Most AI tools ask you to trust a number because the model sounds confident. Columnly is built the opposite way: correctness is plain, deterministic code that always runs — not an instruction buried in a prompt a model could ignore. Here's exactly how a figure earns its place on the screen.
Fail open where a wrong guess would drop your data. Fail closed where a wrong guess would fabricate a number.
Every data question is solved twice, by two different-class models. One understands and decomposes it; a second, independent model re-derives the whole thing from scratch — blind to the first one's code. The answer ships only when the two agree within a strict numeric tolerance.
Reads the question and the data profile, decomposes it into computed sub-goals, and produces a figure.
Never sees Model A's work. Writes its own independent solution to the same question.
Agree within tolerance → ship the verified figure · Disagree → pause and ask you · Can't back it → refuse, offer real options
Every number that will ever be displayed is registered in an immutable store, keyed by identity. It's immutable by key (a later step can't silently overwrite a figure), it auto-captures the code line that produced it (so lineage can't be faked), and it records the unit, scope, denominator, and what it was derived from. If a number isn't in the store, it cannot be shown.
In the web app the browser is structurally incapable of producing a number. Every figure crosses from server to client inside a sealed envelope with its verification state and snapshot id; the client-side handle that reads it has no setter. Structural data — names, labels, chart types — crosses freely; anything that could be wrong crosses only inside the envelope. A new number can appear only via a fresh, verified server round-trip.
The parts that must be correct are plain code that always runs. "You cannot sum an order ID." "You cannot divide a per-order total by a per-week count." "No join without real value overlap." Number-matching, the aggregate-legality rules, the grain guard, the join resolver — all deterministic. The model is used only where judgment is genuinely needed; everywhere correctness is at stake, code decides.
These run on the rendered output itself — a number that doesn't trace is deleted before ship.
Each figure must point to a stored, machine-computed value and equal it exactly under a strict formatting grammar ($/€/£/¥, western & Indian number formats, K/M/B — plus lakh/crore where you need it, %).
Every chart's plotted values must equal the verified series behind it — a chart can't quietly disagree with its own data.
A "highest" or "lowest" claim is checked against the very chart it sits on. If they disagree, it doesn't ship.
Interactive filters must stay verified per state — every slice recomputes and re-verifies, not just the default view.
Themes are contrast-checked to WCAG-AA; a beautiful chart that can't be read isn't a passing chart.
A final pass catches the failure modes that would embarrass a number before it ever reaches you.
No prior period → no "% change." No target column → no "vs target." A source that shares no join key → its rows are not counted, and the answer says so. When an insight can't be backed by the data, it's dropped from the artifact — and Columnly shows a plain, number-free "Not in this dataset" card that names exactly what your data can't answer. Only when the gap is real.
The Sheets add-on reads your open sheet synchronously and stores nothing at rest. It never edits your original sheet unless you ask for a write — and every write has full undo.
The web app keeps a per-organization database so your data can stay live, be refreshed daily and re-sliced. It's versioned and retained with atomic swaps — a strength, and we say so plainly rather than hiding it behind a blanket "no data at rest" claim.
Built for EU data-protection obligations; all data hosted in the EU.
Connectors cannot write back to HubSpot or Pipedrive.
Sample data to the model is never used to train it.
Full detail lives in our Privacy Policy and Terms.
Every figure traceable, every figure verified — and an honest "we can't tell" when that's the truth.