Skip to main content

Security & Compliance

Your data is your most valuable asset. dbdeux is built from the ground up with enterprise-grade security to protect it.

Data Handling Principles​

Your Data Stays in Your Warehouse​

dbdeux operates on a metadata-only architecture:

  • All queries execute directly in your warehouse
  • Query results are streamed to your browser, not stored on our servers
  • We store only metadata: schema information, run status, row counts, and lineage graphs
  • If you delete your dbdeux account, there is no residual data to clean up

Zero Data Residency​

Unlike tools that cache or replicate your data, dbdeux has no data stores containing your business data. This simplifies:

  • Compliance: No additional data processing agreements needed for your warehouse data
  • Data governance: Your existing warehouse access controls remain the single source of truth
  • Auditing: All data access goes through your warehouse's native audit logs

Authentication & Access Control​

Single Sign-On (SSO)​

dbdeux supports enterprise SSO through:

  • Google Workspace (OAuth 2.0)
  • SAML 2.0 (any compliant identity provider)

Role-Based Access Control (RBAC)​

Fine-grained permissions control who can do what:

RoleCapabilities
ViewerView models, DAG, and run history. Cannot edit or execute
MemberEdit models, run builds, and use platform features within the org budget
AdminManage connections, environments, team members, and billing
OwnerFull access including destructive actions and SSO configuration

Two-Factor Authentication (2FA)​

Additional security layer available for all accounts, with enforcement options for organizations that require it.

Credential Security​

Warehouse Credentials​

Your warehouse connection details are protected with multiple layers:

  • Encrypted at rest with AES-256 encryption
  • Encrypted in transit with TLS 1.3
  • Access-controlled by role (only Admins can view/modify connections)
  • Never logged in plain text in any system
  • Rotatable without downtime (update credentials and test without interrupting active runs)

Secret Management​

All secrets are stored in a dedicated, hardened secrets management service:

  • Secrets are never exposed in application logs
  • Access to secrets is audited
  • Secrets are injected at runtime only into isolated compute containers

Network Security​

Encryption in Transit​

All communication is encrypted:

  • Browser ↔ dbdeux: TLS 1.3
  • dbdeux ↔ Your Warehouse: TLS (version depends on warehouse support)
  • Internal service communication: mTLS (mutual TLS)

Static Egress IPs​

All connections to your warehouse originate from known, static IP addresses:

  • Predictable for firewall/allowlist configuration
  • Documented and stable (we notify before any IP changes)
  • See IP Allowlist guide for setup

No Inbound Access Required​

dbdeux never needs inbound access to your network. All connections are outbound from our platform to your warehouse. No VPN tunnels, no reverse proxies, no network changes needed.

Compliance​

SOC 2 Type II​

dbdeux maintains SOC 2 Type II compliance, covering:

  • Security
  • Availability
  • Confidentiality

GDPR​

For organizations subject to GDPR:

  • Data Processing Agreement (DPA) available on request
  • No personal data stored beyond what is necessary for account management
  • Right to erasure fully supported
  • Data residency options available (US, EU)

Audit Logging​

Every significant action is logged:

  • User logins and logouts
  • Connection creation and modification
  • Run executions (who, what, when)
  • Permission changes
  • Configuration modifications

Audit logs are retained for 12 months and can be exported for external compliance tools.

Infrastructure Security​

  • Cloud-native deployment on enterprise-grade cloud infrastructure
  • Auto-scaling with no single points of failure
  • Automated security patching for all platform components
  • Regular penetration testing by independent security firms
  • Bug bounty program for responsible vulnerability disclosure

Responsible Disclosure​

If you discover a security vulnerability, please report it to security@dbdeux.io. We respond within 24 hours and work with reporters to resolve issues before public disclosure.