DATA PLANE · YOUR AWS ACCOUNT
Holds the actual data and the query engine. It runs entirely inside your account.
SECURITY & TRUST
Your data never leaves your perimeter
e6data deploys into your own cloud account and runs where your tables live. Zero data movement - your existing governance and residency controls stay in force.
SOC 2
Independently audited security controls
Read moreISO 27001:2022
Certified information security management
Read moreISO 27017:2015
Cloud-specific security controls
Read moreISO 27018:2019
Protection of personal data in the cloud
Read moreHIPAA
Safeguards for protected health information
Read moreGDPR
EU data protection and processing rights
Read moreAudit reports, certificates, sub-processors and security controls are published in our Trust Center.
THE ARCHITECTURE
Your data stays in your account
The architecture separates a Data Plane from a Control Plane, so your data never leaves your environment.
CONTROL PLANE · e6data-MANAGED
Receives only metadata and metrics for orchestration. Never your data.
HOW IT IS SECURED
Least privilege, end to end
Customer-owned deployment
The engine deploys into an isolated Kubernetes namespace inside your own AWS EKS cluster, via Terraform scripts that are public and auditable.
Least-privilege access
Read-only access to the S3 buckets and Glue catalog you specify, plus a separate bucket for schema metadata. Nothing more.
IAM, scoped per service
Permissions are granted through IAM OIDC for a specific service account. Granular S3 controls, and MFA required for every deployment.
No e6data personnel access
Employees have no access to the production Control Plane and no pathway to your Data Plane. All inter-plane traffic is application-to-application.
Full audit visibility
Kubernetes audit and authenticator logs, S3 access logging on by default, CloudTrail for IAM and STS, and IP allowlisting via EKS authorized networks.
Residency stays in force
e6data runs where your tables already live, so your existing governance and data-residency controls apply unchanged.
WHAT LEAVES THE DATA PLANE
Metadata, never data
Only operational metadata is sent to the Control Plane. Query Editor results stream to your browser through the Control Plane - they are not retained on e6data servers, not written to disk, and inaccessible to employees.
- Infrastructure and cluster metrics (CPU, memory, I/O)
- Query counts and durations - SQL text masked, hashes only
- Schema information (table and column names)
- User identity, for query attribution
Read the full detail
Certifications, audit reports, sub-processors, control details and the deployment model are published in our Trust Center.
TALK TO US
See your numbers on your workloads.
Reach out to book a demo, share challenges you’re facing, and tell us how this fits into what you’re currently working on or thinking about.
Problems we’re solvingThanks.
An actual person replies, usually within one working day.