Security is built into federation
SemanticFed enforces governance where it matters — at the query edge — and queries your data in place so you move and copy less. Here is how we approach security and data protection.
This page describes the SemanticFed security model. It is not a certification claim.
How we protect your data
The security model SemanticFed is built around, end to end
Encryption in transit & at rest
Connections to SemanticFed and to your sources use TLS, and platform secrets are held in AWS Secrets Manager, separately for each environment, rather than in config or code.
Policy at the query edge
Row filters, column masking, and access rules are enforced on every federated query, before results return — consistently, no matter which underlying source the data came from.
Inherited identity & RBAC
Authentication and role-based access control are inherited from the Burdenoff platform and enforced at the edge. SemanticFed never re-implements auth.
Audit & lineage
Every federated query is attributable and logged with the policy that applied, and every dataset carries lineage back to its physical sources — so access reviews read as one consistent record.
Privacy by architecture
Federation changes the privacy calculus — querying in place means moving and storing less.
Query in place
Because federation queries data where it lives, regulated data can stay inside its residency boundary instead of being copied out to be analyzed.
Data minimization
Push-down means a query reads only the rows and columns it needs — we move the minimum, not whole tables, and we keep no copy by default.
You keep custody
Your source systems remain yours. SemanticFed queries them with scoped credentials; it does not take ownership of your underlying data stores.
No data selling
We never sell your data or use it for anything other than providing the service to you.
Compliance posture
How SemanticFed keeps your data where it belongs, stated plainly.
GDPR-aware by design
Built to support data-minimization, access, and residency requirements.
Data residency
Query-in-place keeps regulated data inside its jurisdiction.
Hosted in India
Hosted on Amazon Web Services in the Mumbai (ap-south-1) region.
Security documentation
Ask us for our Security Exhibit and the controls behind each item on this page.
Certification status
Where we stand today. When a report or certificate is issued, we will name the auditor and the period it covers here.
SOC 2 Type II
Not heldWe have completed a readiness assessment against the AICPA Trust Services Criteria (Security, Availability, Confidentiality). No CPA firm has been engaged yet, so there is no report to share.
ISO/IEC 27001:2022
Not certifiedWe have drafted the ISMS scope, policy and Statement of Applicability and assessed our controls against Annex A. No certification body has audited us yet.
Hosting provider
AWS’s own reportsSemanticFed runs on AWS, whose data centres are covered by AWS’s own SOC 2 reports and ISO/IEC 27001 certification. Those attestations belong to AWS, not to SemanticFed.
Operate securely
Practices we recommend to keep your federation deployment locked down
Scoped source credentials
Connect each source with least-privilege, read-scoped credentials so SemanticFed can only do what you intend.
Strong authentication
Use the platform’s authentication and RBAC, and grant access to models and sources on a need-to-know basis.
Review the query plan
Every federated query exposes an inspectable plan, so you can verify exactly what ran where before trusting a result.
Version your model
Keep semantic definitions and policy as reviewed, versioned changes so governance is traceable, not ad-hoc.
Responsible disclosure
If you discover a potential security issue in SemanticFed, please report it to us privately so we can investigate and fix it before any details are made public. We welcome responsible disclosure and will acknowledge your report.
Governed by design
Federation that enforces your policy everywhere and moves your data less.