Skip to content
DocumentationAdministration
Administration
Encryption

Encryption

Altertable encrypts customer data in transit and at rest. See Security and compliance for the security overview, key-management information, and SOC 2 Type II attestation.

Credentials

Database and object-storage credentials are encrypted before storage and used when Altertable connects to the source. Use lakehouse credentials for clients that query or ingest through Altertable.

Encryption protects stored credentials, but it does not determine what the credential holder can access. Use access control to scope members and service accounts.

Lakehouse storage

Altertable-managed storage uses Cloudflare R2 and Amazon S3, with encryption keys managed by Altertable. If you connect your own bucket, review that provider’s encryption and key-management settings alongside its access policy.

Distributed StorageCOMPUTEWorkersWrite lakehouse dataTLS 1.3bucket-aAES-256 at restAltertable-managed keysbucket-bAES-256 at restAltertable-managed keysbucket-cAES-256 at restAltertable-managed keys

See Buckets for managed and connected storage options, and Network access for reaching restricted sources.

To query Amazon S3 table buckets, connect an S3 Tables external catalog.