Your data moves through us. It never stays.
DLH.io reads your sources with read-only access, encrypts everything in transit and at rest, and deletes your data as soon as it lands in your warehouse. Our controls are independently audited every year.
Audited
SOC 1 & SOC 2 Type II
After every sync
Your data is purged
Compliance
Audited controls your security review can check
Request documents in the Trust CenterSOC 1 & SOC 2 Type II
Independent CPA audits of our controls, including the AICPA trust services criteria. SOC 2 first issued December 2023.
Reports under MNDAHIPAA
We sign a Business Associate Agreement with covered entities. HIPAA Security criteria are assessed as part of our SOC 2 report.
BAA on requestGDPR
Our Terms of Service include a Data Processing Addendum with the European Commission's standard contractual clauses for EU data transfers.
DPA includedPCI DSS
We meet the Payment Card Industry Data Security Standard for handling cardholder data in your pipelines.
PCI compliantAnnual penetration test
An outside firm tests the platform every year, and we keep all underlying software on current, patched versions.
Third-party testedData handling
We move your data. We don't keep it.
DLH.io is a pipeline, not a place your data lives. We ask for the least access possible and hold data only as long as a sync needs it.
Read-only at the source
Databases and SaaS apps only need READ permission. If a source grants more, we never use it.
Scoped at the destination
We create our own schema and tables, write to them, and read back only the data we wrote.
Purged after it lands
Data is deleted from DLH.io as soon as it's written to your destination, normally within eight hours.
30-day hard stop
If your destination is down, we hold data so the sync can resume, then purge it automatically after 30 days.
Credentials in a KMS
Database credentials and OAuth tokens live in a key management system backed by a hardware security module.
No access without you
Support can only see your data if you grant access for a ticket, and you can revoke it at any moment.
Infrastructure
Secure from the wire to the server room
- 01
Encrypted in transit and at rest
TLS 1.2+ on every connection, HTTP redirected to HTTPS with HSTS, and AES-256 for data at rest. Database connections use SSL by default.
- 02
Locked-down production
Production is reachable only through hardened bastion hosts with MFA. IAM policies enforce least privilege, and privileged actions are audit-logged.
- 03
Segregated networks
Networks are split by security level, with restrictive firewalls on every connection between them.
- 04
Built on AWS and Google Cloud
Physical and environmental security is handled by our cloud providers, which hold SOC 1/2/3, PCI DSS, and ISO 27001.
You control who gets in
- SAML 2.0 single sign-on
- Sign in through Okta, Google Workspace, or Azure ADFS.
- Your people only
- Only users your organization registers, plus DLH.io operations staff, can open your dashboard.
- Metadata, not data
- The dashboard shows sync status and table and column names, never the rows themselves.
- Fast offboarding
- Admins can ask us to revoke a member's access, and we do it within 24 hours.
How our team works
- Every employee follows written security policies, which are reviewed regularly.
- Two-factor authentication and strong passwords are required for administrative access.
- Development follows industry secure-coding guidance such as OWASP.
- No security breach to date. If one is ever confirmed, affected customers hear from us right away.
Responsible disclosure
Found a vulnerability? Tell us.
Report it through our contact page. Include where the issue is, its potential impact, and the steps to reproduce it. Proof-of-concept scripts and screenshots help.
5 business days
We respond to every report within this window.
Good faith
Avoid privacy violations and service disruption while testing.
Safe harbor
Follow these guidelines and we won't take legal action.
Go deeper
Platform security
Keys, connection options, data residency, and PII controls.
Trust Center
SOC 2 report, security policies, and compliance documents.
Security documentation
The full technical detail behind this page.
IP allowlist
The addresses to allow through your firewall.
Support data access
How to grant, limit, or revoke support access.
Security questionnaire on your desk?
Bring it to a call. We'll walk your team through our controls, share the SOC 2 report under NDA, and answer what the docs don't.