Security & Compliance

Your data is your most valuable asset. dbdeux is built from the ground up with enterprise-grade security to protect it.

Data Handling Principles

Your Data Stays in Your Warehouse

dbdeux operates on a metadata-only architecture:

• All queries execute directly in your warehouse
• Query results are streamed to your browser, not stored on our servers
• We store only metadata: schema information, run status, row counts, and lineage graphs
• If you delete your dbdeux account, there is no residual data to clean up

Zero Data Residency

Unlike tools that cache or replicate your data, dbdeux has no data stores containing your business data. This simplifies:

• Compliance: No additional data processing agreements needed for your warehouse data
• Data governance: Your existing warehouse access controls remain the single source of truth
• Auditing: All data access goes through your warehouse's native audit logs

Authentication & Access Control

Single Sign-On (SSO)

Sign-in to dbdeux goes through Datalakehouse single sign-on. There is no separate dbdeux password to create, rotate, or leak, and a user who is already signed in to another Datalakehouse product is authenticated silently rather than re-entering credentials.

Access is revoked centrally: remove someone from your identity provider and they lose dbdeux with everything else. For federating your own corporate identity provider, contact support@dbdeux.io.

Role-Based Access Control (RBAC)

Fine-grained permissions control who can do what:

Role	Capabilities
Viewer	View models, DAG, and run history. Cannot edit or execute
Member	Edit models, run builds, and use platform features within the org budget
Admin	Manage connections, environments, team members, and billing
Owner	Full access including destructive actions and SSO configuration

Sessions Expire Without Losing Your Work

Sessions are time-limited, and staying signed in forever is not a security posture. What matters is how the expiry is handled.

While you are actively working, your session is kept alive, so you are not signed out part way through something you are typing. If a session does expire, dbdeux does not throw you back to the sign-in screen without warning. It shows an Are you still working? prompt with a countdown, and Continue working signs you back in and returns you to the same page. If your organization session is still active, that is a single silent round trip with nothing to retype. A tab left idle overnight does the same on its own: it signs back in quietly, keeps the workspace you had selected, and the editor, worksheets, and a running job's live log all carry on where they were.

The countdown is honest about the alternative: if it runs out, you are signed out completely and taken to the sign-in screen, and a Sign out button on the prompt lets you choose that immediately on a shared machine. Signing out this way ends the session everywhere, not just in the tab, so the next person at that keyboard starts from a clean sign-in. The window before it runs out is your chance to copy anything unsaved out of an open dialog first, which is exactly what an abrupt redirect takes away.

Signing in also takes you where you were going. Open a link to a job run, a catalog object, or a Semantic Layer definition while signed out, and after you sign in you land on that page rather than a default home page. Shared links behave the way people expect them to, whether the recipient happens to be signed in or not.

The prompt is reserved for your own session. A Git provider rejecting a stored credential, or a share link that needs its own sign-in, is a different problem with a different fix, so it is reported where it happened rather than as a session warning, and it never signs you out.

Two-Factor Authentication (2FA)

Additional security layer available for all accounts, with enforcement options for organizations that require it.

Credential Security

Warehouse Credentials

Your warehouse connection details are protected with multiple layers:

• Encrypted at rest with AES-256 encryption
• Encrypted in transit with TLS 1.3
• Access-controlled by role (only Admins can view/modify connections)
• Never logged in plain text in any system
• Rotatable without downtime (update credentials and test without interrupting active runs)

Secret Management

All secrets are stored in a dedicated, hardened secrets management service:

• Secrets are never exposed in application logs
• Access to secrets is audited
• Secrets are injected at runtime only into isolated compute containers

Network Security

Encryption in Transit

All communication is encrypted:

• Browser ↔ dbdeux: TLS 1.3
• dbdeux ↔ Your Warehouse: TLS (version depends on warehouse support)
• Internal service communication: mTLS (mutual TLS)

Static Egress IPs

All connections to your warehouse originate from known, static IP addresses:

• Predictable for firewall/allowlist configuration
• Documented and stable (we notify before any IP changes)
• See IP Allowlist guide for setup

No Inbound Access Required

dbdeux never needs inbound access to your network. All connections are outbound from our platform to your warehouse. No VPN tunnels, no reverse proxies, no network changes needed.

Compliance

SOC 2 Type II

dbdeux maintains SOC 2 Type II compliance, covering:

• Security
• Availability
• Confidentiality

GDPR

For organizations subject to GDPR:

• Data Processing Agreement (DPA) available on request
• No personal data stored beyond what is necessary for account management
• Right to erasure fully supported
• Data residency options available (US, EU)

Audit Logging

Every significant action is logged:

• User logins and logouts
• Connection creation and modification
• Run executions (who, what, when)
• Permission changes
• Configuration modifications

Audit logs are retained for 12 months and can be exported for external compliance tools.

Infrastructure Security

• Cloud-native deployment on enterprise-grade cloud infrastructure
• Auto-scaling with no single points of failure
• Automated security patching for all platform components
• Regular penetration testing by independent security firms
• Bug bounty program for responsible vulnerability disclosure

Responsible Disclosure

If you discover a security vulnerability, please report it to security@dbdeux.io. We respond within 24 hours and work with reporters to resolve issues before public disclosure.