Security Overview - AnomalyArmor

AnomalyArmor is built with security as a foundational principle, not an afterthought. We understand that data observability tools have access to sensitive infrastructure, and we’ve designed our platform to limit data exposure to metadata and bounded aggregates, and to enforce that boundary at every layer.

Security architecture showing TLS 1.3 encryption, restricted read access, and AES-256 at rest

Core Security Principles

Metadata and Aggregates Only, Never Raw Row Values

The most important security control is what we don’t access:

We Access	We Never Access
Table names	Individual row data
Column names and types	`SELECT *` or raw column values
Schema metadata	PII content
Timestamp values (for freshness)	Business-sensitive records
Constraint definitions	Query results beyond aggregates
Aggregate statistics (`COUNT`, `MIN`, `MAX`, `SUM`, `AVG`, `PERCENTILE`)

When you connect a database, AnomalyArmor queries system catalogs (information_schema, pg_catalog, etc.) for structure, and runs bounded aggregate queries against your tables for monitoring. It never runs SELECT * or row-level reads of sensitive columns.

-- What we query (metadata + aggregates)
SELECT table_name, column_name, data_type
FROM information_schema.columns;
SELECT COUNT(*), MAX(created_at) FROM orders;

-- What we NEVER query (raw rows)
SELECT * FROM users;                   -- ❌ Never executed
SELECT email, ssn FROM customers;      -- ❌ Never executed

This isn’t just policy. It’s enforced by our open-source Query Gateway, which parses and validates every SQL query before execution.

Defense in Depth

Security is implemented at every layer:

Four layers of security: Network, Authentication, Application, and Data

Compliance & Certifications

For customers in the EU or handling EU data:

Data Processing Agreement (DPA) available
Right to erasure supported
Data portability supported
EU data residency options (contact sales)

HIPAA Readiness

For healthcare organizations:

Business Associate Agreement (BAA) available
Enhanced audit logging
Contact us for healthcare-specific deployment options

Encryption

Data in Transit

All network traffic uses TLS 1.3 encryption:

Database connections from AnomalyArmor to your infrastructure
Web traffic to the AnomalyArmor dashboard
API calls to AnomalyArmor services
Webhook deliveries to your endpoints

Minimum TLS version: 1.2 (1.3 preferred) Cipher suites: Modern, AEAD-only (AES-GCM, ChaCha20-Poly1305)

Data at Rest

All stored data is encrypted with AES-256:

Data Type	Encryption	Key Management
Database credentials	AES-256-GCM	AWS KMS, automatic rotation
Asset metadata	AES-256	Managed by infrastructure
Audit logs	AES-256	Immutable storage
Backups	AES-256	Separate backup keys

Key Management

Encryption keys are managed through AWS KMS:

Automatic key rotation every 365 days
Keys never leave the KMS boundary
Separate keys per customer (Enterprise)
Hardware Security Module (HSM) backed

Network Security

Connection Architecture

AnomalyArmor connects outbound to your databases:

IP Allowlisting

AnomalyArmor connects to your databases from a single static IP address:

Production IP (US region):
54.236.95.144/32

# Add this to your security group/firewall inbound rules for your database port

The current list is always shown in Settings → Security in your dashboard. All AnomalyArmor traffic egresses through this address, and it does not change between deployments.

VPC Peering (Enterprise)

For enhanced network isolation:

Direct VPC peering between your AWS account and AnomalyArmor
No public internet exposure for database connections
Private DNS resolution

AWS PrivateLink (Enterprise)

Connect via AWS PrivateLink for:

Fully private connectivity
No data traversing public internet
Simplified firewall rules

Authentication & Access Control

User Authentication

AnomalyArmor supports multiple authentication methods:

Method	Availability	Details
Email + Password	All plans	Strong password requirements
Google SSO	All plans	OAuth 2.0 integration
SAML 2.0 SSO	Enterprise	Okta, Azure AD, OneLogin, etc.
Multi-Factor Auth	All plans	TOTP-based (Google Authenticator, etc.)

Role-Based Access Control (RBAC)

Control who can do what:

Role	Permissions
Viewer	View assets, alerts, dashboards
Editor	Viewer + configure alerts, manage destinations
Admin	Editor + manage data sources, team members
Owner	Admin + billing, security settings

Session Security

Session tokens expire after 24 hours of inactivity
Sessions invalidated on password change
Concurrent session limits (Enterprise)
IP-based session restrictions (Enterprise)

Credential Security

How We Store Your Database Credentials

Database credentials are the most sensitive data we handle:

Encryption: AES-256-GCM with customer-specific keys
Key storage: AWS KMS with HSM backing
Access logging: Every credential access is logged
Least privilege: Only the discovery engine accesses credentials
No visibility: Support staff cannot view your credentials

Credential Recommendations

Always create a read-only, dedicated user for AnomalyArmor. Never share credentials with production applications.

Audit Logging

What We Log

Every significant action is logged:

Event Type	Details Logged
Authentication	Login, logout, failed attempts, MFA events
Data access	Discovery runs, asset views, exports
Configuration	Rule changes, destination updates, team changes
Admin actions	User management, security settings

Log Retention

Standard: 90 days retention
Enterprise: Configurable retention, SIEM integration

Accessing Audit Logs

Navigate to Settings → Audit Log to view activity:

Filter by user, action type, date range
Export to CSV
API access for SIEM integration (Enterprise)

Infrastructure Security

Cloud Provider

AnomalyArmor runs on AWS with:

Multi-AZ deployment for high availability
Automated backups with point-in-time recovery
DDoS protection via AWS Shield
Web Application Firewall (WAF)

Host Security

Hardened AMIs with minimal attack surface
Automatic security patching
No SSH access to production hosts
Immutable infrastructure (replaced, not updated)

Container Security

Non-root container execution
Read-only file systems where possible
Resource limits enforced
Regular vulnerability scanning

Incident Response

Our Commitment

In the event of a security incident:

Detection: 24/7 monitoring with automated alerting
Response: Incident response team engaged within 1 hour
Communication: Affected customers notified within 24 hours
Resolution: Root cause analysis and remediation
Post-mortem: Detailed report shared with affected customers

Reporting Security Issues

If you discover a security vulnerability:

Email: security@anomalyarmor.ai
Response time: Within 24 hours
Bug bounty: Contact us for details

Please do not disclose security issues publicly until we’ve had a chance to address them.

