Snapshot 222301
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Skip to main content Use this page to find security guidance and configuration tasks across VeloDB Cloud. Security controls cover the control plane (organizations, console accounts, Management API access, and managed infrastructure) and the warehouse data plane (SQL users, roles, network access, encryption, and audit logs). For SaaS deployments, VeloDB Cloud operates the underlying infrastructure. In BYOC, you own the cloud account and customer-controlled resources. Check each guide for deployment-specific availability and responsibilities. Start with your task If you need to Start here Understand resource isolation and the available security controls. Security Features Choose the right identity and permission model. Identity and Access and Access Control Manage console members, organization roles, and MFA. Members and Multi-Factor Authentication Create or revoke credentials for Management API requests. API Keys Manage warehouse SQL users, roles, and data privileges. Warehouse Users and Roles and Data Access Control Change the warehouse admin password. Warehouse admin password Choose public or private access for SaaS warehouses, warehouse-specific console endpoints, or the Metrics API. Network Security Restrict source IP addresses for public access. Public IP allowlist Review encryption at rest and manage warehouse encryption keys. Encryption at Rest and Warehouse Encryption Review encryption for connections and data transfer. Encryption in Transit Review and schedule operating system security fixes. OS Updates (Private Preview) Review organization activity, query activity, or infrastructure evidence. Audit Logging and Audit Event Reference Review the BYOC operating boundary and cloud controls. BYOC Security Overview, BYOC Network Security, and Control Mapping Review BYOC diagnostics, remote support, and SQL execution controls. Telemetry and Logging, Remote Support, and SQL Execution Control Maintain warehouse security Review access when people or applications join, change roles, or leave. Membership in the console, Management API keys, and warehouse SQL accounts use separate credentials and permissions. Changes to one access path do not automatically update the others. Use network restrictions and encryption controls that match your deployment and connection path. For BYOC, also review the cloud IAM, networking, storage, and support boundaries in the linked BYOC guides. OS Updates applies security fixes to operating system packages separately from VeloDB Core upgrades. OS updates are in Private Preview and require enablement by VeloDB Cloud Support. Review the update's impact and use a maintenance window when scheduling maintenance. Review audit records and update history as part of ongoing operations. Shared responsibility Security is shared across three parties: The cloud provider secures the underlying infrastructure in every deployment, including the physical data centers, hardware, and hypervisor. VeloDB Cloud secures the warehouse service. In a SaaS deployment, VeloDB Cloud manages the cloud account, the warehouse engine and platform, encryption, and patching. In a BYOC deployment, VeloDB Cloud manages the warehouse software and its operation inside your cloud account. You secure your data, identities, roles, permissions, network exposure, and console access. In a BYOC deployment, you also own the cloud account and customer-controlled resources. Availability and configuration vary by deployment type and feature. For the detailed BYOC boundary, see BYOC Security Overview. Compliance and legal resources For certifications, audit reports, and vendor-assessment materials, see Compliance and Trust, Security Program, and the VeloDB Trust Center. For service agreements, privacy notices, and data processing terms, see Legal. On This Page Start with your task Maintain warehouse security Compliance and legal resources Was this page helpful?