--- title: About security in Tiger Cloud | Tiger Data Docs description: Learn how Tiger Cloud protects your PostgreSQL data with encryption, access controls, and network security --- Protecting data starts with secure software engineering. At Tiger Data, we embed security into every stage of development, from static code analysis and automated dependency scanning to rigorous code security reviews. To go even further, we developed [pgspot](https://github.com/timescale/pgspot), an open-source extension to identify security issues with PostgreSQL extensions, which strengthens the broader ecosystem as well as our own platform. Tiger Data products do not have any identified weaknesses. ![Tiger Cloud platform security architecture overview](/_astro/tiger-platform-security-overview.DexpnyhU_1uSbj7.webp) ![Tiger Cloud platform security architecture overview](/_astro/tiger-platform-security-overview-dark.DE5djrdr_Z16DihD.webp) This page lists the additional things we do to ensure operational security and to lock down Tiger Cloud services. To see our security features at a glance, see [Tiger Data Security](https://www.tigerdata.com/security). ## Role-based access Tiger Cloud provides role-based access for you to: - Administer your Tiger Cloud project In Tiger Console, users with the Owner, Admin, and Viewer roles have different permissions to manage users and services in the project. - Manage data in each service To restrict access to your data on the database level, you can create other roles on top of the default tsdbadmin role. ## Authentication Tiger Cloud supports [multi-factor authentication](/deploy/tiger-cloud/tiger-cloud-azure/security/multi-factor-authentication/index.md) and [SAML single sign-on](/deploy/tiger-cloud/tiger-cloud-azure/security/saml/index.md) for logging in to Tiger Console. On the Scale and Enterprise pricing plans, a project Owner or Admin can also [enforce MFA or SSO for all members of a project](/deploy/tiger-cloud/tiger-cloud-azure/security/members#enforce-mfa-or-sso-for-all-project-members/index.md). ## Active sessions Every sign-in to your Tiger Cloud account is an active session: each browser you use Tiger Console from, and each machine where you logged in with [Tiger CLI](/get-started/quickstart/tiger-cli/index.md), which also covers the bundled Tiger MCP. You can review these sessions and revoke any of them from Tiger Console. Revoking a session signs that device out remotely, so it is the way to cut off access for a device you no longer control, or for CLI and Tiger MCP on a machine where you can't run `tiger auth logout`. To review and revoke sessions: 1. **Click your user name in the top right of Tiger Console and select `Account settings`** The `Active sessions` list shows each device signed in to your account, with its location, sign-in time, and last activity. Web sessions show the browser and operating system; CLI sessions show the Tiger CLI version and platform, for example `tiger-cli/0.24.0 (darwin/arm64)`. 2. **Revoke the sessions you don't recognize or no longer need** Click `Revoke` next to a session to sign that device out, or `Revoke all other sessions` to sign out everything except the browser you are using. A revoked CLI session stops working immediately; to use Tiger CLI on that machine again, run `tiger auth login`. ## Passwordless database access Passwordless database access lets project members query a service through SQL editor and Data view without supplying database credentials. You control this access separately for each service. Turning off passwordless database access disables SQL editor for the service and prevents Data view from connecting without database credentials. Data view remains available with database credentials and a network connection to the service. Project membership alone no longer grants database access through these tools. If your security policy requires users to connect through your private network, turn off passwordless database access as well as configuring private networking. This setting controls the console's passwordless query connections; it does not change network restrictions or platform maintenance access. To change the setting, you need permission to update the service, and the service must be running: 1. **Select your service in Tiger Console** 2. **Open `Operations` > `Security` > `Passwordless access`** 3. **Turn `Allow passwordless database access` on or off** This setting was previously named `SQL Editor` and was under `Operations` > `Service management`. ## Data encryption Your data on Tiger Cloud is encrypted both in transit and at rest. Both active databases and backups are encrypted. Tiger Cloud uses Azure as its cloud provider, with all the security that Azure provides. Data encryption uses the industry-standard AES-256 algorithm. Cryptographic keys are managed by [Azure Key Vault](https://azure.microsoft.com/en-us/products/key-vault). Keys are never stored in plaintext. For more information about Azure security, see the Azure documentation on security in [Azure Virtual Machines](https://learn.microsoft.com/en-us/azure/virtual-machines/security-overview) and [Azure Disk Encryption](https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-overview). ## Networking security Customer access to Tiger Cloud services is only provided over TLS-encrypted connections. There is no option to use unencrypted plaintext connections. ## Private endpoints Tiger Cloud enables you to connect to your services through a private endpoint in Azure using Azure Private Link. Traffic stays on Microsoft's internal network and never crosses the public internet. Once a service is attached, it is reachable only through the endpoint's private IP in your Azure Virtual Network, and communication can only be initiated from your Virtual Network to Tiger Cloud. Console passwordless connections are controlled separately. To require users to connect through your private network, also [turn off passwordless database access](#passwordless-database-access). ## IP address allow lists You can allow only trusted IP addresses to access your Tiger Cloud services. You do this by creating [IP address allow lists](/deploy/tiger-cloud/tiger-cloud-azure/security/ip-allow-list/index.md) and attaching them to your services. ## Operator access Normally all the resources required for providing Tiger Cloud services are automatically created, maintained and terminated by the Tiger Cloud infrastructure. No manual operator intervention is required. However, the Tiger Data operations team has the capability to securely log in to the service virtual machines for troubleshooting purposes. These accesses are audit logged. No customer access to the virtual machine level is provided. ## GDPR compliance Tiger Data complies with the European Union's General Data Protection Regulation (GDPR), and all practices are covered by our [Privacy Policy](https://www.tigerdata.com/legal/privacy) and the [Terms of Service](https://www.tigerdata.com/legal/terms-of-service). All customer data is processed in accordance with Tiger Data's GDPR-compliant [Data Processor Addendum](https://www.tigerdata.com/legal/timescale-cloud-data-processing-addendum), which applies to all Tiger Data customers. Tiger Data operators never access customer data, unless explicitly requested by the customer to troubleshoot a technical issue. The Tiger Data operations team has mandatory recurring training regarding the applicable policies. ## HIPAA compliance The Tiger Cloud [Enterprise plan](/deploy/tiger-cloud/tiger-cloud-azure/pricing-and-account-management#features-included-in-each-pricing-plan/index.md) is Health Insurance Portability and Accountability Act (HIPAA) compliant. This allows organizations to securely manage and analyze sensitive healthcare data, ensuring they meet regulatory requirements while building compliant applications. ## SOC 2 compliance Tiger Cloud is SOC 2 Type 2 compliant. This ensures that organizations can securely manage customer data in alignment with industry standards for security, availability, processing integrity, confidentiality, and privacy. It helps businesses meet trust requirements while confidently building applications that handle sensitive information. The annual SOC 2 report is available to customers on the Scale or Enterprise pricing plans. Open a [support ticket](https://console.cloud.tigerdata.com/dashboard/support) to get access to it.