Security, residency & encryption

How Evitrus handles tenant isolation, where cloud data lives, and what is (and is not) available for customer-managed keys.

Tenant isolation

• Every principal belongs to one organisation (tenant).
• Evidence Events, Changes, API keys, and org settings are scoped by tenant; the API never trusts a client-supplied tenant id (the tenant is taken from the session, access JWT, or API key).
• ClickHouse enforces isolation with row policies on SELECT and a CHECK constraint on INSERT, both bound to the fail-closed query setting SQL_tenant_id. Application WHERE tenant_id = … is for index pruning.
• Postgres enforces isolation with FORCE ROW LEVEL SECURITY and SET LOCAL app.tenant_id on every tenant-scoped table.
• Access is permission-based RBAC (resource.action), not role-name checks.

Data residency (EU)

For the managed Evitrus cloud (api.evitrus.io, app.evitrus.io):

• Evidence Events, identity data, and organisation audit logs are hosted in the European Union.
• Transactional email (password reset and similar notices) is delivered by Lettermint, which hosts related account data in the European Union.
• MVP is single-region — there is no per-tenant region picker yet.
• Disaster-recovery copies of EU-hosted stores stay inside the EU.

Exporters you install (Kubernetes, Terraform, GitHub Action, …) run in your environment and only push normalized Evidence Events. Metric overlays are pulled on demand and are not stored as Evitrus’s system of record.

DPA outline, subprocessors, and the security whitepaper: Legal. Contact the Evitrus team during procurement for the current EU region identifier.

Encryption

Layer	Today
In transit	TLS on public HTTPS endpoints
At rest	Provider-managed disk/volume encryption for the event store and Postgres
Customer-managed keys (CMEK)	Not available in closed beta / MVP

CMEK roadmap

CMEK (bring your own KMS key) is an Enterprise deliverable:

1. Design with the first Enterprise design partner (envelope or volume CMEK).
2. Ship within 6 months of the first paid Enterprise contract, or by 2027-Q1, whichever is earlier.

Until CMEK ships, use data portability export for an offline copy under your own keys, or discuss self-hosted options.

Integrity & exit

• Events are append-only with a per-event contentHash (see data portability).
• You can bulk-export Evidence Events as JSON/JSONL at any time.