Encryption in Transit
VeloDB Cloud protects data in transit through protocol-level encryption. What applies to a given connection depends on the protocol and the connection method, and the design is the same on every supported cloud provider.
Protocol-Layer Encryption
Connections to the VeloDB Console use HTTPS. Protocol-level encryption for warehouse and integration channels varies by connection method. Loading from and exporting to object storage use HTTPS by default. Lakehouse access to external sources, Kafka ingestion, and CDC from PostgreSQL and MySQL support SSL when enabled. When enabled, warehouse TLS covers the MySQL protocol, JDBC, and Stream Load on warehouses running 26.0.5 or later in the 26.0.x release series, or 26.1.2 or later in the 26.1.x release series.
| Channel | Purpose | Protocol-level encryption |
|---|---|---|
| VeloDB Console | Browser-based access to VeloDB Cloud. | HTTPS |
| MySQL protocol | How users and applications connect to and query the warehouse. | TLS, on warehouses running 26.0.5 or later (26.0.x) or 26.1.2 or later (26.1.x), when enabled. |
| JDBC | How users and applications connect to the warehouse over JDBC. | TLS, on warehouses running 26.0.5 or later (26.0.x) or 26.1.2 or later (26.1.x), when enabled. |
| Lakehouse sources | Federated access to external sources such as JDBC-compatible databases and Iceberg. | SSL, depending on the data source |
| Load from object storage | Ingestion from object stores such as Amazon S3, Azure Blob Storage, and Google Cloud Storage. | HTTPS by default |
| Load from Kafka | Streaming ingestion through Routine Load. | SSL, when enabled |
| Load via CDC | VeloDB consumes change data from PostgreSQL and MySQL source databases through continuous load. | SSL, when enabled |
| Stream Load | HTTP-based ingestion. | TLS, on warehouses running 26.0.5 or later (26.0.x) or 26.1.2 or later (26.1.x), when enabled. |
| Export to object storage | Export to object stores such as Amazon S3, Azure Blob Storage, and Google Cloud Storage. | HTTPS by default |
To confirm whether TLS is enabled on your warehouse, contact VeloDB Support. A private network path limits which networks can reach the warehouse, and an IP allowlist restricts connection sources. Neither one provides protocol-level encryption on its own. See Network Security or BYOC Network Security.
Connection Paths
Transport encryption should be considered together with the network path used to reach the warehouse:
| Connection path | Security documentation |
|---|---|
| Public Link | Connection, Network Security |
| Private connectivity to a warehouse | Connection, Network Security |
| BYOC | BYOC Security Overview, Create BYOC Warehouse |