Secure and audit-ready,
by design
QueryWell Studio combines Fusion replication and reporting with explicit data paths. Query results and run records are stored locally, Data Loader writes to your own Oracle Autonomous Database, and optional AI connects to your chosen provider. Credentials stay in the OS keychain; export hashes help verify the files you retain.
No QueryWell reporting cloud
Query Studio stores results, history and exports on your device. Data Loader sends selected data to the customer ADB target, and optional AI runs send configured context to your chosen provider. Elaman does not host a reporting copy or provide reporting cloud sync.
Secrets in the OS keychain
Credentials live in OS-native secret storage — never in plaintext and never in the app's local database. QueryWell runs BI Publisher reports using an approved username/password reporting account over HTTPS by default. Token sign-in is in Preview from version 7.1 and must be enabled by your BI Administrator; see Oracle's 31 March 2027 deadline. A green connection test means a real, executable login — 401 and 403 fail loudly.
Read the Oracle Fusion API authentication guide for connection requirements and the roles of basic authentication and OAuth.
Reporting-only by default
Query execution is restricted to read-only SQL against Fusion transactional data. Reports run as the reporting account you supply, so what BI Publisher returns is bounded by that account's roles, grants and data-security policies. Data Loader writes to the customer database you administer; catalog workflows can publish BI Publisher objects. QueryWell does not use a JDBC or SQL*Net connection to the Fusion database.
Residency follows your destinations
Where report data lives depends on the destinations you configure: your device, your target database and, for optional AI runs, your model provider. Review their regions, access controls and retention against requirements such as Bank of Ghana CISD-2026. QueryWell does not certify compliance with any regulation.
Masked audit logs
Query history records executions and the export log records generated files. Sensitive parameter names — token, key, IBAN, account and the like — are masked in the log automatically.
Tamper-evident exports
Every export is SHA-256 hashed and recorded in the export log — evidence you can hand straight to auditors and examiners.
Security & governance at a glance
- Read-only query execution against Fusion transactional data; Data Loader writes to your configured target
- Runs as the reporting account you supply — bounded by that account's Fusion roles and data-security policies
- OS-native secret storage; no secrets in the local database
- Sensitive parameters (token, key, IBAN, account…) masked in logs
- Content Security Policy enforced in production builds
- No product telemetry or cloud sync; update checks send limited version, platform, licence and random-install identifiers
- Reads Fusion data through BI Publisher; no JDBC or SQL*Net connection to the pod database. An approved username/password reporting account over HTTPS runs reports today
- Cryptographically signed updates; signed & notarised macOS build and verified-publisher Windows installer
Where your data goes — the three paths
QueryWell stores connection metadata, history, audit logs and saved queries in local SQLite on your device. Report data itself travels one of three paths, each of which you choose and can evidence:
- Query Studio — reports run through BI Publisher; results, history and exports are stored on the device. Elaman does not host a reporting copy.
- Data Loader — selected, supported data is written to your Oracle Autonomous Database through ORDS REST-enabled SQL. QueryWell applies pod-stored policy in the client, stores local run records and publishes a per-user pod ledger on a best-effort basis.
- AI Workbench — prompts, schema metadata and tool results go directly to the model provider you configure, on your own account. Elaman does not proxy or retain them.
Scope the reporting replica. Data Loader bounds concurrent loader report requests per pod across runs in this QueryWell instance. Assess source access, table coverage and workload with your Fusion administrators; for bulk warehouse extraction, evaluate Oracle's recommended extraction tools.
Data Loader — governed by design
Data Loader is included in Studio and creates reporting copies in your own Oracle Autonomous Database. Administrators can configure a governance registry in the BI Catalog and must restrict its folder permissions. QueryWell applies those rules in the client; source and target permissions govern access outside it. These controls do not prevent other clients from copying data.
Data Loader governance controls
- Client-applied open or restricted target policy, configured in the BI Catalog
- Per-table row caps and deny lists
- Copy rules checked by cooperating QueryWell clients against recorded load activity
- Local run records and a best-effort pod ledger with per-user folders; interrupted or failed writes can leave the pod ledger incomplete
- Local CSV export of the ledger for offline audit
- Optional delete reconciliation can remove missing-source rows from the target after a full key scan and safety checks; it is disabled by default
- Supported columns only: LOB/RAW/LONG/XMLTYPE excluded; supported time-zoned timestamps map to plain TIMESTAMP
Reporting your auditors will trust
Review the source, desktop, target and optional AI-provider paths for your deployment, and retain the exports and run records your evidence process needs.