Prepared for: Customer information security / architecture review Product: AI SQL Tuner Studio, version 2.2 (Windows desktop application) Vendor: AI SQL Tuner LLC, Commack, New York, USA Contact: support@aisqltuner.com · privacy@aisqltuner.com
This document summarizes the security-relevant behavior of AI SQL Tuner Studio 2.2 so that a security team can evaluate it for installation.
1. What the product is
AI SQL Tuner Studio is a Windows desktop (MSIX) application that reads performance and configuration metadata from a SQL Server instance, sends that metadata to a large language model for analysis, and renders the result as a local HTML report. It is a read-only diagnostic and advisory tool. It does not run as a service, does not install an agent on the SQL Server, and requires no components to be deployed to the database server.
Supported targets: SQL Server 2016 and later (on-premises), Azure SQL Database, Azure SQL Managed Instance, and Microsoft Fabric SQL Database.
2. Software distribution and code signing
| Item | Detail |
|---|---|
| Package format | MSIX bundle (.msixbundle), installed per-user via Add-AppxPackage |
| Code signing | Signed with a code signing certificate issued by SSL.com |
| Signing identity | CN=AI SQL TUNER LLC, O=AI SQL TUNER LLC, L=Commack, S=New York, C=US |
| Timestamping | RFC 3161 timestamp from SSL.com (ts.ssl.com), SHA-256 digest |
| Signature algorithm | SHA-256 |
Windows validates the signature and the publisher identity at install time; MSIX installation fails if the package has been tampered with. Customers can verify the signature independently before installing:
Get-AuthenticodeSignature "AI SQL Tuner Studio_<version>_x64.msixbundle" | Format-List Status, StatusMessage, SignerCertificate
Status must return Valid. On isolated servers with no outbound internet access the certificate chain may not build (error 0x800B010A); the issuing SSL.com intermediate certificates must be installed into the machine store in that case.
The MSIX package identity is bound to the same certificate subject, so the application cannot be updated or replaced by a package signed by a different publisher.
3. SQL Server access model — least privilege
The application connects to SQL Server as an ordinary client using Microsoft.Data.SqlClient. It supports Windows Integrated Authentication, Microsoft Entra ID interactive authentication, and SQL Server authentication. Windows or Entra ID authentication is recommended so that no password is handled by the application at all.
3.1 Recommended least-privilege account
No membership in sysadmin, db_owner, or db_datareader is required. The permissions below are metadata-read permissions only; none of them convey the ability to read user table data or to modify anything.
-- Server level (once per instance)
CREATE LOGIN [AISQLTuner] FROM WINDOWS; -- or: WITH PASSWORD = '...'
GRANT VIEW SERVER STATE TO [AISQLTuner]; -- DMVs (waits, I/O, plan cache, sessions)
GRANT VIEW ANY DEFINITION TO [AISQLTuner]; -- catalog view metadata
-- Per target database
CREATE USER [AISQLTuner] FOR LOGIN [AISQLTuner];
GRANT VIEW DATABASE STATE TO [AISQLTuner]; -- database-scoped DMVs, Query Store
GRANT VIEW DEFINITION TO [AISQLTuner]; -- object metadata, module text (Code Review)
GRANT SHOWPLAN TO [AISQLTuner]; -- estimated plans (Query Tuner only)
Two Server Health collectors read data that requires additional rights: the CHECKDB-lineage collector (DBCC DBINFO WITH TABLERESULTS) and the backup-history collector (msdb.dbo.backupset). If the login lacks those rights, each collector fails independently, logs a message, and the run continues — the application degrades gracefully rather than requiring elevation. Customers who prefer not to grant them can simply accept the reduced report.
3.2 Transport encryption
Connections are encrypted by default. The application targets Microsoft.Data.SqlClient 6.1.2, in which Encrypt defaults to Mandatory, so TLS is negotiated unless the operator explicitly overrides it. TrustServerCertificate is a per-connection opt-in and is displayed with a warning in the pre-run plan dialog when enabled. Entra ID interactive connections always set Encrypt=true.
As a separate feature, the Server Health report audits encryption on the instance — it enumerates active sessions from sys.dm_exec_connections and reports the percentage of connections that are unencrypted, along with sysadmin role membership and risky built-in accounts.
