Security

How Feldera handles data

Connector credentials, pipeline state, and feature data are sensitive. This page outlines our controls and the settings you can manage.

Security Principles

Core security

Encryption at rest

Feldera Cloud encrypts all stored pipeline state and checkpoint data at rest with AES-256. Storage-layer encryption is operator-transparent.

Transit encryption

TLS 1.2 or higher protects communication among the Feldera control plane, worker nodes, and connectors. The feature API is HTTPS-only.

Secret handling

An encrypted secrets store holds connector credentials, including Kafka SASL passwords, Postgres passwords, and AWS access keys. Plaintext values never appear in configs, logs, or audit trails.

Access control

Cloud Scale includes role-based access control with owner, editor, and read-only roles. An immutable audit log records access changes, timestamp, and actor. Per-pipeline grants are available.

Minimize data

Feldera processes only data needed for the SQL result set. Source rows are neither logged nor retained beyond incremental operator state requirements. Retention windows control state duration.

Tenant isolation

Each organization's pipelines run in isolated worker processes, with no operator-state sharing across tenants. Cloud Scale customers can request VPC deployment for added network isolation.

Technical Controls

How controls operate

API access control

Every Feldera Cloud API request requires a bearer token. Tokens are scoped to a user or service account, with further read/write scopes available for specific pipelines.

Shell 
curl -H "Authorization: Bearer $FELDERA_API_KEY" \
     https://api.felderahq.com/v1/pipelines

Inject credentials via secrets store

Pipeline configs reference credentials by name, never inline. At startup, the value is resolved and injected into the connector process environment.

YAML 
sources:
  - name: transactions
    type: kafka
    config:
      bootstrap_servers: "$KAFKA_BROKERS"
      sasl_password: # resolved from secrets store, not inlined
      secret_ref: kafka-prod-sasl

Event log retention

Cloud Starter keeps event logs for 30 days, and Cloud Scale for 90 days. Logs capture pipeline state transitions, access events, and configuration changes. API log exports are available for compliance requests.

Responsible Disclosure

Report security issues

Please report security issues in Feldera Cloud or the open-source engine privately before disclosure. We aim to acknowledge reports within 24 hours and share a resolution timeline within 5 business days.

Email [email protected] . Encrypt sensitive details with our PGP key, available on the GitHub repository.

We do not currently operate a formal bug bounty program. Release notes acknowledge researchers when a patch fixes a responsibly disclosed issue.

More questions?

Team security review

Need a security questionnaire or deeper technical review of our controls? Reach out, and we can work through your compliance requirements.

Contact us