Security

Enterprise-grade security by default

Single-tenant isolation, end-to-end encryption, and complete data sovereignty. Every deployment, every customer.

Single-tenant isolation

Every customer gets a dedicated Kubernetes namespace — or an entirely separate cluster. Your data never shares infrastructure, compute, or storage with anyone else. There is no noisy-neighbour risk and no blast radius from another tenant.

  • Dedicated namespace per customer with network policies
  • Isolated databases — no shared tables, no shared connections
  • Independent scaling and resource allocation
  • Optional dedicated cluster for maximum isolation

First-party data sovereignty

All data flows through your own subdomain via DNS A records — not CNAME aliases that can be detected and blocked. Data is processed in your cluster. Vendor API credentials are stored in your infrastructure, not ours.

  • DNS A record pointing to your cluster IP
  • Data processed and stored in your infrastructure
  • No data passes through Datafly-owned servers
  • Full compliance with data residency requirements

Encryption

All data is encrypted in transit and at rest. Cross-domain identity tokens use military-grade encryption with short-lived, single-use tokens that cannot be replayed.

  • TLS 1.3 for all data in transit (minimum TLS 1.2)
  • AES-256 encryption for all data at rest
  • Cross-domain tokens encrypted with AES-256-GCM
  • 60-second TTL with single-use nonces on identity tokens

Access control

Fine-grained role-based access control with five distinct roles. Integrate with your existing identity provider via SAML or OIDC for single sign-on, with optional multi-factor authentication.

  • OrgAdmin — full organisation control
  • SourceAdmin — manage sources and integrations
  • SourceEditor — configure pipelines and transformations
  • SourceViewer — read-only access to source data
  • DataGovernanceAdmin — manage PII rules and consent
  • SSO via SAML 2.0 and OpenID Connect
  • Multi-factor authentication support

Audit logging

Every configuration change is recorded with who made the change, when it happened, and the full before-and-after diff. The audit trail is immutable and cannot be edited or deleted by any user, including administrators.

  • Full before/after diffs for every configuration change
  • User attribution with timestamp and IP address
  • Immutable audit trail — no edits, no deletions
  • Searchable and exportable for compliance reporting

Consent architecture

Consent is enforced at two layers: first at data collection in the browser by Datafly.js, and again at delivery by the Delivery Workers. Even if a misconfiguration allows an event through, the second layer catches it before data reaches any vendor.

  • Client-side enforcement in Datafly.js collector
  • Server-side enforcement in Delivery Workers
  • Consent-gated vendor identity syncs
  • Per-vendor consent category mapping
  • Supports all major Consent Management Platforms

Credential security

Vendor API credentials — keys, secrets, tokens — are stored in your cluster's secure configuration store. They are never included in browser JavaScript, never exposed in client-side code, and never transmitted to Datafly.

  • Credentials stored in your cluster config, not ours
  • Never embedded in client-side JavaScript
  • Server-proxied identity syncs keep secrets server-side
  • Rotatable without redeployment

Customer-hosted option

Deploy Datafly Signal in your own VPC using our Helm charts. In this model, Datafly has zero access to your data, infrastructure, or credentials. You maintain full operational control.

  • Deploy via Helm charts into your own Kubernetes cluster
  • Datafly has no access to your data or infrastructure
  • Full operational control — you own the deployment
  • Available for AWS, GCP, and Azure

Security is not an add-on. It is the architecture.

From single-tenant isolation to double consent enforcement, every layer of Datafly Signal is designed to keep your data safe, private, and under your control.

AES-256

Encryption at rest

TLS 1.3

Encryption in transit

5 roles

RBAC access control

2-layer

Consent enforcement

Ready to take control of your data?

See how Datafly Signal's security-first architecture protects your customer data while delivering it to the vendors you need.