Skip to main content

​
Encryption in transit

All client connections to Rivestack databases require SSL/TLS. Unencrypted client connections are rejected. The certificate is renewed with ACME DNS-01 and covers the regional database hostnames. Standard PostgreSQL clients can validate it with their operating-system trust store; no Rivestack-specific CA download is needed.
sslmode=require encrypts traffic but does not authenticate the database server. Use verify-full, keep the hostname from the dashboard, and do not replace it with a raw IP address.

​
Data at rest

Rivestack does not currently advertise application-level or customer-managed encryption for the PostgreSQL data directory. Backup traffic is sent to S3-compatible object storage over TLS, but the current pgBackRest configuration does not add client-side repository encryption. Do not rely on an “encrypted at rest” claim when assessing compliance requirements. Contact hi@rivestack.io before placing data that requires a specific at-rest encryption control or customer-managed key policy.

​
Network security

​
Shared cloud firewall

Database VMs are covered by one reconciled Hetzner Cloud Firewall selected by server labels. This avoids Hetzner’s per-project firewall limit. It exposes only the two documented database service ports and restricts SSH to Rivestack operations CIDRs; all other unsolicited public inbound traffic is dropped by the cloud firewall. Dedicated hosts also drop raw public PostgreSQL traffic on 5432, leaving that port for the free shared service and private cluster traffic. Tenant allowlists are enforced on each database host, so adding customers does not create additional Hetzner firewalls:
  • Direct clusters use a persistent nftables source policy in front of PgBouncer.
  • HA clusters enable Hetzner Load Balancer PROXY protocol. A private HAProxy listener reads the original client address, applies the same source policy, and passes the PostgreSQL/TLS stream through to PgBouncer unchanged.
  • IPv4 and IPv6 addresses and CIDR networks are supported. An empty allowlist blocks new public database connections.

​
Configure an IP allowlist

  1. Open the dedicated cluster in the dashboard and select Network.
  2. Add each application, office, VPN, or CI egress address as an IP or CIDR. Both IPv4 and IPv6 are accepted; DNS names are not.
  3. Save the policy. The change is applied asynchronously, and the previous policy remains authoritative until the infrastructure job succeeds.
New clusters start with 0.0.0.0/0 and ::/0, which permits any source that can authenticate. Replace both public networks to restrict access. Saving an empty list intentionally blocks all new public database connections. Before restricting a production cluster, include every stable outbound address used by your applications, administrators, migrations, and monitoring.
The load balancer’s network connection normally hides the client address from a backend. Rivestack enables Hetzner PROXY protocol and terminates that header on the private HAProxy listener, so the allowlist evaluates the original client address without terminating PostgreSQL TLS.
Changes are applied asynchronously to every cluster node. Existing established connections may continue until they close; the new policy controls new connections.

​
Private networking

Cluster nodes use tenant-private networks for database traffic and a regional private network for the distributed consensus service. Private-network placement is not a substitute for authentication or encryption, so client access is still protected by TLS and database credentials.

​
Public port

The dashboard hostname points directly to the VM for a single-node dedicated cluster and to one Hetzner Load Balancer after the cluster is scaled to HA.

​
Authentication

  • Database users: password authentication over required TLS
  • Dashboard: Auth0 authentication with email verification
  • API: authenticated application and provider requests

​
Infrastructure

​
Compliance language

Selecting EU Central keeps the provisioned database nodes in the EU region. Data residency alone is not a compliance certification. Rivestack does not claim a compliance standard or an at-rest encryption control unless it is explicitly stated in your agreement.

​
Reporting vulnerabilities

If you discover a security vulnerability, report it to hi@rivestack.io.