Enterprise-Grade
Security by Default

Keboola provides comprehensive audit capabilities:

• Complete audit trails: All user actions, data changes, job executions, and configuration modifications are logged with timestamps and user attribution
• Telemetry data: Job execution details, data flows, schema evolution, and operational metadata available for compliance reporting
• Controlled support access: Keboola support engineers must request access through the platform; project administrators receive notifications and can approve or reject requests
• Time-limited access: When approved, support access is granted with full audit logging and configurable auto-join policies
• Customer-controlled: Organizations can disable auto-join to require explicit invitations for all access

Learn more at keboola.com/product/security

Keboola provides multi-region deployment options across three major cloud providers:

Available regions:

• United States: AWS US Virginia, GCP US Virginia
• European Union: AWS EU Frankfurt, Azure EU Ireland, GCP EU Frankfurt
• Custom regions: Single-tenant deployments in any region supported by the cloud provider

For EU data protection, sub-processors (AWS EMEA SARL, Microsoft Ireland Operations, Google Cloud EMEA Ltd.) are contractually bound to EU processing.

BYODB deployments give customers direct control over data residency since data resides in customer-owned databases.

Learn more at keboola.com/dpa | security.keboola.com

Keboola implements multi-layered access controls:

• Role-Based Access Control (RBAC): Granular bucket-level permissions with roles including Share, Admin, Guest, Developer, and Reviewer
• Single Sign-On (SSO): SAML integration with Active Directory, Azure AD, Google Authentication, and other providers
• Multi-Factor Authentication (MFA): Authenticator apps (TOTP) and hardware security keys (FIDO/U2F)—administrators can enforce MFA for all users
• Token-based authorization: Short-lived tokens with specific scopes for automated processes, restricted to specific buckets or operations
• Brute force protection: CAPTCHA verification after 10 failed login attempts within 5 minutes

Learn more at keboola.com/product/security

Keboola's security architecture adapts to three deployment models:

• Multi-tenant SaaS: Network isolation between tenants, encrypted storage, access controls. Available in AWS (US, EU), Azure (EU), and GCP (US, EU). VPC deployment options available for Enterprise.
• Single-tenant deployment: Complete Keboola stack within customer's cloud environment—maximum control, custom security policies, custom domains, direct Active Directory integration
• BYODB (Bring Your Own Database): Customer data stays in customer-owned Snowflake or BigQuery instances. Keboola orchestrates but never stores customer data on Keboola infrastructure.

All deployment models maintain full audit logging and Docker containerization ensuring components run in isolated environments.

Learn more at help.keboola.com/storage/byodb

Keboola implements defense-in-depth encryption at multiple layers:

Data at rest:

• AES-256 encryption through AWS KMS, Azure Key Vault, and Google Cloud KMS
• All stored data—Snowflake tables, file storage, configuration values—remains encrypted

Data in transit:

• TLS 1.2+ (HTTPS) for all API communications, web interface access, and component data transfers

Application-level encryption:

• Sensitive configuration values prefixed with # are automatically encrypted before storage
• No decryption API exists for end users—encrypted values only decrypted during component execution
• Ciphers are region-locked and cannot transfer between deployments

Learn more at developers.keboola.com/overview/encryption

Keboola maintains enterprise-grade security certifications:

• SOC 2 Type II: Annual certification demonstrating ongoing operational effectiveness of security controls—available through the Trust Center
• GDPR Compliance: Maintained since May 2018 with comprehensive Data Processing Agreement (DPA) and Standard Contractual Clauses
• HIPAA Compliance: Available for healthcare organizations in the Enterprise tier

Cloud infrastructure partners (AWS, Azure, GCP) maintain ISO 27001, CSA STAR, and other certifications. Sub-processors are contractually bound to process data only in approved regions.

The Trust Center provides access to compliance documentation, vulnerability disclosure policies, and bug bounty program.

Learn more at security.keboola.com