Security - Aiven

Aiven provides enterprise-grade security across all layers of the platform. From encryption at rest and in transit to network isolation and compliance certifications, security is built into every aspect of Aiven services.

Security overview

Aiven’s security architecture follows defense-in-depth principles:

Data Encryption

At rest: LUKS full-disk encryption
In transit: TLS 1.2+ for all connections
Backups: AES-256 + RSA encryption
Key rotation: Automatic with upgrades

Network Security

TLS-only connections, no plaintext
VPC peering for private connectivity
IP allowlisting
Dynamic firewall protection

Access Control

Role-based access control (RBAC)
SSO and SAML support
Two-factor authentication
Application users for automation

Compliance

SOC 2 Type II
ISO 27001
HIPAA
PCI DSS
GDPR compliant

Data encryption

Aiven encrypts data at every stage - at rest, in transit, and in backups.

Encryption at rest

All service instances use full-disk encryption:

LUKS encryption

Algorithm: AES-XTS-Plain64 with SHA256
Key size: 512-bit encryption key
Mode: LUKS2 default configuration

Ephemeral keys

Randomly generated per instance and volume
Never reused across instances
Destroyed when instance terminates

Automatic key rotation

Keys rotated during maintenance updates
Rolling upgrades create new instances with new keys
Old instances and keys destroyed

Encryption Details:
  Service VMs:
    Method: LUKS2 full volume encryption
    Algorithm: aes-xts-plain64:sha256
    Key Size: 512-bit
    Key Generation: Random per instance
    Key Storage: Instance memory only
    Key Lifetime: Instance lifetime

Encryption keys never leave the virtual machine. Aiven cannot access your data at rest without the running instance.

Encryption in transit

All connections to and between Aiven services use TLS encryption:

Client connections: TLS 1.2+ required, no plaintext option
Service-to-service: TLS or IPsec for inter-VM communication
Strong cipher suites: AES-256-GCM, ChaCha20-Poly1305
Perfect forward secrecy: ECDHE key exchange

# Download CA certificate for validation
avn project ca-get \
  --project my-project \
  --target-filepath ca.pem

# Connect with certificate validation (PostgreSQL)
psql "postgres://user:pass@host:port/db?sslmode=verify-full&sslrootcert=ca.pem"

# Connect with certificate validation (Kafka)
kafka-console-consumer --bootstrap-server host:port \
  --consumer-property security.protocol=SSL \
  --consumer-property ssl.truststore.location=ca.truststore \
  --consumer-property ssl.truststore.password=changeit

Backup encryption

Service backups are encrypted with multiple layers:

File encryption

Algorithm: AES-256 in CTR mode
Key size: 256-bit
Integrity: HMAC-SHA256
Per-file keys: Random key for each backup segment

Key encryption

Algorithm: RSA
Key size: 3072-bit RSA key pair
Key generation: Random per service
Key storage: Encrypted in backup header

Storage location

Same region as service (default)
Cross-region backup available
Cloud provider object storage (S3, GCS, Azure Blob)

Backup Encryption:
  File Encryption:
    Algorithm: AES-256-CTR
    Key Size: 256-bit
    Integrity: HMAC-SHA256 (512-bit)
  
  Key Encryption:
    Algorithm: RSA
    Key Size: 3072-bit
    Key Storage: Backup file header
  
  Storage:
    Location: Same region as service
    Provider: Cloud object storage
    Access: Aiven-managed keys only

Bring Your Own Key (BYOK)

For enhanced control, use your own encryption keys:

Customer-managed keys: Use keys from your KMS
AWS KMS, GCP KMS, Azure Key Vault: Integration available
Key rotation: You control rotation schedule
Access audit: Full audit trail in your KMS

BYOK is available with Advanced or Premium support tiers. Contact your account team to enable this feature.

Network security

Connection security

All network connections are secured:

Client Connections
Service-to-Service

Public or private access with encryption

Mandatory TLS: No plaintext connections allowed
Certificate validation: CA certificates available
IP filtering: Restrict access by source IP
VPC peering: Private network connectivity

# Configure IP allowlist
avn service update \
  --project my-project \
  --service postgres-1 \
  -c ip_filter="203.0.113.0/24"

VPC and network isolation

Enhanced security with private networking:

VPC Peering

Private network connectivity

No public internet exposure
Private IP addressing
Direct cloud provider network connection
Supported: AWS, GCP, Azure, UpCloud

Dedicated VMs

No multi-tenancy

One customer per VM
Data never leaves VM (except backups)
VMs destroyed after use
Fresh VMs for upgrades

Firewall protection

Dynamic firewall rules protect each service:

Firewall Configuration:
  Type: iptables-based
  Default Policy: DENY all
  Allowed Sources:
    - IP allowlist entries
    - Peered VPC CIDR blocks
    - Aiven management plane
  Allowed Ports:
    - Service-specific (5432, 6379, 9092, etc.)
    - Management access (restricted IPs)
  Updates: Dynamic based on configuration

