Snapshot 224589
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Skip to content PuppyGraph security Security & Trust Understand how PuppyGraph runs in your environment, how access is controlled, and the security practices behind our software. Free downloadBook demoJoin Slack Contact us about security 01 / Deployment & data handling Deployment and data handling Deploy PuppyGraph on infrastructure you control and connect it to your data sources. Review the deployment model alongside the data handling of the features you choose to use. Deployment options Deploy PuppyGraph in your own environment using containers or Kubernetes. PuppyGraph is also available through AWS, Azure, and Google Cloud Marketplaces. Explore deployment options → Connected data sources PuppyGraph connects to your existing data stores as a graph query engine. Configure the data sources and credentials used by your deployment, then define the graph model over those sources. PuppyGraph uses persistent volumes for cluster metadata and local data cache within your deployment. Read about persistent volumes and local cache. TLS deployment example The Nginx guide demonstrates TLS routing for UI/HTTP, Bolt, and Gremlin on port 443. TLS terminates at an Nginx proxy; backend traffic in that example uses a private, unencrypted Docker network. Review the TLS proxy deployment → Have FIPS requirements? Contact our team to discuss a build for your deployment. Optional feature When you use built-in AI Built-in AI is optional. When you use the assistant, its access is governed by your permissions in PuppyGraph. Inherited RBAC permissions: The AI assistant directly inherits the signed-in user’s RBAC role and permissions in PuppyGraph. It can only perform operations permitted by that role. See role-based access controls below. Data shared with the model: When you use the assistant, requests are sent to the configured model endpoint. The data included depends on the task and the signed-in user’s permissions. Requests may include catalog metadata, sampled rows, and generated queries within that permission scope. Endpoint and credentials: You can configure the model endpoint and use a deployment-wide API key or a personal API key. Read built-in AI documentation → 02 / Product access controls Identity, access, and audit Use identity, role, and row-level controls together to configure access to your PuppyGraph deployment. For SSO logins, the identity provider identifies the user. With RBAC enabled, the user’s role determines whether the operation is allowed. RLS filters apply according to the table configuration and entitlement behavior described below. Local users and service accounts are also supported. Identity Single sign-on PuppyGraph supports OpenID Connect (OIDC) providers, including Okta, Auth0, Google Workspace, Microsoft Entra ID (Azure AD), and Keycloak. Sign-in uses the Authorization Code flow with PKCE. With SSO enabled, users authenticate through your identity provider. Their PuppyGraph role can be assigned automatically from configured IdP group mappings. SSO documentation → Operations Role-based access With RBAC enabled, assign one of five built-in roles (Admin, UserAdmin, GraphAdmin, Analyst, or Viewer) to control which operations users can perform. Permissions are enforced across REST, Bolt, and Gremlin entry points. RBAC is enabled by default. Disabling it treats all authenticated users as Admin. RBAC documentation and permission matrix → Five built-in roles Role Permissions and limits Admin Full access, including users, graph schemas, catalogs, queries, cluster management, and system operations. UserAdmin Manage users and roles; read graph schemas and catalogs and run queries. Cannot modify graph schemas, catalogs, or cluster infrastructure. GraphAdmin Build and maintain graph schemas, run queries, and read catalog metadata. Cannot create or delete catalogs or manage users. Analyst Run queries and read graph schemas and catalog metadata. Viewer Read graph schemas and catalog metadata; cannot run queries. Data visibility Row-level security Configure an entitlement table and security filters to restrict the rows each authenticated user can access when querying graph data. When RLS is enabled, configured filters apply at query time using the authenticated user’s entitlements, including intermediate traversal steps. Coverage depends on both the configured tables and entitlement records; see the behavior details below. A user with no entitlement records bypasses RLS. RLS documentation and behavior details → RLS coverage and entitlement behavior Topic Details Enable and scope RLS requires authentication, an entitlement table, and enabled security filters. Only tables configured with these filters are restricted by RLS. Other tables have no RLS restriction. Multiple filters on one table are combined with AND. Missing records A user with records for some resource types but none for a required type receives no rows from tables filtered on that missing type. RBAC permissions still apply. Include records covering the required resource types for every user who must be filtered, including explicit denials where appropriate. Administrators and caching Admin is not automatically exempt: entitlement presence follows the same rules. Entitlement changes are subject to cache refresh and may not take effect immediately. Accountability Review access-management activity. The audit log records RBAC-related actions, including user creation, role changes, password resets, service account operations, group mapping changes, and access denials. Read about RBAC audit logging → Service accounts User impersonation A service account with impersonation enabled can act as a specific user, inheriting that user’s role and permissions. The target user’s role must be equal to or lower than the service account’s role, preventing privilege escalation. The audit log records both identities. Service account impersonation documentation → 03 / Company security Our security practices These practices cover PuppyGraph’s software development, development infrastructure, and employee access and awareness. Vulnerability scanning & remediation We perform vulnerability scans during our production process and remediate findings that pose a risk to our environment. Infrastructure monitoring & testing We continuously monitor our development cloud infrastructure, complemented by regular penetration tests. Employee security training Employees receive security awareness training during onboarding and annually to stay informed about threats and scams. Employee access & MFA Employees receive application access based on their roles. Access is protected by multi-factor authentication. Contact us about our security practices → Evaluate PuppyGraph in your environment Start with a free download, explore your use case with our team, or connect with the community. Free downloadBook demoJoin Slack $ docker run -p 8081:8081 \ -p 8182:8182 -p 7687:7687 \ puppygraph/puppygraph:latestPulling puppygraph/puppygraph:latestStarting PuppyGraphWeb console listening on 0.0.0.0:8081Gremlin endpoint listening on 0.0.0.0:8182PuppyGraph is running# no pipelines · no second database · no data movement