This document describes the security measures used by Softnix Data Lakehouse to help protect organizational data and systems. It focuses on a public-facing overview and avoids technical details that could create security risk.
1. Security Overview
Softnix Data Lakehouse is a platform for storing, connecting, processing, and analyzing data from multiple types of organizational data sources, including databases, files, and API services.
The system is designed to support on-premise deployment, allowing data to remain under the customer's organizational control without requiring data to be sent to third parties.
Security coverage includes user authentication, data access control, encryption, audit logging, and infrastructure-related controls.
2. Authentication and User Management
Softnix Data Lakehouse supports system user accounts and can connect to organizational identity systems such as OAuth or Identity Providers that support OpenID Connect, enabling users to use Single Sign-On with other enterprise systems.
Passwords are stored with appropriate cryptographic protection and are not stored in readable form. The system uses tokens to manage sessions securely, with limited lifetimes and automatic expiration.
User account operations such as creation, update, suspension, or password reset are managed by administrators, and changes are recorded in audit logs.
3. Access Control
Softnix Data Lakehouse uses Role-Based Access Control and Group-Based Access Control to define permissions by user role and group.
Administrators can define which groups may access capabilities such as query execution, Data Catalog viewing, Data Quality configuration, or system administration. Permissions can also define which tables or columns each group may access.
The system supports masking sensitive column-level data, such as personal or financial information. Users without full access can see masked values instead of real values, helping ensure users access only the data needed for their work.
4. Data Protection
Data exchanged between users and the system is protected with encrypted HTTPS/TLS connections to reduce the risk of interception or tampering in transit. This also applies to connections between the system, external data sources, and identity systems where applicable.
Stored data is separated by usage type, such as user data, data source connection information, metadata, permission data, and audit logs. Credentials used to connect to data sources are encrypted before storage and are not exposed in plaintext through APIs.
Data covered by masking policies is transformed before being returned from processing, so real values are not exposed to users without authorization. Retention periods can be adjusted to align with organizational policy and compliance requirements.
5. Application Security
The system includes application and API security controls such as:
- Permission checks before access to system data or functions
- Access limited to users authorized by role
- Protection against database command injection and validation of incoming data
- Automatic session invalidation when sessions expire or are invalid
- Security headers and Cross-Origin policies to reduce browser-based risks
- Separation of privileges between general users and administrators
These controls help reduce risks such as unauthorized access, injection attacks, session hijacking, and malformed input.
6. Audit Logging and Traceability
Softnix Data Lakehouse includes audit logging for important events such as login, logout, user changes, permission management, data source connection activity, query execution, and Data Quality configuration changes.
Audit logs help administrators review activity, analyze events, and support security governance processes. Each record can include relevant information such as time, actor, action, target, and IP address.
Access to audit logs is controlled by permissions, and is generally limited to administrators. Filtering and search capabilities support investigation and management workflows.
7. Infrastructure Security
Softnix Data Lakehouse supports deployment in isolated and controlled environments, such as on-premise servers or containerized environments.
For large organizations, data connection, query processing, metadata storage, and presentation layers can be separated to improve scalability, flexibility, and access boundary control between components.
8. Deployment Options
Softnix Data Lakehouse supports deployment options based on customer security and operational requirements, such as:
- On-premise deployment
- Single-node deployment for smaller environments
- Separated deployment for large environments or high data volume
- Deployment in environments with controlled external connectivity
- Deployment in environments requiring high network isolation
9. Continuous Security Improvement
Softnix continuously improves security controls across access review, encryption, secret management, configuration review, and security testing within the development lifecycle.
10. Security Reporting
If customers identify a security concern, they may contact the system administrator or Softnix support team so the issue can be reviewed and handled through the appropriate process.
This document is intended as a public-facing overview and may be updated as the system evolves.