Security

Security you can inspect. Deployment you control.

Polybase uses TLS 1.3 in transit, permission controls and deployment options that include our EU cloud, your VPC and your own infrastructure.
Encryption
TLS 1.3
Hosting
Self-host
Keys
Yours
Compliance
GDPR by design
The problem

Why your collaboration data isn't as European as you think.

US CLOUD Act · 2018

Most teams assume that if their tools store data “in the EU”, their data is safe under EU law. For US-owned providers, that assumption is wrong.

The US CLOUD Act (2018) gives American authorities the power to compel any US-based company to hand over data it controls — regardless of where in the world that data is physically stored. A US provider's Frankfurt data center doesn't change who can be served the warrant.

This is why Slack, Microsoft Teams, Zoom, Google Workspace and Jira — all US-owned — sit in legal tension with GDPR for sensitive data. European data protection authorities have repeatedly flagged transatlantic transfer as a compliance risk, and the EU has announced work on new cloud rules — a proposed Cloud and AI Development Act — that would weigh provider jurisdiction for sensitive workloads.

The only durable fix is architectural. If a provider physically cannot access your data or your keys, there is nothing for any court — European or foreign — to compel. That's the model Polybase is built on.

Where your data lives

Three models. You pick the boundary.

Choose the data-residency reality your compliance posture needs — and move between models later without rebuilding.

EU Cloud

Our EU cloud

Runs in EU regions. Your data stays in the EU and we operate the platform for you — no servers for your team to manage.

Data stays in the EU
Private Cloud

Your own VPC

Runs inside your cloud account and region. You control the network, storage and access.

Your cloud account
Self-hosted

Your infrastructure

Runs on your own servers — online or fully air-gapped. You own the data and the encryption keys, end to end.

Your servers, your keys
Key management

Who holds the keys?

With self-host, we never hold your keys — so there is nothing for us, or any court, to hand over.

EU Cloud
Where it runs
EU regions, operated by Polybase
Who holds the keys
Polybase-managed
Who can access data
Polybase operators, to run the service
Encryption at rest
Provider-managed disk encryption
Private Cloud (VPC)
Where it runs
Your cloud account & region
Who holds the keys
You — your cloud's key management
Who can access data
Only your team
Encryption at rest
Your cloud's key management / disk encryption
Self-hosted / air-gap
Where it runs
Your own infrastructure
Who holds the keys
You — exclusively
Who can access data
Only you. Polybase cannot.
Encryption at rest
Your disk encryption / key management
TLS 1.3 protects data in transit across every model.
Our philosophy

Your data never leaves your control.

Security is not a layer we bolted on — it is the ground every query, connection, and user walks over. Polybase is built on strong cryptography, granular access rules, and a full self-host option so the most sensitive teams can trust it. Run our cloud or your own infrastructure — control stays with you.

The Pledge
  • TLS 1.3 encrypted communication in transit
  • Self-host: full control on your own infrastructure
  • Designed around GDPR principles
Security pillars

Every layer designed for defence.

Six core principles — every user and every bit flows through them.

01

Encryption

TLS 1.3 encrypted communication in transit. For sensitive data at rest we recommend disk encryption under your own key management.

TLS 1.3
02

Self-host option

Run Polybase on your own cloud or on-prem, with zero vendor lock-in.

Your servers
03

Granular access

Every record is protected by access policies that evaluate user roles and team memberships.

Per-record rules
04

Portable backups

Standard, portable backups made with the tools you already use. Uploaded files stay on storage you control.

Portable
05

Message audit trails

Message edits are recorded server-side as an append-only history. A general audit log panel is on the roadmap.

Message history · General audit (Soon)
06

Data sovereignty

With self-host you decide where your data lives. Compliance with local data residency laws stays fully in your hands.

Self-host
Architecture

Layered defence in depth.

Every request passes four checkpoints: edge, identity, application, and data. A failure in one component never exposes the entire system — the layers reinforce each other.

To make this auditable, the full rule engine is exposed — your auditors can inspect the policies directly inside Polybase.

  1. 01Edge

    Edge

    Every request is filtered and rate-limited to block abuse.

  2. 02Identity

    Identity

    Standard email/password and API token authentication. Enterprise SSO/SAML/SCIM/2FA on the roadmap, on request.

  3. 03Application

    Application

    Role- and team-based access policies are evaluated on every request.

  4. 04Data

    Data

    Access policy enforced on the server for every record; backups with your own tooling; optional disk-level encryption.

Every layer auditable
Compliance

Privacy by design.

We focus on principles over certifications: data minimization, explicit access rules, and full data control via self-host.

By design
GDPR
By design

Designed around EU data protection principles; full data control with self-host.

Active
Self-host
On-prem

Run on your own infrastructure with a single command; your data stays on your servers.

Active
Auditable Rules
RBAC

Roles and permissions are open and auditable; your team can inspect every access policy directly.

Roadmap
SOC 2 / ISO 27001
Roadmap

Not certified yet — SOC 2 and ISO 27001 are on our roadmap. We answer security questionnaires and architecture questions today.

Air-gapped & offline

Built to run with no internet at all.

Deploy Polybase on isolated infrastructure — no outbound connection required, no telemetry, no dependency on us. It runs fully offline; video calls stay inside the same network. You manage backups and access; your data and keys never leave the network. It's the deployment that government, defense, and regulated finance and healthcare ask for — and that almost no all-in-one collaboration suite credibly offers.

For government · defense · regulated finance & healthcare
  • Self-hosted on fully isolated networks
  • No telemetry, no outbound calls required
  • Video calls inside the same network
  • Full data and encryption-key sovereignty
  • You manage backups, updates and access
Architecture

Full control with self-host

Your data, on your servers

Lightweight
Simple to operate
Self-hosted
One-command deploy
TLS 1.3
Modern encryption
Talk to our trust team

We take your questions seriously.

We answer your questions about architecture, deployment and security. You can request a tailored review for your team.

Email the trust team