4. No changes are made to the target server
Every collector in the product is a read-only query against system catalog views and dynamic management views. The application contains no INSERT, UPDATE, DELETE, CREATE, ALTER, or DROP statements against customer objects, makes no configuration changes, creates no jobs or extended-event sessions, and installs nothing on the database server.
Three non-SELECT statements exist, all of which are read-only informational commands:
| Statement | Purpose | Effect |
|---|---|---|
SET SHOWPLAN_XML ON / OFF |
Query Tuner — obtain an estimated plan | Session-scoped setting. The submitted query is compiled but never executed. It runs on a separate connection so the caller’s session state is unaffected. |
DBCC DBINFO WITH TABLERESULTS, NO_INFOMSGS |
Read last known-good CHECKDB date | Reads database boot-page metadata. Does not run CHECKDB. |
DBCC SHOW_STATISTICS ... WITH DENSITY_VECTOR |
Read existing statistics density | Reports existing statistics. Does not update or recompute them. |
Remediation scripts are never executed. When the AI recommends an index change or other action, the script is rendered as text in the report’s Scripts section. The Export SQL command writes those scripts to a .sql file for a DBA to review and run manually in SSMS or sqlcmd. The application has no code path that executes a recommended script.
5. Data accessed and transmitted
5.1 What is read from SQL Server
Only system metadata: catalog views (sys.objects, sys.indexes, sys.columns, sys.databases, sys.configurations, sys.server_principals, sys.sql_modules, and similar) and dynamic management views (sys.dm_os_wait_stats, sys.dm_exec_query_stats, sys.dm_db_index_usage_stats, sys.dm_db_missing_index_details, Query Store views, and similar). The release ships 64 distinct collectors across six tuning goals, each with a published DMV list.
No user table data is queried. The product issues no SELECT against customer application tables and returns no table rows to the AI model.
5.2 What is sent to the AI model
- Object metadata — schema, table, index, column, and stored procedure names
- Aggregated performance statistics — waits, I/O latency, execution counts, CPU and duration totals
- Server and database configuration values
- SQL statement text drawn from the plan cache, Query Store, or
sys.sql_modules - For Query Tuner only: the query text the operator pastes in, plus its estimated plan XML
- For Fix Deadlocks only: deadlock graph XML from the
system_healthextended-event session
5.3 Disclosure customers should be aware of
Although no table rows are read, SQL statement text can contain literal values embedded in the statement — for example a hard-coded WHERE Email = 'someone@example.com' in a stored procedure, or an ad-hoc query captured in the plan cache. Deadlock graph XML can likewise include key values for the rows involved in the deadlock. Where this matters for regulated data, the bring-your-own-endpoint option in Section 6 keeps all such content inside the customer’s own Azure tenant.
Passwords, connection credentials, API keys, and license keys are never included in any payload sent to the AI model.
6. AI processing and endpoint options
Default: requests are sent over HTTPS to an Azure AI Foundry endpoint operated by AI SQL Tuner LLC on Microsoft Azure. Content sent to Azure AI Foundry / Azure OpenAI is governed by Microsoft’s data-handling terms for those services and is not used to train models.
Bring your own endpoint: the application can instead be pointed at the customer’s own Azure AI Foundry or Azure OpenAI resource. This is configured in the UI under AI Configuration by supplying the resource root endpoint (for example https://<resource>.cognitiveservices.azure.com/) and the customer’s own API key. With BYO enabled, metadata is sent only to the customer’s Azure resource — the vendor’s endpoint is not contacted for analysis, and the request never leaves the customer’s Azure tenant boundary.
Supported model families are Azure OpenAI GPT deployments (Responses API) and Claude deployments served through Azure AI Foundry (Anthropic Messages API). Azure AI Foundry credentials are not embedded in the shipped application.
No vendor-side storage. AI SQL Tuner LLC does not store collected metadata or generated reports. Reports are written to the operator’s local disk when they choose to save them.
