Encryption & Secrets Management
Witboost protects data at every layer through industry-standard encryption and secure secrets management.
Encryption in Transit
All communications outside of the cluster are encrypted using TLS 1.2 or higher:
- Between the platform and end users (UI, API)
- Between Tech Adapters and target technologies (Snowflake, Databricks, etc.)
- HTTPS enforced for all web and API traffic
Encryption at Rest
| Component | Encryption Method |
|---|---|
| Credentials & Secrets | Stored in a dedicated secret manager, managed by the customer |
| Platform Databases | Leverage the underlying infrastructure's encryption-at-rest capabilities |
| Persistent Storage | Configured according to customer requirements and cloud provider best practices |
| Backups | Encrypted using the same at-rest encryption mechanisms |
Key Management
- Customer-controlled — In on-premises deployments, the customer retains full control over encryption keys
- Industry best practices — Key management follows industry standards including AES-256, RSA-2048+, and key rotation
- No key escrow — Agile Lab does not have access to customer encryption keys
Secrets Management
Witboost integrates with enterprise secrets management solutions leveraging ESO
Based on the infrastructure and cloud provider, the customer can choose the preferred secret manager from the compatible ones.
Some examples:
- Hashicorp vault
- AWS Secrets Manager
- Azure Key Vault
- Google Cloud secret manager
Secrets include:
- Database connection strings
- API keys for Tech Adapter integrations
- Service principal credentials
- OAuth client secrets
All secrets are injected at runtime and never stored in source code, configuration files, or container images.
Data Protection by Architecture
Because Witboost is a control-plane platform, it provides an additional layer of data protection by design:
- No customer data content — The platform handles only metadata (schemas, policies, lineage, contracts)
- No consumer data at rest in Witboost — Customer's actual data remains in their own data infrastructure
- No consumer data in transit through Witboost — Data flows directly between source and target systems; Witboost orchestrates but never intermediates the data
This architectural boundary means that even in the unlikely event of a platform compromise, no customer data content would be exposed — only metadata and governance artifacts.