Enterprise-Grade
Security by Default

Keboola provides comprehensive audit capabilities: Complete audit trails with all user actions, data changes, job executions, and configuration modifications logged with timestamps and user attribution. Telemetry data includes job execution details, data flows, schema evolution, and operational metadata available for compliance reporting. Support access is controlled—engineers must request access through the platform and project administrators receive notifications to approve or reject requests. When approved, support access is granted with full audit logging and configurable auto-join policies. Organizations can disable auto-join to require explicit invitations for all access. Learn more at keboola.com/product/security

Keboola provides multi-region deployment options across three major cloud providers. Available regions include: United States (AWS US Virginia, GCP US Virginia), European Union (AWS EU Frankfurt, Azure EU Ireland, GCP EU Frankfurt), and Custom regions (single-tenant deployments in any region supported by the cloud provider). For EU data protection, sub-processors are contractually bound to EU processing. BYODB deployments give customers direct control over data residency since data resides in customer-owned databases. Learn more at keboola.com/dpa and security.keboola.com

Keboola implements multi-layered access controls: Role-Based Access Control (RBAC) with granular bucket-level permissions including Share, Admin, Guest, Developer, and Reviewer roles. Single Sign-On (SAML) integration with Active Directory, Azure AD, Google Authentication, and other providers. Multi-Factor Authentication (MFA) supporting authenticator apps (TOTP) and hardware security keys (FIDO/U2F)—administrators can enforce MFA for all users. Token-based authorization with short-lived tokens having specific scopes for automated processes, restricted to specific buckets or operations. Brute force protection includes CAPTCHA verification after 10 failed login attempts within 5 minutes. Learn more at keboola.com/product/security

Keboola's security architecture adapts to three deployment models: Multi-tenant SaaS with network isolation between tenants, encrypted storage, and access controls available in AWS (US, EU), Azure (EU), and GCP (US, EU), with VPC deployment options for Enterprise. Single-tenant deployment places the complete Keboola stack within customer's cloud environment for maximum control, custom security policies, custom domains, and direct Active Directory integration. BYODB (Bring Your Own Database) keeps customer data in customer-owned Snowflake or BigQuery instances while Keboola orchestrates but never stores customer data on Keboola infrastructure. All deployment models maintain full audit logging and Docker containerization. Learn more at help.keboola.com/storage/byodb/

Keboola implements defense-in-depth encryption at multiple layers. Data at rest uses AES-256 encryption through AWS KMS, Azure Key Vault, and Google Cloud KMS with all stored data—Snowflake tables, file storage, configuration values—remaining encrypted. Data in transit uses TLS 1.2+ (HTTPS) for all API communications, web interface access, and component data transfers. Application-level encryption protects sensitive configuration values prefixed with # by automatically encrypting before storage. No decryption API exists for end users—encrypted values only decrypt during component execution. Ciphers are region-locked and cannot transfer between deployments. Learn more at developers.keboola.com/overview/encryption/

Keboola maintains enterprise-grade security certifications: SOC 2 Type II annual certification demonstrating ongoing operational effectiveness of security controls available through the Trust Center. GDPR Compliance maintained since May 2018 with comprehensive Data Processing Agreement (DPA) and Standard Contractual Clauses. HIPAA Compliance available for healthcare organizations in the Enterprise tier. Cloud infrastructure partners (AWS, Azure, GCP) maintain ISO 27001, CSA STAR, and other certifications. Sub-processors are contractually bound to process data only in approved regions. The Trust Center provides access to compliance documentation, vulnerability disclosure policies, and bug bounty program. Learn more at security.keboola.com