Encryption in Transit
VeloDB Cloud protects data in transit through protocol-level encryption. What applies to a given connection depends on the protocol and the connection method, and the design is the same on every supported cloud provider.
Protocol-Layer Encryption
Connections to the VeloDB Cloud console use HTTPS. Protocol-level encryption for warehouse and integration channels varies by connection method. Loading from and exporting to object storage use HTTPS by default. Lakehouse access to external sources, Kafka ingestion, and CDC from PostgreSQL and MySQL support SSL when enabled. Warehouse TLS covers the MySQL protocol, JDBC, and Stream Load. See TLS availability and enablement for version requirements and how to enable it.
| Channel | Purpose | Protocol-level encryption |
|---|---|---|
| VeloDB Cloud console | Browser-based access to VeloDB Cloud. | HTTPS |
| MySQL protocol | How users and applications connect to and query the warehouse. | TLS with VeloDB Core 26.1.3 or later; existing warehouses require enablement through a support ticket. |
| JDBC | How users and applications connect to the warehouse over JDBC. | TLS with VeloDB Core 26.1.3 or later; existing warehouses require enablement through a support ticket. |
| Lakehouse sources | Federated access to external sources such as JDBC-compatible databases and Iceberg. | SSL, depending on the data source |
| Load from object storage | Ingestion from object stores such as Amazon S3, Azure Blob Storage, and Google Cloud Storage. | HTTPS by default |
| Load from Kafka | Streaming ingestion through Routine Load. | SSL, when enabled |
| Load via CDC | VeloDB consumes change data from PostgreSQL and MySQL source databases through continuous load. | SSL, when enabled |
| Stream Load | HTTP-based ingestion. | TLS with VeloDB Core 26.1.3 or later; existing warehouses require enablement through a support ticket. |
| Export to object storage | Export to object stores such as Amazon S3, Azure Blob Storage, and Google Cloud Storage. | HTTPS by default |
TLS availability and enablement
TLS is supported for newly created warehouses running VeloDB Core 26.1.3 or later.
For an existing warehouse:
- Upgrade VeloDB Core to 26.1.3 or later if the warehouse is running an earlier version.
- Submit a support ticket to VeloDB Cloud Support requesting TLS enablement for the warehouse. Upgrading alone does not enable TLS on an existing warehouse.
- After TLS is enabled, open Connect and copy the current connection details. Follow Connection Methods to configure your client with the generated TLS settings.
For help with your request or to confirm whether TLS is enabled, contact VeloDB Cloud Support.
Note:
A private network path limits which networks can reach the warehouse, and an IP allowlist restricts connection sources. Neither one provides protocol-level encryption on its own. See Network Security or BYOC Network Security.
Connection Paths
Transport encryption should be considered together with the network path used to reach the warehouse:
| Connection path | Security documentation |
|---|---|
| Public Endpoint | Connect, Network Security |
| Private connectivity to a warehouse | Access VeloDB Cloud from Your VPC, Network Security |
| BYOC | BYOC Security Overview, Create BYOC Warehouse |