EQQ Security: Roles, Permissions, and Audit Logging

Controlled, secure access to business data is central to EQQ's design. This guide explains the layered security model that protects your data — from role-based access control and read-only database connections through to multi-factor authentication and a comprehensive audit trail.

Three User Roles

EQQ uses three distinct roles, each with carefully scoped permissions:

  • Query User — can only run queries that have been published and explicitly shared with them. Cannot create, edit, or delete queries, and has no visibility of the underlying database structure.
  • Query Creator — can build, test, and publish queries using the database views that an Administrator has approved for them. Cannot access user management, database connection settings, or system configuration.
  • Administrator — full access to user management, database connections, view registration, application settings, and the activity log.

Read-Only Database Access

EQQ connects to your business database using a dedicated, read-only SQL account. By design, EQQ can never INSERT, UPDATE, or DELETE records in your business database. This eliminates the risk of accidental or malicious data modification through EQQ, regardless of the queries that are constructed or the users running them.

Per-User View and Database Permissions

Administrators control which database connections and registered views each user can access. A Query Creator in the Finance team only sees Finance-relevant views and has no visibility of HR, Operations, or other departmental data. This ensures that sensitive information is accessible only to the people who genuinely need it.

SQL Injection Prevention

All user-supplied query parameters are validated and sanitized before being passed to the database. EQQ uses parameterized queries throughout its query engine, so it is not possible for a user to inject arbitrary SQL through a parameter field. Input validation happens both in the application layer and at the point of query execution.

Multi-Factor Authentication

EQQ supports TOTP-based MFA to add a second layer of protection at every login. Users register an authenticator app (such as Microsoft Authenticator or Google Authenticator) and must supply a time-based one-time code alongside their password at each sign-in. Administrators can monitor MFA registration status for all user accounts under Administration > Users by reviewing each user's account detail.

Database-Level Certificate Security

EQQ uses a per-installation unique certificate — generated automatically during setup — to protect internal cross-database SQL operations. The certificate signing password is stored securely in the EQQ database settings table and is never embedded in source code or configuration files. This means each EQQ installation has its own cryptographic identity.

Audit Logging

EQQ records every significant user action in a full audit trail. Administrators can review the log under Administration > Activity Log. Events captured include:

  • User sign-ins and sign-outs (including failed login attempts)
  • Query executions: who ran which query, when, and how many rows were returned
  • Query creation, modification, and deletion
  • User account changes and role assignments
  • Database connection additions and modifications

The audit trail supports compliance requirements and provides a clear record for investigating any unexpected data access.

Need Help?

If you need a security review of your EQQ setup, help setting up role-based access for your team, or advice on compliance-related configuration, contact us via Get In Touch or see our Services page.