Protect your data

Use this page to decide whether the default encryption, isolation, and recovery controls meet your application’s requirements. These layers solve different problems: encryption protects bytes and traffic, isolation limits access, and backups recover deleted or corrupted data.

Stored data

The storage classes deployed for tenant databases and durable volumes encrypt data at rest. The apply path also checks the selected class and rejects a backend it can identify as unencrypted or unapproved. If the class is unset or the platform API cannot read it, the current guard warns and continues; the deployed storage configuration, rather than that guard alone, therefore carries the guarantee today.

Protected PostgreSQL backups add two independent layers:

1. WAL-G encrypts every database archive client-side with a unique 256-bit libsodium key before it leaves the database environment.
2. The EU object store encrypts the already-encrypted archive again at rest.

The database key is wrapped by OpenBao and stored separately from the archive. A storage credential by itself therefore exposes encrypted objects, not database plaintext. Backup paths are scoped to an opaque database identity so recreated databases do not accidentally join an older encryption chain.

Volume backups are encrypted by their storage and object-storage substrates. They do not currently add the database-specific client-side encryption layer; the distinction is intentional and documented rather than hidden behind a generic “encrypted” badge.

Network traffic

• Public application routes terminate with platform-issued TLS certificates.
• Platform APIs and object-storage backup traffic use TLS.
• Private Net encrypts device-to-platform traffic with WireGuard.
• Cilium encrypts traffic between managed endpoints when it crosses cluster nodes; same-node traffic does not traverse the WireGuard tunnel.
• Private routes are not exposed through the public application route.

Encryption in transit does not make a public route private. Choose route visibility based on who should be able to connect, then use Team-level Private Net grants for internal services.

Public platform-generated HTTP routes also pass through the origin web application firewall before reaching the component. Read Web traffic protection for its rules, coverage boundaries, blocked responses, and false-positive workflow.

Access to data and credentials

Each Environment runs in its own namespace. Inbound dependency access is default-deny: a component must declare a database, bucket, or Blueprint dependency before the platform wires the corresponding network and credential path. A volume is mounted only into the component that declares it. Private Net authorization is granted to Team members rather than to copied VPN configuration files.

Secrets are stored in OpenBao as the source of record. The workload receives only the values it declared, materialized through its isolated runtime secret; secret values are not written into your project YAML or exposed by pull. Database application passwords are generated and maintained by the platform, and additional database roles are bounded so they cannot request superuser or replication privileges.

Recover deleted or corrupted data

Encryption cannot recover a file that an authorized application deleted. Snapshots and database archives provide that separate protection:

• database-native base backups and continuous WAL support point-in-time recovery for protected database tiers;
• volume policies select in-cluster or off-site recovery points;
• restore operations stage a new copy before a handoff; and
• automated database restore drills test the technical recovery path rather than merely checking that backup files exist.

Your responsibilities

deliberate. runs the infrastructure automation, isolation controls, credential machinery, backup schedules, and technical restore checks described here. Your team still decides who may read data once it is connected, which data may be copied into previews, which recovery point is correct, whether the recovered application is usable, how long business records must be retained, and whether an independent export is required for portability or compliance.

For security questions that depend on your threat model or regulatory scope, contact the deliberate. team before treating a platform default as a compliance control.