Security

pganalyze Overview

pganalyze is a monitoring system for PostgreSQL databases. It processes statistics data available from the built-in Postgres statistics views, as well as additional system level data like CPU and I/O performance metrics.

Data Collected And Transferred By pganalyze

All data collected and transferred by pganalyze can be easily verified using the open-source pganalyze-collector program, by running:

pganalyze-collector --dry-run

In particular, amongst other information, pganalyze currently collects the following information:

Schema Information
- Tables (including column, constraint and trigger definitions)
- Indexes
Database Statistics
- Queries (including query text)
- Tables
- Indexes
- Database
- Others (Replication, etc)
Operating System Statistics
- CPU
- Memory
- Storage
Log Information (optional, has to be enabled)

Note that this list may occasionally be out of date and we suggest you reach out to us if you have specific concerns about sensitive data being transferred.

We also support setting up a restricted monitoring user, to guarantee that we cannot access actual table data in your database.

Security Assessments and Compliance

Data Centers

pganalyze's physical infrastructure is hosted and managed within Amazon’s secure data centers and utilize the Amazon Web Service (AWS) technology. Amazon continually manages risk and undergoes recurring assessments to ensure compliance with industry standards. Amazon’s data center operations have been accredited under:

ISO 27001
SOC 1 and SOC 2/SSAE 16/ISAE 3402 (Previously SAS 70 Type II)
PCI Level 1
FISMA Moderate
Sarbanes-Oxley (SOX)

PCI

We use PCI compliant payment processor Stripe for encrypting and processing credit card payments. pganalyze's infrastructure provider is PCI Level 1 compliant.

Physical Security

pganalyze utilizes ISO 27001 and FISMA certified data centers managed by Amazon. Amazon has many years of experience in designing, constructing, and operating large-scale data centers. This experience has been applied to the AWS platform and infrastructure. AWS data centers are housed in nondescript facilities, and critical facilities have extensive setback and military grade perimeter control berms as well as other natural boundary protection. Physical access is strictly controlled both at the perimeter and at building ingress points by professional security staff utilizing video surveillance, state of the art intrusion detection systems, and other electronic means. Authorized staff must pass two-factor authentication no fewer than three times to access data center floors. All visitors and contractors are required to present identification and are signed in and continually escorted by authorized staff.

Amazon only provides data center access and information to employees who have a legitimate business need for such privileges. When an employee no longer has a business need for these privileges, his or her access is immediately revoked, even if they continue to be an employee of Amazon or Amazon Web Services. All physical and electronic access to data centers by Amazon employees is logged and audited routinely.

For additional information see: https://aws.amazon.com/security

Bug Bounty Program

We offer a bug bounty program for security researchers.

Vulnerability Reports

Please report vulnerabilities by email to security@pganalyze.com.

We recommend encrypting your message using PGP for the pganalyze key:

Fingerprint:

C09B 2CAB 0DB3 78F6 E7FD 93F1 0E6D EC71 A2B5 F2F9

Public Key: