SAML SSO and SCIM
Sign in through any SAML or OIDC identity provider. SCIM provisions and removes users the minute HR does.
SAML 2.0 · OIDC · SCIM 2.0
Enterprise · SOC 2 Type II · HIPAA
The data layer your auditors like too.
Basalt runs realtime tables for banks, insurers and health networks in 38 regions. Every row is encrypted, traced to its source event and kept where your regulator wants it.
38 regions
99.999% SLA
BYOC on AWS, GCP, Azure
Compliance
Audited every year. Reports on request.
Independent auditors test our controls against six frameworks. Your security team gets the full reports under NDA within one business day.
SOC 2 Type II
Annual audit · AICPA
ISO 27001
Certified · 2025 cycle
HIPAA
BAA on Enterprise
GDPR
EU DPA · SCCs
PCI DSS
Level 1 · v4.0
CSA STAR
Level 2 · CAIQ
Architecture
Five layers. One audit trail.
Guarantees in every plan
Exactly-once ingest
Retries, replays and duplicate webhooks never count twice.
Dedup window 7 d
Encrypted end to end
AES-256 at rest, TLS 1.3 in transit, keys you can revoke.
FIPS 140-3
Signed, append-only log
Every change is chained and signed. Nothing is edited in place.
SHA-256 chain
Pinned to a region
Rows, backups and logs stay in the region you choose.
38 regions
Point-in-time recovery
Restore any view to any second of the past year.
RPO 0 · RTO 15 min
Deployment
Run it where your risk team sleeps.
Three ways to deploy the same engine. Move between them without rewriting a view or changing an endpoint.
Deployment · Basalt Cloud
Shared cells, private by default.
Your tenant runs in a multi-tenant cell with per-tenant encryption keys, network policies and quotas. The fastest way to production, with the same controls our largest customers use.
Isolation
Per-tenant keys
Regions
38, pick any
Uptime SLA
99.99%
Go-live
Same day
Deployment · Dedicated
A cell with your name on it.
Your workloads run on single-tenant compute and storage that no other customer touches. Upgrades follow your change windows, and capacity is reserved ahead of peak.
Isolation
Single tenant
Regions
Any, or several
Uptime SLA
99.999%
Go-live
5 business days
Deployment · Bring your own cloud
Our engine, your account.
The data plane runs inside your AWS, GCP or Azure account. Rows and keys never leave your VPC. Only health metrics and metadata reach our control plane, and you can cut that link at any time.
Isolation
Your VPC
Clouds
AWS · GCP · Azure
Uptime SLA
99.99%
Go-live
2 to 3 weeks
Customer story
Orbitly moved fraud review from minutes to milliseconds.
Our regulators asked how a payment was scored three months ago. We replayed the exact feature row in under a second, and the audit closed that afternoon.
Ines Valdés
CISO, Orbitly
Fraud review lag
47 min4 ms
Audit evidence prep
3 weeks1 query
Chargeback losses
$2.1M / yr$0.6M / yr
Security
Controls your team already asks for.
Everything below ships on Enterprise with no add-on fees. Our security brief maps each control to SOC 2, ISO 27001 and HIPAA clauses.
Row-level security
Policies written in SQL decide which rows each role, tenant or API key can read. The engine enforces them on every read.
Per role · Per key · Per tenant
Customer-managed keys
Bring keys from AWS KMS, Cloud KMS or Key Vault. Revoke one and every replica, backup and cache goes dark.
BYOK · HYOK · Auto rotation
Audit log streaming
Every login, query, schema change and key use is signed and streamed to your log tool, Watchly or your object storage.
Signed · 1 s delivery · 7 yr retention
Private link
Reach Basalt over AWS PrivateLink, Private Service Connect or Azure Private Link. No traffic touches the public internet.
No public endpoints · IP allowlists
Data residency
Pin projects to the EU, US, UK, Canada, Australia or Japan. Rows, logs and backups stay inside that border.
12 jurisdictions · 38 regions
Support
A person who knows your schema.
Support engineers in Reykjavík, Toronto and Singapore cover every hour. Mission critical customers get a named engineer and a bridge line a human picks up within minutes.
| Support plan | StandardIncluded | PremiumScale add-on | Mission criticalEnterprise |
|---|---|---|---|
| First response, P1 | 4 business hours | 1 hour | 15 minutes |
| Channels | Email, portal | Shared chat, phone | Shared chat, phone bridge, war room |
| Named engineer | No | Yes | Yes, plus a backup |
| Architecture reviews | On request | Twice a year | Quarterly |
| Uptime SLA | 99.95% | 99.99% | 99.999% |
Trusted by 140 regulated teams
FAQ
Questions from security reviews.
How does procurement work?
We sign annual or multi-year order forms, accept your paper for MSAs, and work through Coupa, Ariba or a PO. Most security reviews close in two to three weeks with our pre-filled SIG and CAIQ.
Can our data stay in one country?
Yes. Pin a project to a region or a jurisdiction and rows, logs, backups and support access stay inside it. Residency is enforced by policy and checked in every audit.
Do you run penetration tests?
An independent firm tests the platform twice a year and after every major release. Enterprise customers get the summary reports under NDA and may run their own tests with 48 hours’ notice.
Will you sign our DPA?
Our DPA covers GDPR, UK GDPR, CCPA and Swiss law with Standard Contractual Clauses built in. We review customer DPAs too, and we sign a BAA for HIPAA workloads.
How do we migrate from our current stack?
A migration engineer maps your Kafka topics, CDC sources and views to Basalt, then runs both systems side by side. Teams usually cut over in four to eight weeks with zero downtime.
Get started
Set your data in stone.
Free up to 10M events a month. No card, no sales call. Your first pipeline is live in about four minutes.