Skip to main content

Security Features

VeloDB Cloud provides security capabilities for resource isolation, identity and access management, encryption, network controls, and auditing. The available controls and their scope depend on the deployment and access path.

Security Capabilities​

VeloDB Cloud provides security capabilities across the following dimensions:

  • Resource isolation: Isolate storage and compute resources between organizations.
  • Identity authentication: Verify the identity of each user or application.
  • Access control: Manage access to data through fine-grained permissions.
  • Data protection: See Encryption at Rest and Encryption in Transit for supported paths and protocols.
  • Network security: See Network Security for deployment-specific connectivity controls.
  • Security auditing: See Audit Logging for supported organization and warehouse audit records.
  • Application security: Protect cloud applications with cloud firewalls, a web application firewall (WAF), and database auditing.

Resource Isolation​

SaaS deployment

VeloDB Cloud isolates organizations at the storage and compute layers.

Data storage

  1. Each organization uses a separate object storage bucket in each region. The bucket is private and uses Security Token Service (STS) authentication.
  2. Each warehouse has its own cloud IAM role, and only that role can access the warehouse's data in object storage.
  3. Cache data is stored on local cluster disks and is isolated between warehouses.

Compute resources

  1. Each cluster belongs to a single warehouse and is not shared across warehouses.
  2. Security group rules prevent clusters in different organizations from connecting to one another.

BYOC deployment

In a VeloDB Cloud BYOC deployment, warehouse compute and customer warehouse storage run in your cloud environment. This placement applies to the customer data plane. It does not mean that all control-plane metadata, operational telemetry, logs, support records, diagnostics, query-related records, access evidence, or other operational records remain in your environment.

Data storage

Customer warehouse storage is deployed in your cloud environment and governed by the BYOC deployment model and your cloud-provider configuration.

Compute resources

  1. Warehouse compute resources run in your cloud resource pool and provide data warehouse services.
  2. A warehouse can contain multiple clusters that share the same underlying data. Separate clusters can serve reporting, interactive analytics, and other workloads without competing for compute resources.

Identity Authentication​

All access to the VeloDB Cloud control plane or data plane requires authentication. The control plane supports multi-factor authentication (MFA). The data plane authenticates MySQL-protocol and HTTP connections, supports IP allowlists and blocklists, and enforces password policies and protections against brute-force attacks.

For details, see Identity and Access.

Access Control​

VeloDB Cloud separates console access (organization roles), management API access (API keys), and warehouse access (database users). Inside a warehouse, access follows the MySQL-style permission model with role-based access control (RBAC), object-level privileges, and fine-grained row-level, column-level, and masking controls. For the access model and role details, see Identity and Access. For row policy, view, and masking syntax, see Data Access Control.

Data Protection​

Storage Encryption

Stored data is protected in two layers: the storage layer (cloud object storage and cache disks encrypted by the cloud platform with cloud-managed keys) and an optional warehouse layer (Transparent Data Encryption, which you can back with a customer-managed KMS key). For details, see Encryption at Rest.

Transmission Encryption

Connections to the VeloDB Console use HTTPS. Object storage load and export (Amazon S3, Azure Blob Storage, and Google Cloud Storage) use HTTPS by default, and lakehouse access, Kafka, and CDC from PostgreSQL and MySQL support SSL when enabled. For current availability of protocol-level encryption for the MySQL protocol, JDBC, and Stream Load, contact VeloDB Support. For details, see Encryption in Transit.

High availability, backup, and disaster recovery are covered separately under Reliability.

Network Security​

Under the principle of least privilege, VeloDB restricts VPC network rules: external access goes through the gateway, operations access goes through VPN, and organizations are isolated from each other. Warehouses can be reached over the public network (restricted by IP allowlist) or over a private network connection scoped to a single VPC.

For access methods, IP allowlists, PrivateLink, and BYOC network placement, see Network Security.

Security Auditing​

Console and control-plane operations, as well as warehouse access, are audited. You can review audit information in the VeloDB Console. For organization activity logs, query audits, and the audit_log table, see Audit Logging.

Application Security​

VeloDB uses cloud firewalls, a web application firewall (WAF), and database auditing to protect its cloud applications.