DataEgressGet started
← All docs

Security

What DataEgress never has access to

  • Your production database. DataEgress only calls the HTTP endpoint you expose via defineDataset(...).handler() — it never holds database credentials, never opens a DB connection, never sees your schema.
  • Raw destination credentials at rest. secretAccessKey values are encrypted (AES-256-GCM) before being stored, and are never returned by any API response — GET/POST /api/destinations always mask them.

What DataEgress does have access to, and for how long

  • Row data, transiently, while generating an export file. Rows pass through DataEgress's process to be written to CSV/Parquet and uploaded; they are not retained beyond the local temp file, which is deleted after a successful upload.
  • The generated export file itself, briefly, for signed_url destinations (stored in DataEgress's own storage — local disk in dev, R2 in production if configured) or as a preview mirror alongside s3 deliveries. There is no long-term retention policy implemented yet — see limitations.md.

Encryption

  • Destination credentials: AES-256-GCM, key derived from DATARELAY_ENCRYPTION_KEY.
  • Local signed download URLs: HMAC-SHA256 tokens (DATARELAY_SIGNING_SECRET), time-limited (1 hour).
  • In transit: all destination uploads use HTTPS (AWS SDK default); the fetchPage HTTP call to your dataset endpoint should be HTTPS in production (the SDK doesn't enforce this in V1 — see limitations.md).

Change both DATARELAY_ENCRYPTION_KEY and DATARELAY_SIGNING_SECRET to real random values before deploying anywhere beyond local dev. The defaults are intentionally insecure placeholders.

GDPR / data retention

Not yet implemented as product features:

  • No automatic deletion of generated export files after N days.
  • No per-destination data residency controls.
  • No formal DPA/subprocessor documentation (this is a codebase, not a company with a legal entity yet).

If you're evaluating DataEgress for a compliance-sensitive use case today, treat V1 as infrastructure you operate yourself, not a vetted subprocessor.

SOC 2

Not pursued yet, deliberately — see the "why" in the product's own research: a SOC 2 Type II engagement costs real money and takes a 6–12 month observation period, and the customer-callback architecture (DataEgress never touches your database) meaningfully lowers what a security reviewer needs to approve without it. Revisit once a real deal is blocked on it.

Reporting a security issue

This is an early-stage internal project without a public disclosure program yet. File an issue in this repo, or contact the maintainer directly.