Security
Security model
Telemetry contains more about a business than most databases do. This page describes how ClueLake is built, not a compliance position.
Security
Built for production telemetry.
Telemetry contains more about a business than most databases do. These are the architectural properties ClueLake is built on.
Tenant isolation
The workspace is the first key of every telemetry table, so tenancy is a property of the storage rather than a filter a query has to remember.
Scoped credentials
Ingest, query and automation keys are separate, bound to a workspace, and stored only as hashes. Tenancy is resolved from the credential, never from the payload.
Controlled query access
SQL is read-only and validated, with the tenant predicate injected by the server. Customers never receive database credentials.
Encrypted connections
TLS in transit throughout, with private networking between the control plane and its databases.
Role-based permissions
Owner, admin, member and viewer roles across organisations and workspaces.
Audit logging
Sign-in, credential and configuration changes are recorded append-only, enforced by the database rather than by application code.
Configurable retention
Retention is policy, set per environment, and applied by the storage engine.
Redaction policies
Deterministic attribute allow and deny lists, applied before storage. Sensitive headers are removed rather than the event being discarded.
In detail
Data isolation
Every telemetry table is sorted and partitioned by workspace first. Queries have the tenant predicate injected server-side; customers never hold database credentials.
Authentication
Sessions for people, and scoped keys for machines. Keys are stored as hashes with a non-secret prefix kept for display, so a key can be identified in a list without holding anything that authenticates.
Authorization
Owner, admin, member and viewer roles across organisations and workspaces, checked server-side on every request.
Encryption
TLS in transit. Databases are on private networking and are never exposed to the public internet.
API security
Rate limits per organisation, workspace and key. SQL is read-only and validated by a parser rather than by string matching.
Secrets
Held in a managed secret store and injected at runtime. Nothing sensitive is committed, logged, or placed in a URL.
Audit logs
Append-only, enforced by database triggers rather than by application code, so the record survives a compromised service account.
Retention
Configurable per environment and applied by the storage engine, so deletion is a property of the data rather than a job that might not run.
Data residency
Workspaces carry a region. Telemetry is not moved between regions implicitly.
Infrastructure
Least-privilege IAM, network policy between components, non-root containers and read-only root filesystems where practical.
Certifications
ClueLake does not currently hold SOC 2, ISO 27001 or HIPAA attestation, and this page makes no claim to any. The architectural controls above are what exists today. If a formal attestation is a requirement for your evaluation, get in touch and we will tell you where things actually stand.