Controls we can describe precisely.

Every client connection is encrypted through the bolt+ssc:// scheme, with trust-on-first-use against a certificate issued by CognoDB's own CA — there is no unencrypted listener to accidentally connect to. Instance storage and backup snapshots are encrypted with managed keys.

Who can administer your organization and who can open a database session are different questions with different answers. Console identity never becomes a data-path credential, so an SSO session cannot be replayed against your graph.

Instance passwords are generated at creation, displayed a single time, and stored only as a bcrypt hash. API keys are hashed at rest and shown once for the same reason. We cannot recover either for you, which is the point.

Connect your identity provider over OIDC, with issuer discovery and allowed email domains, so joining and leaving your directory controls console access without a separate offboarding step.

Each successful state-changing request is recorded with who made it, what it touched and where it came from. Reads are excluded so the log stays legible, and a failure to write an audit entry never silently drops the record.

Each organization's workloads run in their own namespace with default-deny networking, so an instance can only be reached through the gateway that fronts it. Containers run as a non-root user with a read-only root filesystem and no ambient capabilities.

Daily encrypted snapshots with retention. Restore creates a new instance rather than overwriting the original, so a recovery cannot destroy the evidence of what went wrong.

Deleted instances are retained for 30 days with a final snapshot before permanent removal, and bulk-deletion limits mean an automated system cannot remove a fleet without a human in the loop.