Snapshot 218094
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Skip to main content The security of our systems is of the utmost importance. We consistently aim to improve our security posture by building security into every layer of our products. Below is a breakdown of common security and compliance requirements by PlanetScale plan: Base plan Enterprise multi-tenant Enterprise single-tenant PlanetScale Managed Encryption of data (at rest and in transit) SOC 1 Type 2 available SOC 2 Type 2+ HIPAA available IP restrictions (Vitess only) Audit logs Security logs Data Processing Addendum available Private database connectivity Single sign-on (SSO) Available as add-on Available as add-on Available as add-on Available as add-on Business Associate Agreements available Dedicated AWS/GCP/Azure account PCI compliant Your own AWS/GCP/Azure account Available on all PlanetScale plans Private database connectivity By default, all PlanetScale connections are encrypted and routed through the public Internet. Optionally, you can connect privately to databases through AWS PrivateLink or GCP Private Service Connect. SOC 1 Type 2 & SOC 2 Type 2+ HIPAA PlanetScale continuously monitors and reports primarily using System and Organization Controls (SOC) 1 & 2 Type 2 paired with the HIPAA Security Rule. To request access to our latest reports, please visit PlanetScale’s Trust Center. HIPAA and Business Associate Agreements PlanetScale can enter into Business Associate Agreements (BAAs) with customers who meet qualifying criteria. To request a BAA: Sign into the PlanetScale dashboard Click “Settings” from your Organization page > “Legal” > “Create request” Fill out the form We will review your request and let you know if it’s approved Once approved, you’ll receive a Docusign sent to the email you specified as the signer The customer must determine whether they are a Covered Entity — or a Business Associate of a Covered Entity — as defined under HIPAA. If so, the customer may require a BAA with PlanetScale for the purposes of our relationship. Responsibility around HIPAA compliance between PlanetScale and the customer is implemented using a shared responsibility model. While PlanetScale plans provide a secure and compliant infrastructure for the storage and processing of Protected Health Information (PHI), the customer is ultimately responsible for ensuring that the environment and applications that they build on top of PlanetScale are properly configured and secured according to HIPAA requirements. The Department of Health and Human Services does not recognize any formal certification for HIPAA. PlanetScale systems, software, networks, and procedures are consistent with the controls outlined in the relevant rules. Data security Encryption of data PlanetScale databases and their client communications are AES encrypted throughout the PlanetScale platform, both in transit and at rest. At rest Data is encrypted at rest on the underlying storage media that serves database branches and also the underlying storage media that hosts your PlanetScale database backups. This helps mitigate the risk of unintentional or malicious access to user data on storage systems. In transit Data in transit to PlanetScale databases is encrypted and goes through three major paths: The PlanetScale CLI, leverages TLS when initiating a connection to PlanetScale’s API and Edge. PlanetScale connection strings require the successful establishment of a TLS session before any SQL commands can be issued. TLS is used to secure all data transmitted between PlanetScale and clients using PlanetScale Connect. All public PlanetScale endpoints use post-quantum key exchange with clients that support it. Additional data protection controls Communications to the PlanetScale API and Dashboard are encrypted using TLS 1.3 with support for post-quantum key exchange. Certificates are issued by established third-party certificate authorities. General Data Protection Regulation (GDPR) PlanetScale offers database services in Amazon Web Services, Google Cloud Platform, and Microsoft Azure regions around the world. PlanetScale complies with the EU General Data Protection Regulation (GDPR) and other global privacy regulations, where applicable. Customers are responsible for their applications’ compliance with regulatory requirements, including as they relate to data subjects of their systems. Data Processing Addendum All PlanetScale plans are covered by our Data Processing Addendum (DPA). Markups are accepted for addendums on all PlanetScale Enterprise plans. Contact us to talk more about PlanetScale Enterprise plans and changes to our DPA. Data locality The infrastructure supporting user databases, backups, etc., is in the provider (AWS, GCP, or Azure) and region where the database is created. Any read-only replicas in other geographies will copy the data set to the selected regions. The following are two examples of data locality in PlanetScale: If you create a database in a US-based region, all data, including customer data, is stored and processed in the US, except in cases where sub-processors