Security and data

Know what leaves the environment—and what does not.

The collector is customer-controlled. The verified assessment ZIP contains workload metrics and configuration evidence, not the connection credentials used during collection.

Included in assessment evidence

SQL Server CPU and processor facts
Memory pressure and working-set evidence
File-level I/O and throughput counters
tempdb, edition, storage, and configuration facts
Collector manifest and collection-quality diagnostics

Excluded from exported evidence

Database login and password
AWS credentials or access tokens
SQL text and execution plans
Query Store content and traces
Application table rows and intentionally collected PII

How your account is protected

Accounts, access, and records

You sign in with a one-time link sent to your work email. Savio has no passwords to steal.
Each collector you download carries a personal token linked to your account. An upload is accepted only when you are signed in to the account that owns that token, so a copied collector cannot be used by someone else.
Your reports and account details are visible only to your account. Only authorized Savio staff may open assessment results, and only to provide support.
Collector tokens are stored encrypted. Failed sign-in checks, collector downloads, rejected uploads, and registration are recorded.
Savio does not make AWS, database, or configuration changes. You decide whether and when to act on a result.

Hosting: encrypted connections (HTTPS) and storage encryption are provided by Savio's hosting and database providers. Questions about security: [email protected].

Customer checklist before upload

Use the verified ZIP produced by the collector.
Do not manually add credential files or unrelated documents.
Transfer evidence only through the approved hosted assessment endpoint.
Keep or delete the local collector output according to your organization’s policy.

Review the collection method

See how evidence is converted into the Layer 1 decision.

Review Methodology