Security
Understand SerenDB's security features, compliance certifications, and best practices for protecting your data.
Overview
Security is fundamental to SerenDB's architecture. This section covers how we protect your data, compliance certifications, and best practices for securing your applications.
Security Features
Data Encryption
Encryption at Rest
All data encrypted on disk using AES-256
Automatic key management
No configuration required
Applies to databases, backups, and replicas
Encryption in Transit
TLS 1.2+ for all connections
Certificate verification supported
Secure websocket connections
HTTPS for management API
Network Security
IP Allow Lists
Restrict database access to specific IP addresses or ranges.
Benefits:
Prevent unauthorized access
Compliance requirements
Defense in depth
Geographic restrictions
See: IP Allow
Private Networking
Connect SerenDB to your private network infrastructure.
Features:
VPC peering
AWS PrivateLink
No public internet exposure
Enhanced security posture
See: Private Networking
Access Control
Authentication
Password authentication
Passwordless authentication with WebAuth
SSO integration (Enterprise)
API key management
Authorization
PostgreSQL role-based access control (RBAC)
Fine-grained user permissions
Organization and project-level access
Read-only roles
See: Database Access | User Permissions
Row-Level Security (RLS)
Implement granular data access control at the row level.
Use cases:
Multi-tenant applications
User data isolation
Privacy compliance
Data API security
See: Row-Level Security | RLS Tutorial
Protected Branches
Prevent accidental deletion or modification of critical branches.
Features:
Prevent deletion
Prevent compute configuration changes
Protect production data
Audit trail
See: Protected Branches
Compliance & Certifications
SOC 2 Type II
SerenDB is SOC 2 Type II certified, demonstrating:
Security controls
Availability guarantees
Confidentiality measures
Processing integrity
Privacy protections
HIPAA Compliance
HIPAA-eligible architecture for healthcare applications.
Requirements:
Business Associate Agreement (BAA) available
Encryption at rest and in transit
Access controls and audit logging
Enterprise plan required
See: HIPAA
GDPR Compliance
Built with privacy regulations in mind:
Data processing agreements
Right to erasure support
Data portability
EU data residency options
Security Best Practices
Application Security
Connection Security
Use TLS: Always enable SSL/TLS for connections
Verify certificates: Enable certificate verification
Secure credentials: Use environment variables, never commit secrets
Rotate passwords: Regularly update database passwords
Minimum privileges: Grant only necessary permissions
API Security
Protect API keys: Store securely, rotate regularly
Use scoped keys: Create keys with minimum required permissions
Monitor usage: Track API key usage for anomalies
Expire unused keys: Remove keys no longer needed
Application Code
Parameterized queries: Prevent SQL injection
Input validation: Sanitize all user input
Error handling: Don't expose sensitive information in errors
Audit logging: Log security-relevant events
Dependency scanning: Keep dependencies updated
Database Security
User Management
Separate users: Different users for different applications
Read-only users: For analytics and reporting
No superuser access: Use regular roles when possible
Regular audits: Review user access periodically
Data Protection
Implement RLS: For multi-tenant applications
Encrypt sensitive data: Application-level encryption for PII
Mask sensitive data: In non-production environments
Regular backups: Ensure disaster recovery capability
Test restores: Verify backup integrity
Network Security
Access Control
Use IP Allow: Restrict access by IP
VPN or PrivateLink: For production workloads
Minimal exposure: Don't expose databases publicly
Firewall rules: Layer network security
Monitoring
Connection logs: Monitor connection attempts
Query patterns: Identify suspicious activity
Failed authentications: Alert on repeated failures
Resource usage: Detect abnormal patterns
Incident Response
Security Monitoring
SerenDB continuously monitors for:
Unusual access patterns
Failed authentication attempts
Performance anomalies
Infrastructure security events
Reporting Security Issues
If you discover a security vulnerability:
Do not open a public issue
Email security team (see contact info)
Provide detailed description
Include steps to reproduce
Allow time for remediation
See: Security Reporting
Security Updates
Regular platform updates
Automatic security patches
PostgreSQL security updates
Extension security fixes
AI-Specific Security
When using SerenDB with AI applications:
Sanitize embeddings: Prevent embedding injection
Rate limit AI queries: Prevent abuse
Audit AI access: Log AI agent queries
Isolate AI data: Separate AI workloads when needed
See: AI Use in SerenDB
Acceptable Use Policy
Review our acceptable use policy to understand:
Permitted uses
Prohibited activities
Resource limits
Enforcement procedures
Compliance Resources
Security Overview: Comprehensive security architecture
Compliance: Certifications and standards
HIPAA: Healthcare-specific compliance
Security Checklist
Before going to production:
Security is a shared responsibility. SerenDB provides the platform security, while you're responsible for application-level security and access management.
Last updated