Timescale security

Timescale implements a variety of secure software engineering practices in TimescaleDB, including code static analysis for security hardening, automated scanning for dependency vulnerabilities, and code security reviews. Additionally, Timescale has developed the https://github.com/timescale/pgspot open-source extension that we use to identify security issues with Postgres extensions. This has helped tighten our security posture. Timescale products do not have any identified weaknesses.

This page lists the additional things we do to ensure operational security and to lock-down Timescale Cloud services. To see our security features at a glance, see Security at Timescale.

Your data on Timescale Cloud is encrypted both in transit and at rest. Both active databases and backups are encrypted.

Timescale Cloud uses AWS as its cloud provider, with all the security that AWS provides. Data encryption uses the industry-standard AES-256 algorithm. Cryptographic keys are managed by AWS Key Management Service (AWS KMS). Keys are never stored in plaintext.

For more information about AWS security, see the AWS documentation on security in Amazon Elastic Compute Cloud and Elastic Block Storage.

Customer access to Timescale Cloud services is only provided over TLS-encrypted connections. There is no option to use unencrypted plaintext connections.

When using VPC peering, no public Internet-based access is provided to the services. Service addresses are published in public DNS, but they can only be connected to from the customer's peered VPC using private network addresses.

VPC peering only enables communication to be initiated from your Customer VPC to Timescale Cloud services running in the Timescale VPC. Timescale cannot initiate communication with your VPC. To learn how to set up VPC Peering, see Secure your Timescale Service with VPC Peering and AWS PrivateLink.

Normally all the resources required for providing Timescale Cloud services are automatically created, maintained and terminated by the Timescale infrastructure. No manual operator intervention is required.

However, the Timescale Operations Team has the capability to securely log in to the service Virtual Machines for troubleshooting purposes. These accesses are audit logged.

No customer access to the virtual machine level is provided.

Customer data privacy is of utmost importance at Timescale. By default, your Timescale data is encrypted both in transit and at rest. To do this, Timescale uses various technical mechanisms, processes, and software development lifecycle practices, to help ensure the security and privacy of your data.

Timescale complies with the European Union's General Data Protection Regulation (GDPR), and all practices are covered by the Timescale Privacy Policy and the Timescale Terms of Service. All customer data is processed in accordance with Timescale's GDPR-compliant Data Processor Addendum, which applies to all Timescale customers.

Timescale operators never access customer data, unless explicitly requested by the customer to troubleshoot a technical issue. The Timescale operations team has mandatory recurring training regarding the applicable policies.