--- title: About security in Tiger Cloud | Tiger Data Docs description: Learn how Tiger Cloud protects your PostgreSQL data with encryption, access controls, and network security --- Protecting data starts with secure software engineering. At Tiger Data, we embed security into every stage of development, from static code analysis and automated dependency scanning to rigorous code security reviews. To go even further, we developed [pgspot](https://github.com/timescale/pgspot), an open-source extension to identify security issues with PostgreSQL extensions, which strengthens the broader ecosystem as well as our own platform. Tiger Data products do not have any identified weaknesses. ![Tiger Cloud platform security architecture overview](/docs/_astro/tiger-platform-security-overview.DexpnyhU_Z2vdcGA.webp) ![Tiger Cloud platform security architecture overview](/docs/_astro/tiger-platform-security-overview-dark.DE5djrdr_794D7.webp) This page lists the additional things we do to ensure operational security and to lock down Tiger Cloud services. To see our security features at a glance, see [Tiger Data Security](https://www.tigerdata.com/security). ## Role-based access Tiger Cloud provides role-based access for you to: - Administer your Tiger Cloud project In Tiger Console, users with the Owner, Admin, and Viewer roles have different permissions to manage users and services in the project. - Manage data in each service To restrict access to your data on the database level, you can create other roles on top of the default tsdbadmin role. ## Authentication Tiger Cloud supports [multi-factor authentication](/docs/deploy/tiger-cloud/tiger-cloud-aws/security/multi-factor-authentication/index.md) and [SAML single sign-on](/docs/deploy/tiger-cloud/tiger-cloud-aws/security/saml/index.md) for logging in to Tiger Console. On the Scale and Enterprise pricing plans, a project Owner or Admin can also [enforce MFA or SSO for all members of a project](/docs/deploy/tiger-cloud/tiger-cloud-aws/security/members#enforce-mfa-or-sso-for-all-project-members/index.md). ## Active sessions Every sign-in to your Tiger Cloud account is an active session: each browser you use Tiger Console from, and each machine where you logged in with [Tiger CLI](/docs/get-started/quickstart/tiger-cli/index.md), which also covers the bundled Tiger MCP. You can review these sessions and revoke any of them from Tiger Console. Revoking a session signs that device out remotely, so it is the way to cut off access for a device you no longer control, or for CLI and Tiger MCP on a machine where you can't run `tiger auth logout`. To review and revoke sessions: 1. **Click your user name in the top right of Tiger Console and select `Account settings`** The `Active sessions` list shows each device signed in to your account, with its location, sign-in time, and last activity. Web sessions show the browser and operating system; CLI sessions show the Tiger CLI version and platform, for example `tiger-cli/0.24.0 (darwin/arm64)`. 2. **Revoke the sessions you don't recognize or no longer need** Click `Revoke` next to a session to sign that device out, or `Revoke all other sessions` to sign out everything except the browser you are using. A revoked CLI session stops working immediately; to use Tiger CLI on that machine again, run `tiger auth login`. ## Passwordless database access Passwordless database access lets project members query a service through SQL editor and Data view without supplying database credentials. You control this access separately for each service. Turning off passwordless database access disables SQL editor for the service and prevents Data view from connecting without database credentials. Data view remains available with database credentials and a network connection to the service. Project membership alone no longer grants database access through these tools. If your security policy requires users to connect through your private network, turn off passwordless database access as well as configuring private networking. This setting controls the console's passwordless query connections; it does not change network restrictions or platform maintenance access. To change the setting, you need permission to update the service, and the service must be running: 1. **Select your service in Tiger Console** 2. **Open `Operations` > `Security` > `Passwordless access`** 3. **Turn `Allow passwordless database access` on or off** This setting was previously named `SQL Editor` and was under `Operations` > `Service management`. ## Data encryption Your data on Tiger Cloud is encrypted both in transit and at rest. Both active databases and backups are encrypted. Tiger Cloud uses AWS as its cloud provider, with all the security that AWS provides. Data encryption uses the industry-standard AES-256 algorithm. Cryptographic keys are managed by [AWS Key Management Service (AWS KMS)](https://aws.amazon.com/kms/). Keys are never stored in plaintext. For more information about AWS security, see the AWS documentation on security in [Amazon Elastic Compute Cloud](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/data-protection.html) and [Elastic Block Storage](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-encryption.html). ## Networking security Customer access to Tiger Cloud services is only provided over TLS-encrypted connections. There is no option to use unencrypted plaintext connections. ## Networking with Virtual Private Cloud (VPC) peering When using VPC peering, **no public Internet-based access** is provided to the service. Service addresses are published in public DNS, but they can only be connected to from the customer's peered VPC using private network addresses. VPC peering only enables communication to be initiated from your Customer VPC to Tiger Cloud services running in the Tiger Cloud VPC. Tiger Cloud cannot initiate communication with your VPC. To learn how to set up VPC Peering, see [Secure your Tiger Cloud services with VPC Peering and AWS PrivateLink](/docs/deploy/tiger-cloud/tiger-cloud-aws/security/vpc/index.md). ## Private endpoints Tiger Cloud enables you to connect to your services through a private endpoint in AWS using AWS PrivateLink. Traffic routes over the AWS network, without crossing the public internet or requiring VPC peering. Once a service is attached, it is reachable only through the endpoint's private IP in your VPC, and communication can only be initiated from your VPC to Tiger Cloud. Console passwordless connections are controlled separately. To require users to connect through your private network, also [turn off passwordless database access](#passwordless-database-access). ## IP address allow lists You can allow only trusted IP addresses to access your Tiger Cloud services. You do this by creating [IP address allow lists](/docs/deploy/tiger-cloud/tiger-cloud-aws/security/ip-allow-list/index.md) and attaching them to your services. ## Operator access Normally all the resources required for providing Tiger Cloud services are automatically created, maintained and terminated by the Tiger Cloud infrastructure. No manual operator intervention is required. However, the Tiger Data operations team has the capability to securely log in to the service virtual machines for troubleshooting purposes. These accesses are audit logged. No customer access to the virtual machine level is provided. ## GDPR compliance Tiger Data complies with the European Union's General Data Protection Regulation (GDPR), and all practices are covered by our [Privacy Policy](https://www.tigerdata.com/legal/privacy) and the [Terms of Service](https://www.tigerdata.com/legal/terms-of-service). All customer data is processed in accordance with Tiger Data's GDPR-compliant [Data Processor Addendum](https://www.tigerdata.com/legal/timescale-cloud-data-processing-addendum), which applies to all Tiger Data customers. Tiger Data operators never access customer data, unless explicitly requested by the customer to troubleshoot a technical issue. The Tiger Data operations team has mandatory recurring training regarding the applicable policies. ## HIPAA compliance The Tiger Cloud [Enterprise plan](/docs/deploy/tiger-cloud/tiger-cloud-aws/pricing-and-account-management#features-included-in-each-pricing-plan/index.md) is Health Insurance Portability and Accountability Act (HIPAA) compliant. This allows organizations to securely manage and analyze sensitive healthcare data, ensuring they meet regulatory requirements while building compliant applications. ## SOC 2 compliance Tiger Cloud is SOC 2 Type 2 compliant. This ensures that organizations can securely manage customer data in alignment with industry standards for security, availability, processing integrity, confidentiality, and privacy. It helps businesses meet trust requirements while confidently building applications that handle sensitive information. The annual SOC 2 report is available to customers on the Scale or Enterprise pricing plans. Open a [support ticket](https://console.cloud.tigerdata.com/dashboard/support) to get access to it.