Sema

Legal

Data Privacy

Last updated June 1, 2026.

This Data Privacy statement summarises the principles and practical safeguards Sema applies to keep your data private, governed, and under your control across the platform.

1. Your data stays yours

  • Sema does not warehouse your source data. Generated SQL runs against your connected sources or a read-replica you control; only the semantic graph (definitions, relationships, metric logic, embeddings) is stored by Sema.
  • We do not sell your data and we do not use your Customer Data to train foundation models.

2. Governance by default

  • Role-based access control, restricted-column masking, query logging, and signed evidence are enabled by default. Disabling a governance control is always an explicit, logged action.
  • Every answer can be reproduced with the SQL it ran, the graph nodes it touched, and a cryptographically signed evidence pack.

3. Encryption & isolation

  • Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Workspace-level LLM keys and connector credentials are encrypted at rest with per-tenant keys.
  • Query plans execute in sandboxed, network-isolated environments; generated SQL is statically analysed before it reaches a database.

4. Access controls

  • Access to production systems is least-privilege, authenticated, logged, and reviewed. Administrative actions are recorded in an append-only audit log.

5. AI & LLM providers

  • When AI features are used, only the minimum context required (such as schema and metadata) is sent to the configured model provider. You can choose your provider and, on eligible plans, bring your own key.
  • Providers process data under contractual data-protection terms and do not retain content for training under our configuration.

6. Data residency & self-hosting

  • Enterprise customers can deploy Sema's control plane within their own VPC or Kubernetes cluster so that data never leaves their network.

7. Retention & deletion

  • You control retention of your workspace data. On request or on termination, we delete or return your data in line with the DPA, subject to legal retention requirements.

8. Contact

  • Privacy questions? Email privacy@semalayer.com.