Sensitivity and sharing

Squeezle can classify sensitive database columns and gate who sees them, and it can send a specific result out as a secure, expiring link. The two work together: classification is what makes a share link safe to send.

Column sensitivity

A column policy classifies one column with a sensitivity tier and zero or more categories. Squeezle uses this as a second layer on top of the database's own privileges: it hides classified columns from users below their clearance and refuses runs that touch them.

The four tiers, from least to most restrictive, are public, internal, confidential, and restricted; an unclassified column counts as internal. Categories are independent tags (PII, PHI, PCI, Financial, Secret, Other). Some of them are gated, meaning they trip the sharing gate below.

Classify columns

1. Go to Admin → Column sensitivity and pick a connection.
2. Under Suggested classifications, choose Suggest classifications to have the AI classifier propose tiers and categories (it only ever sees column names, types, comments, and nullability, never your data). Review each row and Accept the ones you want; nothing here is in force until accepted.
3. Under Classified columns, use Classify a column to set a column's Sensitivity level, Categories, and an optional reason by hand.

Each classified column also shows whether the database itself denies it to the connection's role: Enforced, Gate only (Squeezle blocks it but the database would still allow the read), or Unknown. An accordion gives the equivalent GRANT / REVOKE SQL to run yourself. Squeezle never runs it for you.

Managing policies needs the Manage data sources capability. The AI classifier specifically needs the sensitivity AI entitlement (Business plans and up); you can always classify by hand without it.

Secure share links

A secure share link is a tokenised, expiring URL to a frozen snapshot of one query result. The snapshot outlives the run, so the link keeps working after the run's own results are cleared, and someone who is not signed in can open it.

Create a link

1. Run the query, then click Share this result in the results pane.
2. Set Expires in (days) (default 7, up to 90), an optional Max views cap, and whether to require the viewer to sign in as a member.
3. Choose Create link, then copy the URL immediately. Squeezle stores only a hash of the token and shows it once.

The link resolves at /shared/<token>. A recipient sees the visible columns and rows, a note of how many columns were hidden from them, and the expiry. Sensitive columns are gated automatically:

• A snapshot carrying a gated category blocks anonymous access. Only a signed-in member with clearance can open it.
• Members are served only the columns their tier allows; columns above their clearance are omitted and counted.

Manage and revoke

Administrators manage links under Admin → Shared links: revoke any link, and control org-wide behaviour with the Sharing kill switch (turn all sharing off) and Full block on gated categories (refuse to share a gated result at all, rather than only blocking anonymous viewers).

Secure sharing is a paid feature gated on the Sharing entitlement (Team plans and up); the admin page needs the Manage settings capability.