What SQLExplain sends, and what it doesn't

What gets masked before AI processing

Before any part of your SQL is sent to an AI model, SQLExplain runs it through a masking step. This step replaces the following with neutral placeholder tokens:

• Database names
• Schema names
• Table names and table aliases
• Hard-coded literal values: numbers, dates and times, and text strings
• SQL comments (removed entirely)

For example, a filter like WHERE region = 'NORTHEAST' is sent to the AI as something like WHERE region = STRING_001. The AI never sees the literal value NORTHEAST, or the real name of the table it came from.

What is kept, and why

Column names, output aliases, and SQL structure (joins, aggregations, CASE logic, grouping, and so on) are kept visible. This is a deliberate tradeoff: a column namedtotal_sales carries real business meaning that a token likeCOLUMN_001 does not. Masking that away would make the explanation far less useful without meaningfully improving privacy, since column names on their own rarely identify a specific database, customer, or record.

What is never sent

SQLExplain never executes your SQL and never connects to your database. It only ever processes the text of the SQL you provide. That means the actual rows, records, and values stored in your tables are never sent anywhere, because SQLExplain never has access to them in the first place.

See it for yourself

Inside the app, an "AI view" control lets you inspect the exact masked version of your SQL before it is sent for explanation. What you see there is what the model receives, not a simplified preview.

Metadata you choose to provide

If SQLExplain asks for table or column structure to resolve something like aSELECT * or an ambiguous column, it asks for structure only, such as column names and data types, never the rows or business records stored in those tables. Providing this metadata is always optional and used only to improve the analysis of the SQL you've already submitted.