Data and tenancy
This page exists to be read before a security review, not during one. It says plainly where your data lives and how it is kept separate from other customers'.
Two models
| Shared (Launch, Team, Division) | Dedicated (Enterprise) | |
|---|---|---|
| Compute | Shared | Its own AWS account |
| Database | Shared, access-controlled per customer | Its own instance |
| Region | Chosen at signup | Any region |
| Credentials | Encrypted with your instance's key | Encrypted with your instance's key |
What "shared" actually means
On the shared tiers your data is stored in a shared database, separated from other customers by enforced database-level access controls, and is never accessible to another customer. Your monitoring, credentials and incident history remain private to your organisation.
The enforcement is in the database itself rather than in application code. Every row carries an owner, and the database refuses to return rows belonging to anyone else — regardless of what a query asks for. A query that forgets to filter returns nothing rather than returning someone else's data.
On the shared tiers we do not say you have your own database, because you do not. If physically separate infrastructure is a requirement, that is the Enterprise tier, and we would rather tell you now than have it surface during procurement.
Dedicated
On Enterprise your instance runs in an AWS account created for your organisation, with its own database. No infrastructure is shared with any other customer, and you choose the region.
Credentials
Integration credentials are encrypted at rest with AES-256-GCM using a key generated for your instance during provisioning. The key is held by the instance and is not stored in the database, so reading the database alone does not yield usable credentials.
Export and deletion
- Export — available at any time from the console.
- Deletion — on request. We record that it happened and when.
- Suspension — does not delete anything. Your data is retained and comes back when the account is reinstated.
Who at Thalamus can see your data
Nobody, by default. Support access requires a grant that records who, why and for how long; it expires automatically within 24 hours, and every use is logged. You can review the whole history and revoke a grant at any time. See team and roles.