7. Network egress
All outbound traffic is HTTPS on TCP/443 unless noted. The application listens on no ports and accepts no inbound connections.
| Destination | Purpose | When | Content |
|---|---|---|---|
| Azure AI Foundry endpoint — vendor-operated, or the customer’s own resource under BYO | Tuning analysis | Each analysis run | The metadata described in Section 5.2 |
https://aisqltuner.com/ |
Easy Digital Downloads license activation and validation | License activation, and periodic validation | edd_action, license key, product item ID, site URL. No customer, server, or database information is included. |
https://learn.microsoft.com/ |
Refines the latest published cumulative-update date for the detected SQL Server version | Server Health runs against on-premises SQL Server only | Unauthenticated GET of a public Microsoft documentation page. No customer data is transmitted. Falls back to a built-in reference table if unreachable. |
https://aisqltunersw.blob.core.windows.net/ |
Downloads the .appinstaller manifest to compare versions |
Only when the operator clicks Help → Check for Updates | Version manifest request. No customer data. |
Customers who block the Microsoft Learn and blob-storage destinations lose only CU-date refinement (a built-in reference table is used instead) and the in-app update check. Analysis and licensing are unaffected.
The application contains no analytics, telemetry, or crash-reporting SDK. No usage data is collected or transmitted to the vendor.
8. Local data storage
| Data | Location | Protection |
|---|---|---|
| Saved connections | %LOCALAPPDATA%\AISQLTuner\AISQLTunerStudio\connections.json |
Plain JSON in the user profile, protected by NTFS ACLs |
| Application settings, including optionally saved API key and license key | %LOCALAPPDATA%\AISQLTuner\AISQLTunerStudio\settings.json |
Plain JSON in the user profile, protected by NTFS ACLs |
| Reports | Wherever the operator chooses to save them | Operator-controlled |
Credential storage is opt-in. A SQL password is persisted only if “Remember password” is checked on the connection, and the AI API key only if “Save key” is checked. These files live in the signed-in user’s local profile and are not additionally encrypted at rest, so they inherit the protection of the user profile and of any full-disk encryption on the workstation.
Recommended hardening: use Windows Integrated or Entra ID authentication and leave the “save” checkboxes unchecked. No secret is then written to disk at all.
Secrets are excluded from application logging — license keys are masked in log output, and API keys and passwords are never logged.
9. Audit and verification controls
The product is designed so that a security reviewer or change-control process can see exactly what a run will do before any data leaves the machine.
- Pre-run plan dialog. Clicking Run Analysis first displays a Review Run Plan dialog showing the connection (server, database, authentication method, encryption state), the AI call (provider, endpoint host, model, and whether the endpoint is vendor cloud or the customer’s own), the license state, and a table of every collector that will run — including the DMVs each one touches, its estimated row cap, and its estimated payload size. Every collector is explicitly marked read-only.
- Plan fingerprint. Each plan carries a stable 16-character SHA-256 fingerprint covering the goal, server, database, model, reasoning level, and collector SQL, so two reviewers can confirm they are looking at an identical configuration.
- Exportable plan. The plan can be saved as JSON for attachment to a change ticket. The export explicitly excludes the license key, API key, and password — only the endpoint hostname appears.
- Console audit line. An 8-line plan summary is written to the in-app console on every run, even when the dialog is suppressed.
10. Summary for reviewers
| Control | Status in 2.2 |
|---|---|
| Installer digitally signed and timestamped | Yes — SSL.com certificate, verifiable with Get-AuthenticodeSignature |
| Requires elevated SQL privileges | No — metadata-read permissions only; no sysadmin or db_owner |
| Makes changes to the SQL Server | No — read-only; recommended scripts are exported for manual review |
| Reads user or application table data | No — system catalog views and DMVs only |
| Agent or service installed on the database server | No |
| Inbound network listeners | None |
| Vendor-side storage of customer data | None |
| Product telemetry or analytics | None |
| Data can be kept inside the customer’s Azure tenant | Yes — bring-your-own Azure AI Foundry endpoint |
| Pre-execution audit of what will be collected and sent | Yes — Review Run Plan dialog with exportable JSON and fingerprint |
AI SQL Tuner LLC · Privacy policy: https://aisqltuner.com/ · privacy@aisqltuner.com