Security & Data Residency
Where your data lives
Section titled “Where your data lives”DataRecs runs on Cells — independent, fully-portable Kubernetes clusters that each hold the full platform stack (database, messaging, object storage, secrets, compute). Cells currently run in:
| Cell | Location |
|---|---|
| Hetzner | Falkenstein, Germany |
| Civo | London, UK |
Your tenant is assigned to a single Cell; your data does not move between Cells or regions without your knowledge.
Tenant isolation
Section titled “Tenant isolation”Every tenant is isolated across every layer of the platform:
- Database — your data lives in a dedicated PostgreSQL schema, with dynamically-provisioned, per-tenant database credentials.
- Messaging — each tenant has its own cryptographically-isolated messaging account; tenants can only ever see their own events.
- Object storage — each tenant has a dedicated storage bucket with scoped API keys that can only access that bucket.
- Compute (Kubernetes) — each tenant runs in its own namespace with network policies restricting egress to only that tenant’s own storage, messaging, and configured data sources.
- Encryption — all confidential data is envelope-encrypted with tenant-scoped encryption keys, managed in our secrets store.
Encryption
Section titled “Encryption”All connection credentials and other confidential data are envelope-encrypted at rest — the encryption key for one tenant is never used for another tenant’s data. By default, DataRecs manages the encryption keys. If you need to hold your own key, see Bring Your Own Key (Google Cloud KMS).
Bring your own storage
Section titled “Bring your own storage”If you need your reconciliation artifacts (extracted data, comparison results) to live in storage you control, see Bring Your Own Storage (Google Cloud Storage).
Compliance
Section titled “Compliance”DataRecs does not yet hold any third-party security certifications (no SOC 2, HIPAA, or FedRAMP attestation today). We are working towards SOC 2. If a specific certification is a requirement for your organization, talk to us about timelines.
Subprocessors
Section titled “Subprocessors”For a current list of subprocessors, contact your account team or open a support request.
Next steps
Section titled “Next steps”- Bring Your Own Key
- Bring Your Own Storage
- Managing API Keys — the permission model for programmatic access.