Hasura Cloud Security
Enterprise grade security in a couple of clicks.
Our mission
Hasura Cloud is architected to help companies follow the three tenets of Information Security: confidentiality, integrity, and availability.
Hasura Cloud undergoes three layers of security scrutiny. As part of our certification process, we undergo routine testing from external agencies to ensure industry standards are maintained. As an open-source software, our internals are exposed for regular scrutiny from our community to ensure components stay current.
To incentivize the community for an extra layer of scrutiny, we also offer a path for responsible disclosure.
Hasura Cloud undergoes three layers of security scrutiny. As part of our certification process, we undergo routine testing from external agencies to ensure industry standards are maintained. As an open-source software, our internals are exposed for regular scrutiny from our community to ensure components stay current.
To incentivize the community for an extra layer of scrutiny, we also offer a path for responsible disclosure.
Security requires robust authentication and authorization
Hasura Cloud provides enterprise grade authorization that can integrate with your authentication provider of choice.
Hasura Cloud provides stateless authorization with JWT controls either through authorization headers, cookies, or webhooks. Being built on Postgres, session based control can always be configured but there are a number of good reasons to prefer stateless authentication.
Hasura Cloud provides stateless authorization with JWT controls either through authorization headers, cookies, or webhooks. Being built on Postgres, session based control can always be configured but there are a number of good reasons to prefer stateless authentication.
Security is more than just authentication and authorization
Inforsec tenet one: Confidentiality
Inforsec tenet two: Integrity
Inforsec tenet three: Availability
Inforsec tenet one:
Confidentiality
Allow Lists
Define a list of queries and mutations that are approved and execution will be limited to that list. With allow lists, you can limit the queries your users are able to execute.
Optional Introspection
Disable schema introspection to add an extra layer of obscurity and data structure opaqueness for unauthorized individuals.
Security Event Logging
Hasura Cloud maintains meticulous logs for security events and does threat-assessment pattern mapping to look for anomalies.
Access Controls
Provide fine-tuned access controls to ensure the person requesting data is only able to fetch/mutate content they’ve been given permission to access.
Single Tenant Mode, VPC Peering
Hasura Cloud enables a wide range of hosting options covering all possible use-cases, including a hosted, single-tenant mode.
Define a list of queries and mutations that are approved and execution will be limited to that list. With allow lists, you can limit the queries your users are able to execute.
Optional Introspection
Disable schema introspection to add an extra layer of obscurity and data structure opaqueness for unauthorized individuals.
Security Event Logging
Hasura Cloud maintains meticulous logs for security events and does threat-assessment pattern mapping to look for anomalies.
Access Controls
Provide fine-tuned access controls to ensure the person requesting data is only able to fetch/mutate content they’ve been given permission to access.
Single Tenant Mode, VPC Peering
Hasura Cloud enables a wide range of hosting options covering all possible use-cases, including a hosted, single-tenant mode.
Inforsec tenet two:
Integrity
Migration API
The Hasura Cloud migration API ensures that all changes to the Hasura Cloud metadata are observable, recoverable, and enforce eventual consistency.
RBAC Controls
User accounts can be highly scoped based on need-to-access and need-to-know params, ensuring users do not manipulate content or settings outside of their area of responsibility. This includes the ability to limit to analytics only account access, read-only mode, and more.
SSO Access
Hasura Cloud supports modern SSO access patterns, enabling centralized user management.
Multi-Layer Input Validation
It’s no surprise that SQL injection attacks continue to be attack-vector number one for those meaning harm. Hasura Cloud has vigilant processes in places to mitigate this.
The Hasura Cloud migration API ensures that all changes to the Hasura Cloud metadata are observable, recoverable, and enforce eventual consistency.
RBAC Controls
User accounts can be highly scoped based on need-to-access and need-to-know params, ensuring users do not manipulate content or settings outside of their area of responsibility. This includes the ability to limit to analytics only account access, read-only mode, and more.
SSO Access
Hasura Cloud supports modern SSO access patterns, enabling centralized user management.
Multi-Layer Input Validation
It’s no surprise that SQL injection attacks continue to be attack-vector number one for those meaning harm. Hasura Cloud has vigilant processes in places to mitigate this.
Inforsec tenet three:
Availability
Rate Limiting
Hasura Cloud can limit access to any of our managed clusters to ensure balanced and consistent availability for all our customers.
DDOS Monitoring
Hasura Cloud actively monitors for abnormal traffic spikes and has tools in place to mitigate the effects of bad actors.
Single Tenant Mode, VPC
Higher availability by reduction of noisy-neighbour effects.
Cloud Scale
Hasura Cloud is optimized for growth and is able to scale with the most demanding of customers.
Hasura Cloud can limit access to any of our managed clusters to ensure balanced and consistent availability for all our customers.
DDOS Monitoring
Hasura Cloud actively monitors for abnormal traffic spikes and has tools in place to mitigate the effects of bad actors.
Single Tenant Mode, VPC
Higher availability by reduction of noisy-neighbour effects.
Cloud Scale
Hasura Cloud is optimized for growth and is able to scale with the most demanding of customers.
Hasura undergoes rigorous compliance audits
Hasura Cloud is SOC 2 Type II Compliant
To achieve our SOC 2 Type II certification, we have implemented an exhaustive list of security controls including technical safeguards like penetration testing by an independent security firm, vulnerability scans and encryption, and process measures such as security training and disaster recovery planning. The audit report is available on request, under an NDA.
Hasura Cloud is HIPAA Compliant
Hasura Cloud’s HIPAA compliance has been audited by an independent third party, and includes controls just as stringent as that of healthcare organizations to protect the privacy, security, and integrity of protected health information (PHI). As part of Hasura Cloud’s Enterprise plan, we can also sign Business Associate Agreements (BAA) with our customers as needed.
Hasura is Regularly Penetration Tested
We regularly undergo penetration testing by an independent security firm as part of our SOC 2 process and can provide findings to customers as required under NDA.
GDPR compliant
Our offerings are fully GDPR compliant. Read our Privacy Policy.
We are happy to arrange custom DPAs where required.
We are happy to arrange custom DPAs where required.
Hasura is ISO certified
Hasura, Inc operates an Information Security Management System that conforms to the requirements stated in the standard: ISO/IEC 27001:2013 supporting the Hasura GraphQL Engine. We achieved multi-site certification, covering our primary office locations in San Francisco, United States and Bangalore, India.
Start with GraphQL on Hasura for Free
Build apps and APIs 10x faster- Built-in authorization and caching
- 8x more performant than hand-rolled APIs
Try GraphQL with Hasura
