Enterprise · SOC 2 Type II · HIPAA
The data layer your auditors like too.
Basalt runs realtime tables for banks, insurers and health networks in 38 regions. Every row is encrypted, traced to its source event and kept where your regulator wants it.
38
regions
99.999%
SLA
BYOC
on AWS, GCP, Azure
Compliance
Audited every year. Reports on request.
Independent auditors test our controls against six frameworks. Your security team gets the full reports under NDA within one business day.
SOC 2 Type II
Annual audit · AICPA
ISO 27001
Certified · 2025 cycle
HIPAA
BAA on Enterprise
GDPR
EU DPA · SCCs
PCI DSS
Level 1 · v4.0
CSA STAR
Level 2 · CAIQ
Architecture
Five layers. One audit trail.
Request path
Top to bottom
Guarantees in every plan
Exactly-once ingest
Retries, replays and duplicate webhooks never count twice.
Dedup window 7 d
Encrypted end to end
AES-256 at rest, TLS 1.3 in transit, keys you can revoke.
FIPS 140-3
Signed, append-only log
Every change is chained and signed. Nothing is edited in place.
SHA-256 chain
Pinned to a region
Rows, backups and logs stay in the region you choose.
38 regions
Point-in-time recovery
Restore any view to any second of the past year.
RPO 0 · RTO 15 min
Deployment
Run it where your risk team sleeps.
Three ways to deploy the same engine. Move between them without rewriting a view or changing an endpoint.
Basalt Cloud
Dedicated
Bring your own cloud
Deployment · Basalt Cloud
Shared cells, private by default.
Your tenant runs in a multi-tenant cell with per-tenant encryption keys, network policies and quotas. The fastest way to production, with the same controls our largest customers use.
Isolation
Per-tenant keys
Regions
38, pick any
Uptime SLA
99.99%
Go-live
Same day
Customer story
Orbitly moved fraud review from minutes to milliseconds.
Orbitly · Payments
Dedicated · 6 regions
Our regulators asked how a payment was scored three months ago. We replayed the exact feature row in under a second, and the audit closed that afternoon.
IV
Ines Valdés
CISO, Orbitly
Fraud review lag
47 min
4 ms
Audit evidence prep
3 weeks
1 query
Chargeback losses
$2.1M / yr
$0.6M / yr
Read the Orbitly story
Security
Controls your team already asks for.
Everything below ships on Enterprise with no add-on fees. Our security brief maps each control to SOC 2, ISO 27001 and HIPAA clauses.
SSO
SAML SSO and SCIM
Sign in through Okta, Entra ID or Google Workspace. SCIM provisions and removes users the minute HR does.
SAML 2.0 · OIDC · SCIM 2.0
RLS
Row-level security
Policies written in SQL decide which rows each role, tenant or API key can read. The engine enforces them on every read.
Per role · Per key · Per tenant
CMK
Customer-managed keys
Bring keys from AWS KMS, Cloud KMS or Key Vault. Revoke one and every replica, backup and cache goes dark.
BYOK · HYOK · Auto rotation
LOG
Audit log streaming
Every login, query, schema change and key use is signed and streamed to Splunk, Datadog or your S3 bucket.
Signed · 1 s delivery · 7 yr retention
PL
Private link
Reach Basalt over AWS PrivateLink, Private Service Connect or Azure Private Link. No traffic touches the public internet.
No public endpoints · IP allowlists
RES
Data residency
Pin projects to the EU, US, UK, Canada, Australia or Japan. Rows, logs and backups stay inside that border.
12 jurisdictions · 38 regions
Support
A person who knows your schema.
Support engineers in Reykjavík, Toronto and Singapore cover every hour. Mission critical customers get a named engineer and a bridge line a human picks up within minutes.
Support plan
Standard
Included
Premium
Scale add-on
Mission critical
Enterprise
First response, P1
4 business hours
1 hour
15 minutes
Channels
Email, portal
Shared Slack, phone
Shared Slack, phone bridge, war room
Named engineer
No
Yes
Yes, plus a backup
Architecture reviews
On request
Twice a year
Quarterly
Uptime SLA
99.95%
99.99%
99.999%
FAQ
Questions from security reviews.
How does procurement work?
We sign annual or multi-year order forms, accept your paper for MSAs, and work through Coupa, Ariba or a PO. Most security reviews close in two to three weeks with our pre-filled SIG and CAIQ.
Can our data stay in one country?
Yes. Pin a project to a region or a jurisdiction and rows, logs, backups and support access stay inside it. Residency is enforced by policy and checked in every audit.
Do you run penetration tests?
An independent firm tests the platform twice a year and after every major release. Enterprise customers get the summary reports under NDA and may run their own tests with 48 hours’ notice.
Will you sign our DPA?
Our DPA covers GDPR, UK GDPR, CCPA and Swiss law with Standard Contractual Clauses built in. We review customer DPAs too, and we sign a BAA for HIPAA workloads.
How do we migrate from our current stack?
A migration engineer maps your Kafka topics, CDC sources and views to Basalt, then runs both systems side by side. Teams usually cut over in four to eight weeks with zero downtime.
