## Core Security Principles
### Metadata and Aggregates Only, Never Raw Row Values
The most important security control is what we **don't** access:
| We Access | We Never Access |
| ------------------------------------------------------------------------ | ------------------------------- |
| Table names | Individual row data |
| Column names and types | `SELECT *` or raw column values |
| Schema metadata | PII content |
| Timestamp values (for freshness) | Business-sensitive records |
| Constraint definitions | Query results beyond aggregates |
| Aggregate statistics (`COUNT`, `MIN`, `MAX`, `SUM`, `AVG`, `PERCENTILE`) | |
When you connect a database, AnomalyArmor queries system catalogs (`information_schema`, `pg_catalog`, etc.) for structure, and runs bounded aggregate queries against your tables for monitoring. It never runs `SELECT *` or row-level reads of sensitive columns.
```sql theme={null}
-- What we query (metadata + aggregates)
SELECT table_name, column_name, data_type
FROM information_schema.columns;
SELECT COUNT(*), MAX(created_at) FROM orders;
-- What we NEVER query (raw rows)
SELECT * FROM users; -- ❌ Never executed
SELECT email, ssn FROM customers; -- ❌ Never executed
```
This isn't just policy. It's enforced by our open-source [Query Gateway](/security/query-gateway), which parses and validates every SQL query before execution.
### Defense in Depth
Security is implemented at every layer:
## Compliance & Certifications
### GDPR Compliance
For customers in the EU or handling EU data:
* Data Processing Agreement (DPA) available
* Right to erasure supported
* Data portability supported
* EU data residency options (contact sales)
### HIPAA Readiness
For healthcare organizations:
* Business Associate Agreement (BAA) available
* Enhanced audit logging
* Contact us for healthcare-specific deployment options
## Encryption
### Data in Transit
All network traffic uses **TLS 1.3** encryption:
* Database connections from AnomalyArmor to your infrastructure
* Web traffic to the AnomalyArmor dashboard
* API calls to AnomalyArmor services
* Webhook deliveries to your endpoints
**Minimum TLS version**: 1.2 (1.3 preferred)
**Cipher suites**: Modern, AEAD-only (AES-GCM, ChaCha20-Poly1305)
### Data at Rest
All stored data is encrypted with **AES-256**:
| Data Type | Encryption | Key Management |
| -------------------- | ----------- | --------------------------- |
| Database credentials | AES-256-GCM | AWS KMS, automatic rotation |
| Asset metadata | AES-256 | Managed by infrastructure |
| Audit logs | AES-256 | Immutable storage |
| Backups | AES-256 | Separate backup keys |
### Key Management
Encryption keys are managed through AWS KMS:
* Automatic key rotation every 365 days
* Keys never leave the KMS boundary
* Separate keys per customer (Enterprise)
* Hardware Security Module (HSM) backed
## Network Security
### Connection Architecture
AnomalyArmor connects **outbound** to your databases:
### IP Allowlisting
AnomalyArmor uses static IP addresses for database connections:
```
Production IPs (US region):
34.xxx.xxx.xxx/32
34.xxx.xxx.xxx/32
# Add these to your security group/firewall
```