Encryption in Transit
VeloDB Cloud protects data in transit through protocol-level encryption. What applies to a given connection depends on the protocol and the connection method, and the design is the same on every supported cloud provider.
Protocol-Layer Encryption
Connections to the VeloDB Console use HTTPS. Protocol-level encryption for warehouse and integration channels varies by connection method. Loading from and exporting to object storage use HTTPS by default. Lakehouse access to external sources, Kafka ingestion, and CDC from PostgreSQL and MySQL support SSL when enabled. For the current availability of protocol-level encryption for the MySQL protocol, JDBC, and Stream Load, contact VeloDB Support.
| Channel | Purpose | Protocol-level encryption |
|---|---|---|
| VeloDB Console | Browser-based access to VeloDB Cloud. | HTTPS |
| MySQL protocol | How users and applications connect to and query the warehouse. | Contact VeloDB Support for current availability. |
| JDBC | How users and applications connect to the warehouse over JDBC. | Contact VeloDB Support for current availability. |
| Lakehouse sources | Federated access to external sources such as JDBC-compatible databases and Iceberg. | SSL, depending on the data source |
| Load from object storage | Ingestion from object stores such as Amazon S3, Azure Blob Storage, and Google Cloud Storage. | HTTPS by default |
| Load from Kafka | Streaming ingestion through Routine Load. | SSL, when enabled |
| Load via CDC | VeloDB consumes change data from PostgreSQL and MySQL source databases through continuous load. | SSL, when enabled |
| Stream Load | HTTP-based ingestion. | Contact VeloDB Support for current availability. |
| Export to object storage | Export to object stores such as Amazon S3, Azure Blob Storage, and Google Cloud Storage. | HTTPS by default |
For MySQL protocol, JDBC, and Stream Load, confirm protocol-level encryption availability with VeloDB Support. A private network path limits which networks can reach the warehouse, and an IP allowlist restricts connection sources. Neither one provides protocol-level encryption on its own. See Network Security.
Connection Paths
Transport encryption should be considered together with the network path used to reach the warehouse:
| Connection path | Security documentation |
|---|---|
| Public Link | Connection, Network Security |
| PrivateLink | Connection, Network Security |
| BYOC | BYOC Security, Create BYOC Warehouse |