# Features & Responsibilities Matrix

All security features that are available on e6data are listed below, along with the responsibility for configuring and managing each.

## Network Access Controls

<table><thead><tr><th width="365.3333333333333">Feature</th><th align="center">Cloud</th><th>Responsibility</th></tr></thead><tbody><tr><td>Deploy into an EKS Cluster that you manage and secure. By default is no ingress allowed to the data plane.</td><td align="center">AWS</td><td>Deployed by the user, using Terraform &#x26; Helm templates provided by e6data.</td></tr><tr><td>Authenticated access from users or clients to the e6data control plane UI and APIs</td><td align="center">AWS</td><td>Credentials to access UI &#x26; Personal Access Tokens for APIs to be generated by users. </td></tr><tr><td>Private access (or private link) from the data plane to the e6data control plane</td><td align="center">AWS</td><td>Deployed by the user, using Terraform &#x26; Helm templates provided by e6data.</td></tr><tr><td>IP access lists to control access to e6data control plane UI and APIs over the internet</td><td align="center">AWS</td><td>Only Kubernetes management access between the e6data control plane and data plane. Any other access should be provided by users.</td></tr><tr><td>Ingress for 3rd party querying tools to access the engine.</td><td align="center">AWS</td><td>User should enable Kubernetes Ingress for external connectors.</td></tr></tbody></table>

## User and Group Management

<table><thead><tr><th width="386.3333333333333">Feature</th><th align="center">Cloud</th><th>Responsibility</th></tr></thead><tbody><tr><td>Use the cloud service provider identity management for seamless integration with cloud resources</td><td align="center">AWS</td><td>e6data</td></tr><tr><td>Single Sign-On with identity provider integration (you can enable MFA via the identity provider)</td><td align="center">AWS</td><td>Can be configured in the e6data console.</td></tr><tr><td>Service principals or service accounts to manage application identities for automation</td><td align="center">AWS</td><td>e6data</td></tr><tr><td>User account locking to temporarily disable a user’s access to e6data</td><td align="center">AWS</td><td>e6data</td></tr><tr><td>Role-based access controls to provide least required privileges for users/groups. </td><td align="center">AWS</td><td>Configured by user.</td></tr></tbody></table>

## Access Management

<table><thead><tr><th width="384.3333333333333">Feature</th><th align="center">Cloud</th><th>Responsibility</th></tr></thead><tbody><tr><td>Fine-grained permission-based access control to all e6data objects including workspaces, catalog, clusters and queries</td><td align="center">AWS</td><td>Users should configure access to their team members.</td></tr><tr><td>Secure API access with personal access tokens with permission management</td><td align="center">AWS</td><td>e6data provides unique tokens in the Console for secure access.</td></tr><tr><td>Segment users, workloads and data with different security profiles in multiple workspaces</td><td align="center">AWS</td><td>Use separate workspaces where possible to segment users who need access to different data sources.</td></tr></tbody></table>

## Data Security

<table><thead><tr><th width="389.3333333333333">Feature</th><th align="center">Cloud</th><th>Responsibility</th></tr></thead><tbody><tr><td>Encryption of control plane data at rest</td><td align="center">AWS</td><td>e6data (enabled by default)</td></tr><tr><td>Encryption in transit of all communications between the e6data control plane and customer data plane</td><td align="center">AWS</td><td>e6data (enabled by default)</td></tr></tbody></table>

## Workload Security

<table><thead><tr><th width="391.3333333333333">Feature</th><th align="center">Cloud</th><th>Responsibility</th></tr></thead><tbody><tr><td>Manage code versions effectively with repos</td><td align="center">AWS</td><td>e6data</td></tr><tr><td>Built-in secret management to avoid hardcoding credentials in code</td><td align="center">AWS</td><td>e6data</td></tr><tr><td>Managed data plane docker image regularly updated with patches, security scans and basic hardening</td><td align="center">AWS</td><td>e6data</td></tr><tr><td>Contain costs, enforce security and validation needs with cluster policies</td><td align="center">AWS</td><td>e6data</td></tr><tr><td>Immutable short-lived infrastructure to avoid configuration drift</td><td align="center">AWS</td><td>e6data</td></tr><tr><td>Enhanced hardening with security monitoring and vulnerability reports of managed data plane images</td><td align="center">AWS</td><td>e6data</td></tr></tbody></table>

## Auditing & Logging

<table><thead><tr><th width="393.3333333333333">Feature</th><th align="center">Cloud</th><th>Responsibility</th></tr></thead><tbody><tr><td>Comprehensive and configurable audit logging of activities of e6data users</td><td align="center">AWS</td><td>Logged by e6data. Can be consumed by users through Console or API.</td></tr><tr><td>Logging of run queries</td><td align="center">AWS</td><td>Logged by e6data. Can be consumed by users through Console or API.</td></tr><tr><td>e6data infrastructure logging</td><td align="center">AWS</td><td>Logged by e6data. Can be consumed by users through Console or API.</td></tr></tbody></table>

## Security Certifications

| Certification | Cloud |
| ------------- | :---: |
| ISO 27001     |  AWS  |
| ISO 27017     |  AWS  |
| ISO 27018     |  AWS  |
| ISO 27701     |  AWS  |
| SOC 2 Type 1  |  AWS  |