Security Overview

DataNature is built with enterprise-grade security from the ground up. Your data and workloads are protected through tenant isolation, encryption, strong authentication, role-based access control, and sovereign deployment options.

Sovereign Data Platform

DataNature is a sovereign data platform — your data stays in your cloud, your country, and under your control:

• Public Cloud — AWS, Azure, GCP, OVHcloud with region-specific deployments
• Private Cloud — Deploy on your private cloud infrastructure, including Ncell Private Cloud for Nepal data sovereignty
• Hybrid Cloud — Combine on-premises and cloud resources for maximum flexibility
• On-Premises — Full deployment in your own data center with complete infrastructure control
• Airgap Deployment — Completely isolated environments with zero external connectivity, ideal for government and highly regulated industries

You choose where your platform runs. DataNature does not require data to leave your chosen infrastructure.

Tenant Isolation

Each workspace is fully isolated:

• Dedicated compute — Your workloads run on dedicated resources, not shared with other tenants
• Dedicated storage — Object storage and data warehouse are per-workspace
• Logical separation — No cross-tenant data access or visibility

Your data stays yours. DataNature does not use your data for training models or sharing with other customers.

Open Data Formats — No Vendor Lock-in

Your data is always stored in open formats that you own:

• Apache Iceberg (default) — Open table format with schema evolution and time travel
• Delta Lake (optional) — ACID transactions with schema enforcement
• Apache Hudi (optional) — Upserts and incremental processing

If you ever leave DataNature, your data comes with you in standard, portable formats.

Encryption

• At rest — All data is encrypted using AES-256
• In transit — All connections use TLS 1.2 or higher

Encryption is applied by default. No configuration required.

Secrets Management

DataNature uses HashiCorp Vault for enterprise-grade secrets management:

• Centralized secrets storage — All sensitive credentials (database passwords, API keys, S3 credentials) are stored in Vault's KV v2 engine with versioning and soft-delete
• Transit encryption — Data-at-rest encryption using Vault's Transit engine with per-tenant encryption keys, enabling encryption-as-a-service without exposing keys to applications
• Dynamic database credentials — Short-lived, automatically rotated database credentials reduce the blast radius of credential compromise
• Per-tenant secret isolation — Each tenant's secrets are stored in isolated Vault paths with tenant-scoped policies, preventing cross-tenant access
• Audit trail — Every secret access, modification, and administrative action is logged with full attribution for compliance and forensic analysis

Vault integrates with the platform's identity provider (Keycloak) for OIDC-based authentication, and with Kubernetes for service-to-service access.

Authentication

• Single Sign-On (SSO) — Integrate with Google, SAML 2.0, or OpenID Connect
• Multi-Factor Authentication (MFA) — Supported for additional account security
• API tokens — For programmatic access with scoped permissions
• Enterprise IdP integration — Active Directory, Okta, and other leading identity providers

Authorization

Role-based access control (RBAC) is enforced across all tools:

• Admin, Developer, and Viewer roles
• Permissions apply consistently in Superset, Trino, Airflow, Spark, and other tools
• Workspace admins control user access and roles

Compliance

DataNature is designed to support:

• SOC 2 Type II — Readiness for service organization controls
• ISO 27001 — Alignment with international security management standards
• GDPR — Data handling practices for EU data protection
• Data sovereignty — Deploy in-country to meet local data residency requirements

Compliance documentation is available to Enterprise customers upon request.

Network Security

• Private networking — Options for private connectivity to your infrastructure
• IP allowlisting — Restrict access by IP (Enterprise)
• Secure endpoints — All access over HTTPS with certificate validation
• VPC-ready — Private endpoints and environment separation (dev/test/prod)

Audits and Testing

• Regular security audits — Internal and third-party assessments
• Penetration testing — Periodic testing of platform security
• Vulnerability management — Prompt patching and updates

For specific compliance or security questions, contact [email protected] or your account team.