Security

Learn more about securing ClickHouse Cloud and BYOC

This document details the security options and best practices available for ClickHouse organization and service protection. ClickHouse is dedicated to providing secure analytical database solutions; therefore, safeguarding data and service integrity is a priority. The information herein covers various methods designed to assist users in securing their ClickHouse environments.

Cloud Console Authentication

Password Authentication

ClickHouse Cloud console passwords are configured to NIST 800-63B standards with a minimum of 12 characters and 3 of 4 complexity requirements: upper case characters, lower case characters, numbers and/or special characters.

Learn more about password authentication.

Social Single Sign-On (SSO)

ClickHouse Cloud supports Google or Microsoft social authentication for single sign-on (SSO).

Learn more about social SSO.

Multi-Factor Authentication

Users using email and password or social SSO may also configure multi-factor authentication utilizing an authenticator app such as Authy or Google Authenticator.

Learn more about multi-factor authentication.

Security Assertion Markup Language (SAML) Authentication

Enterprise customers may configure SAML authentication.

Learn more about SAML authentication.

API Authentication

Customers may configure API keys for use with OpenAPI, Terraform and Query API endpoints.

Learn more about API authentication.

Database Authentication

Database Password Authentication

ClickHouse database user passwords are configured to NIST 800-63B standards with a minimum of 12 characters and complexity requirements: upper case characters, lower case characters, numbers and/or special characters.

Learn more about database password authentication.

Secure Shell (SSH) Database Authentication

ClickHouse database users may be configured to use SSH authentication.

Learn more about SSH authentication.

Access Control

Console Role-Based Access Control (RBAC)

ClickHouse Cloud supports role assignment for organization, service and database permissions. Database permissions using this method are supported in SQL console only.

Learn more about console RBAC.

Database User Grants

ClickHouse databases support granular permission management and role-based access via user grants.

Learn more about database user grants.

Network Security

IP Filters

Configure IP filters to limit inbound connections to your ClickHouse service.

Learn more about IP filters.

Private Connectivity

Connect to your ClickHouse clusters from AWS, GCP or Azure using private connectivity.

Learn more about private connectivity.

Encryption

Storage Level Encryption

ClickHouse Cloud encrypts data at rest by default using cloud provider-managed AES 256 keys.

Learn more about storage encryption.

Transparent Data Encryption

In addition to storage encryption, ClickHouse Cloud Enterprise customers may enable database level transparent data encryption for additional protection.

Learn more about transparent data encryption.

Customer Managed Encryption Keys

ClickHouse Cloud Enterprise customers may use their own key for database level encryption.

Learn more about customer managed encryption keys.

Auditing and Logging

Console Audit Log

Activities within the console are logged. Logs are available for review and export.

Learn more about console audit logs.

Database Audit Logs

Activities within the database are logged. Logs are available for review and export.

Learn more about database audit logs.

BYOC Security Playbook

Sample detection queries for security teams managing ClickHouse BYOC instances.

Learn more about the BYOC security playbook.

Compliance

Security and Compliance Reports

ClickHouse maintains a strong security and compliance program. Check back periodically for new third party audit reports.

Learn more about security and compliance reports.

HIPAA Compliant Services

ClickHouse Cloud Enterprise customers may deploy services housing protected health information (PHI) to HIPAA compliant regions after signing a Business Associate Agreement (BAA).

Learn more about HIPAA compliance.

PCI Compliant Services

ClickHouse Cloud Enterprise customers may deploy services housing credit card information to PCI compliant regions.

Learn more about PCI compliance.