SECURITY
Enterprise Security. From Day 1, Not Phase 3.
HatiData deploys inside YOUR VPC. Your encryption keys. Your network. Your audit trail. We never see your data.
ARCHITECTURE
Your VPC. Your Data. Always.
Every component runs inside your AWS account. The only external connection is an AWS PrivateLink to our control plane.
Postgres wire-compatible proxy. TLS 1.3. Handles auth, RBAC, column masking, and SQL transpilation.
Single-tenant analytical engine. In-process with the proxy -- no network hop. Columnar execution.
Dedicated NVMe SSD for hot data. AES-256-XTS encrypted with your CMEK. Two-tier L1/L2 cache.
Apache Iceberg tables in your S3 buckets. SSE-KMS encrypted. Zero vendor lock-in.
Customer-managed encryption keys. Controls encryption for NVMe cache, S3 storage, and audit logs. You own the keys.
Encrypts NVMe + S3 + Audit Logs
Manages configuration, billing, and updates. Never sees your data. Connected via AWS PrivateLink only.
Config, billing, updates only. Never sees your data.
ENCRYPTION
Encrypted at Every Layer
Six layers of encryption from client to storage. Your keys, your control.
| Layer | Protocol | Key Management |
|---|---|---|
Client → Proxy | TLS 1.3 | Auto-rotated certificates |
Proxy → DuckDB | In-process | N/A (same process) |
NVMe Cache | LUKS AES-256-XTS | Customer CMEK via KMS |
S3 Storage | SSE-KMS (AES-256) | Customer CMEK via KMS |
Audit Logs | SSE-KMS + Object Lock | Customer CMEK via KMS |
Control Plane Link | PrivateLink (TLS 1.3) | AWS-managed |
COMPLIANCE
From Deploy to SOC 2 in 180 Days
A clear path to full compliance, starting from the moment you deploy.
Deploy In-VPC
HatiData runs in your AWS account. Your existing SOC 2 controls cover the data plane.
Security Review
Architecture review with your security team. SIG Lite questionnaire completed.
Shadow Mode Complete
7-day comparison report delivered. Full compatibility matrix.
Production Ready
Cutover from legacy warehouse. All audit trails active.
SOC 2 Type I
HatiData control plane SOC 2 Type I report available.
SOC 2 Type II
Type II observation period complete. Full report available.
GOVERNANCE
CISO Approval Checklist
Everything your security team needs to say yes.
- Data never leaves your VPC
- Customer-managed encryption keys (CMEK)
- Zero public internet traversal (PrivateLink)
- Immutable query audit logs (S3 Object Lock, 7yr retention)
- Role-based access control with column masking
- SOC 2 Type II (in progress, Day 180)
- DPA/MSA/BAA templates available
WHITEPAPER
Download the Security Whitepaper
Full technical deep-dive: encryption architecture, network topology, compliance controls, and audit trail design.
HatiData Security Whitepaper
PDF · 24 pages
Your CISO Will Thank You.
In-VPC deployment. CMEK encryption. PrivateLink. Immutable audit logs. Security that's built in, not bolted on.