Security and privacy

Qlik credentials

The Qlik client secret is encrypted before it goes into the database (AES-256-GCM), never goes back to the browser and doesn’t appear on any screen once saved. The tenant URL is only accepted on the qlikcloud.com domain. To change the URL or the client ID, you must enter the secret again.

Separation between customers

Each customer only sees its own data. The customer for every query always comes from the signed-in person’s session, never from a field the browser could change. Our support team does not change customers’ Section Access rules.

What Qovern does in your Qlik

Qovern only writes to Qlik when someone asks for it on a screen, or when an action you scheduled runs (schedules, alerts). It:

• stores the rules file in the DataFiles connection of the chosen space;
• inserts the Section Access tab into the script of managed apps;
• triggers reloads;
• creates and changes reload schedules, space access, users and groups, at your request.

Every write goes into the audit trail. So give the service account only the permissions for the features you will use.

What Qovern stores

• a copy of the Qlik inventory (apps, spaces, users, groups), updated by the sync;
• app access and reload events, for the Dashboard, the Environment and alerts;
• Section Access rules, published versions and generated documentation;
• the audit trail.

Data is not deleted when access is blocked for non-payment.

Your account

Passwords are stored with argon2id hashing. Sign-ins have an attempt limit. When you change your password, the other open sessions are signed out.

Usage measurement

The website and the app measure navigation with Umami, hosted by Work Avanti itself, without cookies and without sharing data with third parties. Names, emails and addresses containing tokens are not sent.

Privacy policy

Data processing follows Brazil’s data protection law (LGPD). The details are in the Privacy policy and the Terms of use (in Portuguese).