PAR Technology Develops Secure Multi-Tenant LLM Analytics on AWS

Overview of the Analytics System

PAR Technology Corporation has created a natural language text-to-SQL agent for self-serve analytics targeting the restaurant industry. The solution allows users to query data in plain English and receive quick, reliable answers. To achieve this, the system addresses significant challenges related to security, correctness, and user data isolation.

Three-Layer Architecture

The analytics system utilizes a three-layer architecture that includes cryptographic request signing with AWS SigV4, semantic validation via Amazon Bedrock, and programmatic data isolation through Split-Plane SQL. This layered approach reduces the risk of cross-tenant data exposure, even in case of a security breach affecting the LLM itself.

The Data Boundary Challenge

A critical challenge faced by the analytics agent is ensuring that each query generated is accurate and relevant to the user’s specific permissions. For instance, two users asking the same question about total sales will receive different data based on their operational context—one reflecting localized results and the other a national aggregate. Maintaining these distinctions is essential for data governance and security.

Supporting Diverse Users

The system is designed to handle thousands of simultaneous users connected to various datasets and permission levels. Each user's query must be precisely scoped to ensure that sensitive information is not inadvertently shared. This design is vital for maintaining trust and compliance within a multi-tenant environment.