Virtual machines and infrastructure

Cloud provider accounts

Aiven services run in Aiven-managed cloud accounts:

Aiven-controlled: Cloud accounts managed by Aiven operations
Customer isolation: Customers cannot access Aiven cloud accounts
Multi-cloud: Services across AWS, GCP, Azure, DigitalOcean, UpCloud
Region selection: Customer chooses deployment regions

Virtual machine security

Dedicated VMs

One customer per virtual machine
No multi-tenancy at VM level
Data isolation guaranteed

Availability zones

VMs distributed across AZs
High availability and fault tolerance
Region-dependent (2-3+ AZs)

VM lifecycle

VMs never reused
Destroyed during upgrades
Full disk wipe on termination
New VMs for each deployment

Operator access

Aiven operations team can access VMs for troubleshooting, but all access is logged and audited.

Automatic operations: No manual intervention normally required
Troubleshooting access: Operations team can securely log in
Audit logging: All operator access logged
Customer data privacy: Operators never access customer data unless requested
No customer access: Customers cannot access VM level

Operator Access Policy:
  Normal Operations: Fully automated, no manual access
  Troubleshooting: Secure SSH access when needed
  Audit: All access logged and tracked
  Customer Data: Never accessed without explicit request
  Customer Access: Not provided at VM level

Access control

Authentication

Multiple authentication methods with centralized control:

Passwords + 2FA: Email/password with optional/required two-factor
Social login: Google, Microsoft, GitHub
SAML SSO: Enterprise identity providers (Okta, Azure AD, etc.)
Authentication policies: Organization-wide control
Token authentication: Personal and application tokens

Learn more about authentication methods and users and permissions.

Role-based access control (RBAC)

Granular control over who can do what:

Organization Level
Project Level
Service Level

Super Admin (full access)
Organization Admin (full except delete org)
Custom permissions (billing, users, networking)

Managed users

Centralized user management with verified domains:

# Verify your organization's domain
avn organization domain-add \
  --organization-id <ORG_ID> \
  --domain company.com

# Add DNS TXT record, then verify
avn organization domain-verify \
  --organization-id <ORG_ID> \
  --domain company.com

# Users with @company.com become managed users

Managed user benefits:

Centralized lifecycle management
Cannot create new organizations
Profile managed by org admins
Visible to org even before joining

Compliance and certifications

Aiven maintains industry-leading compliance certifications:

Certifications

SOC 2 Type II

Annual audit by independent assessor
Security, availability, confidentiality
Reports available to customers

ISO 27001

Information security management
International standard
Regularly audited and certified

HIPAA

Healthcare data protection
Business Associate Agreement (BAA) available
For Advanced and Premium tiers

PCI DSS

Payment card data security
Level 1 service provider
For qualifying deployments

Data privacy regulations

GDPR Compliance

EU data protection regulation
Data processing agreement available
Data residency options
Right to erasure implemented

CCPA Compliance

California consumer privacy
Data transparency and control
Opt-out mechanisms

Data residency

Deploy in any supported region
Data stays in chosen region
Backup storage in same region (default)
Cross-region backup optional

Enhanced Compliance Environment

For strict compliance requirements:

Additional controls: Enhanced security measures
Dedicated infrastructure: Isolated environment
Stricter policies: Additional restrictions
Compliance support: Dedicated assistance
Available for: HIPAA, PCI DSS, and other regulations

Contact your account team to learn about Enhanced Compliance Environment options.

Audit and monitoring

Audit logs

Track all actions in your organization:

Organization Logs
Project Logs
Service Logs

View organization-level events:

# View organization audit log
# Admin → Organization → Events Log

# Logged events:
# - User invitations and removals
# - Permission changes
# - IdP configuration changes
# - Billing group changes
# - Domain verification

View project-level events:

# View project event log  
# Project → Event log

# Logged events:
# - Service creation/deletion
# - Service configuration changes
# - User access changes
# - Integration changes
# - VPC modifications

View service-specific logs:

# View service logs
avn service logs \
  --project my-project \
  --service postgres-1

# Logs include:
# - Connection attempts
# - Query errors
# - Replication status
# - Performance issues

Security monitoring

Continuous monitoring for security events:

Anomaly detection: Unusual access patterns
Failed login tracking: Multiple failed authentication attempts
Token leaks: GitHub secret scanning partnership
Vulnerability scanning: Regular security assessments
Penetration testing: Independent third-party testing

Software Bill of Materials (SBOM)

Transparency into software components:

# Generate SBOM for project
avn project generate-sbom \
  --project my-project \
  --output csv

# Output includes:
# - OS packages in VMs
# - Service software packages
# - Versions and dependencies
# - Security vulnerability info

SBOM reports are available in CSV and SPDX formats. All services in the project must have latest patches applied.