are identified as having other locations. If you create a database in a Europe-based region, your data does not leave the region the database was created in, unless you create a read-only region in another region. Available on all Enterprise plans Additional audit logging features In addition to the audit log feature available to all PlanetScale plans, Enterprise plans can use our EventBridge configuration to send logs to your AWS account. Ask your PlanetScale account manager for more information on how to set it up. If you have any questions or concerns related to the security and compliance of any PlanetScale Enterprise plans, please contact us, and we will be happy to discuss them further. Available on Enterprise single-tenant plans PlanetScale offers two single-tenant deployment options: Single-tenant and PlanetScale Managed for organizations that require a single-tenant environment. See the section below for more information on PlanetScale Managed-only security and compliance features. Contact us if you are interested in exploring PlanetScale single-tenant deployment options for your organization. Dedicated AWS Organizations member account, GCP organization, or Azure subscription PlanetScale single-tenant deployment options are deployed into a dedicated AWS Organizations member account, GCP organization, or Azure subscription owned by PlanetScale. If you want PlanetScale to deploy into your own AWS Organizations member account, GCP organization, or Azure subscription, owned by your organization, see PlanetScale Managed below. Available on PlanetScale Managed PlanetScale Managed is a single-tenant deployment of PlanetScale within your Amazon Web Services (AWS), Google Cloud Platform (GCP), or Microsoft Azure account. In this configuration, you can use the same API, CLI, and web interface that PlanetScale offers, with the benefit of running entirely in your own AWS Organizations member account, GCP organization, or Azure subscription. You can learn more on the PlanetScale Managed overview page. Deploy in your own AWS, GCP, or Azure account PlanetScale Managed is a packaged data plane that’s deployed to an AWS Organizations member account, GCP project, or Azure subscription that you own and we operate. Your database lives entirely inside a dedicated account, project, or subscription within your cloud organization. PlanetScale will not have access to other accounts, projects, or subscriptions nor your organization-level settings within the cloud service provider. Read more about PlanetScale Managed on each cloud provider: PlanetScale Managed on Amazon Web Services PlanetScale Managed on Google Cloud Platform PlanetScale Managed on Microsoft Azure PCI compliance PlanetScale Managed, when deployed with the appropriate controls enabled via our Shared Responsibility Matrix, has been issued an Attestation of Compliance (AoC) and Report on Compliance (RoC), certifying our compliance with the PCI DSS 4.0 as a Level 1 Service Provider. This enables PlanetScale Managed to be used via a shared responsibility model across merchants, acquirers, issuers, and other roles in storing and processing cardholder data. Human access flow PlanetScale Managed supports customer counter-approval for access to Managed environment(s) by PlanetScale employees via an integration in the web application. Talk to your Customer Engineer about enabling this feature. Other PlanetScale Managed security features PlanetScale Managed on AWS also supports: Fully private network isolation Third-account customer-controlled public key infrastructure (PKI) Corporate security Background checks Background checks are performed on new team members during onboarding (within 30 days of their start date) as permitted by local law. Security training All team members complete security awareness training covering company security policies and procedures during onboarding (within 30 days of their hire date). Trainings are required annually after that for all employees. The training material is designed to assist the employee in identifying and responding to social engineering and other cybersecurity risks they may encounter as part of their role at PlanetScale. Security operations Endpoints All company-provided devices are managed with Kandji. Device configuration is based on the Center for Internet Security (CIS) level 1 benchmark and is continuously enforced. Mobile device management deploys and enables relevant services to ensure corporate endpoints are appropriately monitored. Extended Detection and Response (XDR) PlanetScale administrative endpoints, such as devices used by employees, are monitored via endpoint detection and response systems. Detection and response PlanetScale employs measures for both corporate endpoints and cloud instances to collect, analyze, and store events, connections, and other potentially relevant metadata in real-time. Automated systems match events against internal and known bad patterns and intelligence streams. Need help? Get help from the PlanetScale Support team, or join our Discord community to see how others are using PlanetScale.