Platform and security
Runs in your cloud. Your data stays in your bucket.
One container, a PostgreSQL database and your object storage. Deploy with Docker Compose or Terraform for AWS.
Architecture
Three parts. All of them yours.
browser · API · SDK · CLI
│ HTTPS, single sign-on
▼
datakumi app ×N # one stateless container
├─► PostgreSQL # settings, drafts, approvals, audit log
└─► object storage # Delta tables: S3, ADLS Gen2, GCS, MinIOSecurity
Controls auditors ask for.
Single sign-on
OpenID Connect with PKCE: Entra ID, Okta, Google and others.
Access control
Per folder and dataset, by person or role.
Row and field limits
Applied in the app, exports, SQL and the API.
Maker-checker
Multi-step approval. Nobody approves their own change.
Tamper-evident audit
Hash-chained log, verifiable at any time.
Encrypted secrets
Connection credentials encrypted at rest, with key rotation.
Operations
Observable from day one.
Scale out
Run several replicas behind a load balancer.
Metrics and logs
Prometheus metrics and JSON logs with request ids.
Backups
Database and lake backed up together, with restore checks.