Data protection

Customer data privacy

Aiven’s commitment to data privacy:

No data access

Operators never access customer data
Exception: Explicit customer request for troubleshooting
All access logged and audited

Data processing agreement

Available for GDPR compliance
Defines data processing terms
Customer remains data controller

Token leak protection

Partnership with GitHub secret scanning
Automatic detection of leaked tokens
Email notification to customers
Recommendation to rotate tokens

Training and policies

Mandatory security training for operations team
Regular policy reviews and updates
Strict data privacy policies

Data retention and deletion

Service Data
Backups
Logs

Stored for service lifetime
Deleted when service terminated
Backups retained per backup policy
VMs destroyed and wiped

# Delete service and all data
avn service terminate \
  --project my-project \
  --service postgres-1

# Note: This permanently deletes:
# - All service data
# - Service configuration  
# - Service users and credentials
# - Backups are retained per policy

Security best practices

Enable VPC peering

Use private network connectivity for production services instead of public access

Use IP allowlists

Even with VPC peering, restrict access by IP address for defense in depth

Verify your domain

Enable managed users for centralized control and better security

Require SAML SSO

Use enterprise identity providers and disable password authentication

Enforce 2FA

Require two-factor authentication if using password login

Use application users

Never use personal accounts for automation - create dedicated application users

Rotate tokens regularly

Revoke and regenerate tokens every 90 days or less

Principle of least privilege

Grant users only the minimum permissions needed for their role

Enable service integrations for logs

Send logs to OpenSearch for longer retention and analysis

Regular security audits

Review users, permissions, IP allowlists, and configurations quarterly

Monitor audit logs

Regularly review organization and project audit logs for suspicious activity

Use termination protection

Enable for critical production services to prevent accidental deletion

Incident response

Reporting security issues

If you discover a security vulnerability:

Security Contacts:
  General Issues: [email protected]
  Critical Issues: Immediate response via support portal
  Responsible Disclosure: [email protected]
  PGP Key: Available on request

Aiven’s incident response

How Aiven handles security incidents:

Detection

Automated monitoring and alerts
Customer reports
Vulnerability disclosures

Assessment

Severity evaluation
Impact analysis
Affected services identification

Containment

Immediate threat mitigation
Service isolation if needed
Prevent spread

Remediation

Fix underlying vulnerability
Deploy patches
Verify resolution

Communication

Customer notification
Status page updates
Incident reports for serious issues

Post-incident review

Root cause analysis
Process improvements
Documentation updates

Time synchronization

Accurate time across all services:

NTP servers: Cloud provider trusted NTP
Backend services: Synchronized time
Customer services: Synchronized time
Region-specific: NTP servers in deployment region

Time Synchronization:
  Protocol: NTP (Network Time Protocol)
  Servers: Cloud provider NTP servers
  Scope: All backend and customer services
  Accuracy: Sub-second precision
  Region: Matches service deployment region

Resources and documentation

Security Whitepapers

Detailed technical documentation on Aiven’s security architecture

Compliance Reports

SOC 2, ISO 27001, and other compliance reports (available to customers)

Data Processing Agreement

GDPR compliance documentation

Responsibility Matrix

Shared responsibility model for security

Next steps

Authentication

Configure SSO and authentication policies

VPC & Networking

Set up private network connectivity

Users & Permissions

Implement least privilege access control

Monitoring & Logs

Set up security monitoring and logging

Get Started

Platform

Services

Developer Tools

Integrations

​Security overview

Data Encryption

Network Security

Access Control

Compliance

​Data encryption

​Encryption at rest

​Encryption in transit

​Backup encryption

​Bring Your Own Key (BYOK)

​Network security

​Connection security

​VPC and network isolation

VPC Peering

Dedicated VMs

​Firewall protection

​Virtual machines and infrastructure

​Cloud provider accounts

​Virtual machine security

​Operator access

​Access control

​Authentication

​Role-based access control (RBAC)

​Managed users

​Compliance and certifications

​Certifications

SOC 2 Type II

ISO 27001

HIPAA

PCI DSS

​Data privacy regulations

​Enhanced Compliance Environment

​Audit and monitoring

​Audit logs

​Security monitoring

​Software Bill of Materials (SBOM)

​Data protection

​Customer data privacy

​Data retention and deletion

​Security best practices

​Incident response

​Reporting security issues

​Aiven’s incident response

​Time synchronization

​Resources and documentation

Security Whitepapers

Compliance Reports

Data Processing Agreement

Responsibility Matrix

​Next steps

Authentication

VPC & Networking

Users & Permissions

Monitoring & Logs

Build docs developers (and LLMs) love

Security overview

Data encryption

Encryption at rest

Encryption in transit

Backup encryption

Bring Your Own Key (BYOK)

Network security

Connection security

VPC and network isolation

Firewall protection

Virtual machines and infrastructure

Cloud provider accounts

Virtual machine security

Operator access

Access control

Authentication

Role-based access control (RBAC)

Managed users

Compliance and certifications

Certifications

Data privacy regulations

Enhanced Compliance Environment

Audit and monitoring

Audit logs

Security monitoring

Software Bill of Materials (SBOM)

Data protection

Customer data privacy

Data retention and deletion

Security best practices

Incident response

Reporting security issues

Aiven’s incident response

Time synchronization

Resources and documentation

Next steps