needs - not a copy of the connected source.
Which model a class is routed to is your configuration: you can point every class at your own endpoint, and one model can serve several classes.
The AI functions can be switched off. Without a configured gateway the platform comes up and every function in the matrix that shows "none" keeps working.
In restricted networks the gateway can be sent through an outbound proxy and given your own CA bundle.