Penetration Testing

Our Testing

Annual third-party penetration tests
Continuous automated vulnerability scanning
Bug bounty program for responsible disclosure

Your Testing

Enterprise customers may conduct penetration testing:

Contact us at least 2 weeks in advance
Scope limited to your tenant
Provide test dates and methodology
Share findings for mutual benefit

Security FAQ

Can AnomalyArmor employees see my data?

No. Employees cannot access customer credentials or metadata. All access is logged and audited. Support debugging happens with synthetic data only.

What happens if AnomalyArmor is breached?

Your database credentials are encrypted with customer-specific keys. Even in a breach, credentials cannot be decrypted without the KMS keys. We would notify you within 24 hours of any confirmed breach.

Can I run AnomalyArmor in my own cloud?

Self-hosted deployments are available for Enterprise customers with specific compliance requirements. Contact sales for details.

How do I revoke AnomalyArmor's access?

Delete the data source connection in AnomalyArmor
Revoke the database user’s permissions or delete the user
Remove AnomalyArmor IPs from your security group

Common Questions

AnomalyArmor is GDPR-compliant with a DPA available, and HIPAA-ready with a BAA available for Enterprise. SOC 2 Type II is in progress; contact security@anomalyarmor.ai for the current report status.

Does AnomalyArmor support SSO and MFA?

Yes. Email + password, Google SSO, and TOTP-based MFA are available on all plans. SAML 2.0 SSO (Okta, Azure AD, OneLogin) is available on Enterprise. See User Authentication.

Can I connect AnomalyArmor to a database that isn’t publicly reachable?

Yes, on Enterprise. VPC peering and AWS PrivateLink let AnomalyArmor reach databases without a public endpoint, so traffic never traverses the public internet. See Network Security.

How are database credentials protected if AnomalyArmor is breached?

Credentials are encrypted with AES-256-GCM using customer-specific keys managed by AWS KMS with HSM backing. Even in a breach, credentials cannot be decrypted without the KMS keys, which never leave the KMS boundary.

How do I revoke AnomalyArmor’s access to my database?

Delete the data source connection in AnomalyArmor, then revoke or delete the database user on your side, and remove our IPs from your security group. That gives you a belt-and-suspenders revocation.

Can I run penetration tests against AnomalyArmor?

Enterprise customers can run penetration tests against their own tenant with 2 weeks’ notice. Email security@anomalyarmor.ai with scope, dates, and methodology. We also run annual third-party pen tests and a bug bounty for responsible disclosure.

Query Gateway

Open-source SQL security layer

Data Handling

What data we access and how we handle it

Data Retention

How long we keep your data

​Core Security Principles

​Metadata and Aggregates Only, Never Raw Row Values

​Defense in Depth

​Compliance & Certifications

​GDPR Compliance

​HIPAA Readiness

​Encryption

​Data in Transit

​Data at Rest

​Key Management

​Network Security

​Connection Architecture

​IP Allowlisting

​VPC Peering (Enterprise)

​AWS PrivateLink (Enterprise)

​Authentication & Access Control

​User Authentication

​Role-Based Access Control (RBAC)

​Session Security

​Credential Security

​How We Store Your Database Credentials

​Credential Recommendations

​Audit Logging

​What We Log

​Log Retention

​Accessing Audit Logs

​Infrastructure Security

​Cloud Provider

​Host Security

​Container Security

​Incident Response

​Our Commitment

​Reporting Security Issues

​Penetration Testing

​Our Testing

​Your Testing

​Security FAQ

​Common Questions

​Is AnomalyArmor SOC 2 / GDPR / HIPAA compliant?

​Does AnomalyArmor support SSO and MFA?

​Can I connect AnomalyArmor to a database that isn’t publicly reachable?

​How are database credentials protected if AnomalyArmor is breached?

​How do I revoke AnomalyArmor’s access to my database?

​Can I run penetration tests against AnomalyArmor?

​Related Pages

Query Gateway

Data Handling

Data Retention

Core Security Principles

Metadata and Aggregates Only, Never Raw Row Values

Defense in Depth

Compliance & Certifications

GDPR Compliance

HIPAA Readiness

Encryption

Data in Transit

Data at Rest

Key Management

Network Security

Connection Architecture

IP Allowlisting

VPC Peering (Enterprise)

AWS PrivateLink (Enterprise)

Authentication & Access Control

User Authentication

Role-Based Access Control (RBAC)

Session Security

Credential Security

How We Store Your Database Credentials

Credential Recommendations

Audit Logging

What We Log

Log Retention

Accessing Audit Logs

Infrastructure Security

Cloud Provider

Host Security

Container Security

Incident Response

Our Commitment

Reporting Security Issues

Penetration Testing

Our Testing

Your Testing

Security FAQ

Common Questions

Is AnomalyArmor SOC 2 / GDPR / HIPAA compliant?

Does AnomalyArmor support SSO and MFA?

Can I connect AnomalyArmor to a database that isn’t publicly reachable?

How are database credentials protected if AnomalyArmor is breached?

How do I revoke AnomalyArmor’s access to my database?

Can I run penetration tests against AnomalyArmor?

Related Pages