dltHub
Book a demo

Platform Security

dltHub keeps your data in the region you choose and encrypts every secret. Visit our trust center at trust.dlthub.com

Talk to usTrust Center

Your data stays in your region

Each plane runs on its own isolated network, which limits the impact of a breach.

  • Control plane. Runs in US East. Schedules your jobs and handles their configuration, storing only job metadata, like run status and versions.
  • Data planes. Each cluster is a separate data plane in the EU or the US. Your jobs run there, while your code, configuration files, secrets, and logs remain encrypted and stored within the region.
One control plane in US East sends jobs and configuration to isolated data planes in the EU and US

Access, credentials and region control

Credentials are stored encrypted and scoped per workspace or profile.

Profiles

Docs

Save testing and production configuration and secrets as separate profiles. Test safely without putting production credentials at risk.

Environment variables

Docs

Only workspace owners can edit environment variables. Secrets are stored encrypted and are never kept in plain text.

Environment variables table: WAREHOUSE, BATCH_SIZE, LOG_LEVEL and ORACLE_DSN with the profiles each applies to

Encryption

Learn more

Secrets are never stored in plaintext. They are transmitted over encrypted channels and kept in an isolated, encrypted store.

Guardrails for agents

Agents on dltHub work inside limits you set.

Prod credentials inaccessible

Unlike batch jobs, background agents default to the access profile. Give it read-only database roles.

Your rules, every session

Coding agents follow your engineering rules every session. Background agents get only their defined rules.

A person applies every fix

Background agents diagnose failures and suggest a fix. A person on your team reviews and applies it.

Each workspace has its own security boundary

Every workspace deploys on its own, with its own code, secrets, jobs and access.

  1. 1

    Code

    Deploy a Python project as a workspace, and dltHub mirrors your deployed files to that workspace.

  2. 2

    Storage

    Your code, config, secrets, outputs and metadata are stored in the region your organization picked.

  3. 3

    Secrets

    Store secrets encrypted in dltHub or in your own Google Secret Manager. Deployed pipelines run on the prod profile.

  4. 4

    Jobs and access

    Schedule jobs per workspace and give each user the role they need there. API keys work in one workspace only.

  5. 5

    Execution

    Jobs run in your organization’s region too, and each run receives its secrets only when it starts.

  6. 6

    Destinations

    Switch profiles to point the same code at different destinations, each with its own config and secrets.

Private connectivity

Connect pipelines to private cloud and on-premises systems without exposing those systems to the public internet. On the Enterprise plan, we work with your team to configure the connection around your network architecture.

Talk to us
Your dltHub workspace connects over a private link, with no public internet, to AWS, Google Cloud and on-premises systems

Static egress IPs

Some systems only accept traffic from addresses they know. Jobs can send their outbound traffic from fixed addresses, so those systems can allowlist dltHub.

Allowlist predictable outbound IP addresses

Turn them on when a system you connect to only accepts known addresses. Outbound traffic then comes from fixed addresses for your organization’s region.

Set up static egress IPs
__deployment__.py
@run.pipeline(    my_pipeline,    require={        "static_egress_ips": True,    },)def sync_from_vendor():    ...

Deployment

Two ways to deploy, and where your data sits in each

Where your pipelines run determines which of your networks they can reach. That one choice is the difference between these two.

SaaS + private linksAvailable todayBYOCCustom deployment, designed with you
Where it runsAccounts and schedulingNo customer data passes through itdltHubdltHub
Your code, secrets and logsCode, secrets, logs, configurationdltHubdltHub
Where pipelines runDecides which networks it can reachdltHub VPCYour cloud
Where your data staysYour secretsdltHubStay in your cloud
Code, config, telemetry at restdltHubdltHub
Sources and destinationsReached over a private link onlyStay in your cloud
Private link to your sourcesRequiredNot needed
Discuss enterprise deployment

Explore the rest of dltHub