Kloudfuse Security

Deployed entirely within the customer’s cloud account, the Data Plane ingests, stores, and processes telemetry data locally. This approach ensures data privacy and compliance.

Optionally managed by Kloudfuse to monitor the health and lifecycle of the Kloudfuse deployment.

Every user holds one of three roles — Admin, Editor, or Viewer — which sets what they can create, edit, and administer. Roles can be assigned manually or synchronized from your identity provider’s groups. See Role-Based Access Control.

Policies define which telemetry streams an identity may query — Metrics, Events, Logs, Traces, APM, and RUM — each set to All, None, or Filtered by label. A policy attaches to a team, an individual user, or a service account, and resolves to a label filter that is applied to every query before it reaches the data layer. Editors and Viewers are governed by their policy, and default_rbac_policy: rbac_allow_none denies data to any of them who has no policy assigned; the Admin role is evaluated first and always receives full data access, so it should be held by platform administrators only. See RBAC Policy Management.

Dashboards and alerts live in folders, each granting View, Edit, Admin, or No Access to users, teams, roles, and service accounts independently of the data policy. See Folder Permissions.

Enterprise authentication through SAML, Google, Okta, JumpCloud, or any OIDC provider, with the option to disable local logins entirely. See Kloudfuse Authentication Introduction.

Ingest endpoints can require an API key, sent as the Kf-Api-Key header or in the agent’s native API-key field. UI-managed keys are stored only as a SHA-256 hash, may carry an expiry, support several live tokens for rotation without downtime, and can attach labels to the data they admit — which the policies above can then filter on. See Ingestion Authentication with API Key.

Record authentication events and changes to users, groups, service accounts, policies, and folder permissions — who changed what, and when. They are a first-class log stream, so they are queryable in the product and can be archived alongside other logs. See Enable Audit and Performance Logs.

Record every query the platform executes, the query service that served it, and its duration, attributed to the requesting user for UI and service-account queries; internal service-to-service calls and alert evaluations carry no user. Together with audit logs they record both changes to the platform and reads of the data in it. See Performance Log Fields.

All telemetry data resides in the customer’s cloud account.

The Datadog Agent and the OpenTelemetry Collector can both mask matched card numbers, credentials, and other sensitive values before telemetry leaves your network, reducing the regulated data that reaches the platform. See Keeping Sensitive Data Out of Kloudfuse.

FuseQL’s luhn predicate validates card-number checksums in query, so a scheduled search can detect card-shaped values in log bodies that slipped past collector masking. See Detect What Got Through.

Ingests various log types (application, security, system, network) with flexible parsing and indexing.

Rule-based archival of logs to object storage with on-demand retrieval. Archiving the audit log stream gives a retained copy outside the query store. See Archiving Logs and Hydration.

Permanent deletion of stored metrics, events, logs, and traces by filter, for retention and right-to-erasure obligations. See Data Scrubbing.

Ensures high availability and disaster tolerance.

Supports TLS encryption for data in transit.

Address CVEs and apply security patches.

All Kloudfuse container images in AWS ECR are signed with cosign using an AWS KMS key; the private key never leaves KMS, and signatures are stored as OCI artifacts alongside the image. Verify signatures before deployment with the public key or directly against KMS. See Verify Image Signatures.

Pipelines can pull and verify images with short-lived OIDC credentials instead of stored AWS keys. See Audit Images from ECR.

The FedRAMP chart is built for FIPS-compliant environments (FedRAMP Installation), and a FIPS build of the Envoy gateway is published for deployments that require it (Standalone Envoy Gateway).

The kfuse-fed chart deploys Kloudfuse on AWS with managed RDS, ElastiCache, and MSK in place of bundled in-cluster services, and encrypts all persistent data with customer-managed KMS keys to satisfy the NIST SP 800-53 SC-28 control family required by the FedRAMP High and Moderate baselines. See FedRAMP Installation and EBS Volume Encryption (FedRAMP).

For PCI DSS, HIPAA, GDPR, and similar frameworks, regulated data is masked before it reaches the platform, access to what arrives follows least privilege, and changes and queries are logged. The controls behind each of those are described above; the customer-facing guide is Keeping Sensitive Data Out of Kloudfuse.

Enables alerts and health checks for platform components.

Control plane provides observability into data plane operations.

Tracks known issues and resolutions to ensure transparency and accountability.